df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

There are valuable lessons to be learned from the cybersecurity stories of a challenging year.

The 9 Worst Recent Data Breaches of 2020

The way you respond could significantly reduce the impact it has on your organization.

Statistically, there’s almost a one in three chance (29.6%) that your business will experience a data breach in the next two years, according to [a 2019 study by IBM and the Ponemon Institute](https://www.ibm.com/account/reg/signup?formid=urx-42215). Your company [might even be getting hacked](https://www.cnbc.com/2015/07/29/most-firms-face-significant-daily-or-weekly-cyberattacks-accenture.html) as you read this because of almost two-thirds experience attacks on a weekly basis.

However, [IBM’s 2020 study](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/) found that teams that had a tested incident response plan (and a team to run it) saved an average of $2M (51.8% savings on the cost of an average data breach) compared with those that didn’t.

So although prevention is an essential part of your cybersecurity efforts, the way you respond following a breach is just as important with regard to how it impacts your organization.

The right way to respond after a breach has occurred is different in every case (it depends highly on what type of data was taken, how the breach occurred, and more). But there are a number of strategic best practices to follow that will help you limit the [impact on your business](https://auth0.com/blog/data-breaches-and-business-resilience-what-s-the-relationship/).

Here are four critical high-level steps that your response should include.

## 1. Consult With Legal Counsel

Most states/countries have legislation around security breaches involving personal information (in various levels of comprehensiveness and completeness). And you’ll need to follow them after a breach; otherwise, you could face severe consequences.

The General Data Protection Regulation ([GDPR](https://gdpr-info.eu/)) is a great example of legislation that has severe penalties for not following its requirements. In the event of a breach, you’re required to notify your users within 72 hrs; if you fail to do so, you could see fines as high as €20M or 4% of the previous year’s annual revenue.

However, the legal ramifications of a breach are often hard to assess in some countries ([the United States, for instance](https://iclg.com/practice-areas/data-protection-laws-and-regulations/usa)) because their data protection laws are fragmented and inconsistent. So it’s worth considering independent legal counsel with data privacy expertise to ensure that you’re doing everything that’s required.

Bottom line, your legal requirements will affect everything you do next. So start here to ensure you have an accurate picture of your obligations.

## 2. Secure Your Data and Systems

After a breach, you need to secure your systems and limit further data loss right away. It could save you an average of $164,386, according to [IBM’s 2020 study](https://www.ibm.com/security/data-breach). However, you’ll want to ensure that you do it the right way &mdash; you don’t want to obstruct a criminal investigation. Here are the best practices you’ll want to follow.

### Determine The Scope of The Breach

First things first: Determine the **entire** scope of the breach. Otherwise, you may miss something and fail to completely stop it.

To determine the scope of a breach, assemble a team of experts (your Incident Response (IR) team) who are capable of determining the following:

1. **What was accessed?** Which parts of your systems were affected, and what data did it contain?
2. **How was it accessed?** What were the vulnerabilities that allowed unauthorized access?
3. **What (if anything) was taken?** Not all breaches result in stolen data, but you’ll need to determine if anything was stolen because it determines the steps you’ll need to take next.
4. **Is your data available to the public on the internet?** If you’re unsure, start searching right away to determine if it is.

The best people for your IR team will depend on the breach. But they could include your legal counsel, IT team, cybersecurity team, HR team, communications team, and more. Consider hiring an independent forensics team to help you collect evidence because some of the actions you take to stop a breach may affect an investigation.

Ideally, you should have your IR team predetermined and trained to assess the scope of any breach before one occurs. It’s one of the [most effective ways to limit the effects of a breach on your business](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/).

### Secure Relevant Equipment

As you determine the scope of the breach, immediately take any affected equipment (servers, computers, etc.) offline, and secure related physical locations associated with them. This will prevent any further unauthorized access.

However, be sure to leave that equipment turned on until forensics has a chance to look at it. Otherwise, it may obscure the collection of important evidence (like traces of malware, etc.).

Additionally, [update the login credentials](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) of people who have authorized access to the systems/physical locations that were breached, regardless of whether that was the cause. Compromised credentials are the cause of [over 19% of all breaches](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/), and this extra step ensures that you won’t receive another attack on the same data this way.

### Remove Breached Data From The Internet (If Possible)

The faster you remove any breached data from the internet, the less impact it will have on your users. So if yours is posted somewhere (the dark web, for instance), take steps to remove it immediately by contacting the site and requesting that they take it down and delete it from their archives.

Keep in mind that some search engines also store your data in a cache for a certain period of time. Don’t forget to [contact them](https://support.google.com/webmasters/answer/7479439?hl=en) and make sure they haven’t archived it mistakenly.

## 3. Notify Relevant Parties

Legally speaking, if you don’t notify the right people at the right time about a breach, you could be slapped with a significant fine (like [the $35M fine](https://a-lign.com/sec-issues-first-civil-penalty-for-failure-of-data-breach-disclosure/) the SEC hit Yahoo with for failing to notify investors for almost two years).

However, notification is more than just a legal issue &mdash; it’s also about maintaining the trust (and business) of your customers. Failing to notify your users of a breach is a very bad move, from a PR perspective, [as Uber learned in 2018](https://www.vox.com/2018/2/6/16980356/uber-congress-senate-commerce-committee-2016-security-breach).

### Determine Your Legal Obligations

Many countries have specific requirements in their data privacy legislation that dictate whether, when, and how you should notify those affected by a security breach.

Unfortunately, there’s no one-size-fits-all best practice here: You must check the specific laws or regulations as they pertain to your business. Keep in mind that the type of information leaked in the breach might have special legal requirements as well (for example, medical data).

Here are a few links to resources that can help determine your requirements:

1. [U.S. Data Breach Notification Laws by State](https://www.itgovernanceusa.com/data-breach-notification-laws): A complete breakdown of U.S. data protection and notification requirements for every state
2. [GDPR](https://gdpr-info.eu/): European data privacy laws and notification requirements
3. [HIPAA](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html): Medical specific data protection and notification requirements per the U.S. Department of Health and Human Services

### Notify Law Enforcement

Law enforcement officials can help you navigate the aftermath of a breach, so you’ll want to get them involved early in the process to help you with your investigation. The right law enforcement to notify will vary depending on where you’re located and what laws your business is subject to. Check with your legal counsel on who you need to contact.

Additionally, make sure the law enforcement you’re working with is experienced in dealing with cybercrimes. If your local police department isn’t equipped for the task, you may need to escalate it to one that is.

### Notify Users

The sooner you notify your users, the better they’ll be able to protect themselves from damages associated with the breach. For example, if their credit card numbers were stolen, they can call their provider and lock their cards to prevent unauthorized purchases.

Or, if their Social Security numbers were taken, users can take steps to reduce the effects of identity theft right away &mdash; for example, by contacting a credit bureau and implementing a credit freeze.

Most countries/states have specific laws about how to notify your users if they are affected by a breach. So follow any legal requirements to the letter. However, for the sake of trust and transparency, you’ll generally want to share the following information with anyone who was affected:

* How the breach happened
* What information was taken, and how it affects your users
* How cybercriminals have used that information (if you know)
* What you’ve done to correct the situation
* What you’re doing to help your users with any negative consequences they may experience as a result of the breach (credit monitoring, for instance)
* How to get in touch with questions about the breach

As [Target](https://www.forbes.com/sites/daviatemin/2013/12/30/targets-worst-pr-nightmare-7-lessons-from-targets-well-meant-but-flawed-crisis-response/?sh=7f4115a943cf) proved with the way they handled their 2013 data breach, consumers value transparency when their personal data is exposed. So while you will experience a loss of trust, being upfront about it and controlling the narrative will help you retain some of that trust that you might not otherwise.

<div class="alert alert-info alert-icon">
 
 Note: 
 If you're in the United States, <a href="https://www.ftc.gov/tips-advice/business-center/guidance/data-breach-response-guide-business">the Federal Trade Commission (FTC)</a> has an excellent email template you can use to notify your users. 
</div>

## 4. Correct Vulnerabilities to Prevent Future Breaches

Once the immediate threat of your latest cyberattack has passed, it doesn’t mean it’s OK to cross your fingers and hope that the rest of the security systems you have in place will do their jobs. It means it’s time to audit and address other vulnerabilities in your systems right away to prevent another incident and limit the [further impact to the business](https://auth0.com/blog/how-to-talk-about-breach-prevention-with-your-customers/).

The loss of trust from a breach is extensive. Studies show that anywhere from [65%](https://www.centrify.com/media/4772757/ponemon_data_breach_impact_study_uk.pdf) to [80%](https://www.forbes.com/sites/forbestechcouncil/2017/12/08/mind-the-trust-gap-how-companies-can-retain-customers-after-a-security-breach/#40b4b2806c95) of your customers will lose faith in a breached company. The impact? Millions in lost business, according to IBM/Ponemon:

![Correct Vulnerabilities to Prevent Future Breaches](https://images.ctfassets.net/23aumh6u8s0i/5w4MJYCAaovZlZ8EG3tTyQ/1273f480e751c4efd22d5b8c217ce6ec/01_IBMPonemonInstitute)
Courtesy of <a href="https://www.ibm.com/security/data-breach">IBM/Ponemon Institute</a>

Simply put, another data leak could be devastating for your business. So here’s what we recommend doing to strengthen your information security in the wake of a breach.

### Audit and Reduce Access to Critical Data

Internal human error is a major cause of data security incidents, which means that as more people within your organization gain access to data, your risk for an incident skyrockets:

![Correct Vulnerabilities to Prevent Future Breaches](https://images.ctfassets.net/23aumh6u8s0i/NsneT5SdcElSTWaVMebDK/b8199f8e45a8203014a667cb75dd85e5/02_IBMPonemonInstitute)
Courtesy of <a href="https://www.ibm.com/security/data-breach">IBM/Ponemon Institute</a>

That’s why Verizon consultants who assessed the aftermath of Target’s epic data breach recommended reducing access to critical data as an important step forward for the retailer, which was outlined in their [report](https://krebsonsecurity.com/2015/09/inside-target-corp-days-after-2013-breach/):

_“Target should limit the access to portions of the network containing business-critical systems to only the employees who directly manage those systems. Where possible, Verizon recommends restricting employee network access based on job function.”_

Bottom line, one of the best things you can do following a breach is audit who has access to sensitive information and limit it to essential personnel only. The fewer people who have access to important data, the less likely something is to go wrong.

### Encrypt Everything

Robust [data encryption](https://digitalguardian.com/blog/what-data-encryption) will make your data useless to hackers (even if it’s breached) because most don’t have the mathematical muscle or the patience to decrypt it.

Unfortunately, it’s taken quite a while for companies (even major ones with extremely sensitive data) to follow through &mdash; and they’ve paid the price.

For example, In 2014, hackers stole millions of customer records (all unencrypted) from Anthem, the second-largest health insurer in the United States. And although you’d think that would be a wake-up call for other companies, unencrypted records for over 140 million people were stolen from Equifax [three years later](https://www.cbsnews.com/news/equifax-ex-ceo-hacked-data-wasnt-encrypted/).

Given the constant barrage of cyberattacks that have a proven track record of breaking into the most advanced security systems, every company should be encrypting their data, no matter what. Here are three ways to encrypt yours:

* **Data encryption** converts information into another form, kind of like a secret code. The only way to read the data is to decipher it with a unique key. Modern encryption uses algorithms that make it extremely hard to crack.
* **Tokenization** replaces your data with unique symbols that retain all the information without compromising it. When the token is processed through the right tokenization system, it reveals the actual data.
* **Data de-identification** separates personal identifiers, such as name or Social Security number, with its related data, making it hard for hackers to figure out which data belongs to which individual.

### Improve Authentication Security

Compromised credentials are one of the two largest causes of all data breaches, according to IBM and the Ponemon Institute. So taking steps to improve the security of your authentication process following a breach is essential to ensuring one does not occur this way in the future.

Here are two easy ways to improve authentication security:

* [**Breached Password Detection**](https://auth0.com/breached-passwords/): Breached password detection checks users’ credentials against a database of breached credentials in real-time (that is, right when they log in). It will notify them if their password is breached, and you can even prevent access until the user has reset their password.
* [**Multi-Factor Authentication**](https://auth0.com/multifactor-authentication): Multi-factor authentication requires users to confirm their identity in [two or more ways](https://auth0.com/blog/multifactor-authentication-mfa/) in order to log in. This prevents unauthorized access, even if their credentials are compromised.

### Hack Yourself to Anticipate Future Attacks

If you are going to get hacked, it’s better (and [cheaper](https://www.ibm.com/security/data-breach)) to pay someone to do it intentionally first. You’ll tighten up your systems, and your team will be more prepared if the real thing happens.

This approach is also better than an automated scanner because penetration testers actually attack your network and exploit your system’s weak points, as a real hacker would. The goal is to test the real-world effectiveness of your security system against savvy human hackers, who will try everything in the hacker playbook to break in. And you can’t replicate that with an automated system (yet).

Major tech companies, including Google, Facebook, and Microsoft, are already doing this and have taken penetration testing a step further by creating [bug bounty programs](https://auth0.com/blog/bugcrowd-s-bug-bounty-program/). These programs challenge independent “pink hat” hackers to find vulnerabilities or other bugs that affect the security of their systems. And Google paid out [over $6.5 million](https://www.zdnet.com/article/googles-bug-bounty-program-just-had-a-record-breaking-year-of-payouts/) in 2019 alone to those who found gaps in their networks.

## Strengthen Your Weakest Link: Humans

Humans are by far the weakest link in your cybersecurity efforts. Phishing scams, ransomware, and weak passwords lead to [almost 50%](https://www.ibm.com/security/data-breach) of data breaches.

Plus, now that more people are working remotely in the wake of COVID-19, employees are also taking their work outside the office, using several portable devices that contain sensitive data (which opens up more opportunities for theft and unsanctioned devices lacking proper encryption).

So effective cybersecurity in 2020 is a lot more than just 1s and 0s &mdash; it’s a culture.

[Studies](https://www.isaca.org/-/media/info/cybersecurity-culture-report/index.html) show that strong ownership at the employee level improves cybersecurity and [reduces the number of incidents](https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2018/the-business-benefits-of-a-strong-cybersecurity-culture) an organization experiences. And training (plus the right tools) can help you encourage it:

1. **Educate employees with comprehensive and constant security training**. Whether it’s handling data or recognizing spam emails/social engineering practices, employees need to know how to identify and address security issues. Training is the most important security measure you implement to combat these attacks.
2. **Give employees the tools to better secure their devices**. Implementing [multi-factor authentication](https://auth0.com/learn/two-factor-authentication/) adds another layer of security on your employees’ devices. This eliminates the concern of an employee losing a device or inadvertently sharing their password. Even if their password is stolen, the account can’t be accessed without the second factor, like a physical device or a biological feature, such as a fingerprint.
3. **Improve user experience**. A seamless user experience that supports proven security practices and encourages secure behaviors is essential to building a strong cybersecurity culture. Avoid complexity at all costs.

Above all else, the key to creating a cybersecurity culture is showing your employees why it matters. Policy alone won’t encourage them to care &mdash; you have to help them see what’s at stake. Their vigilance could prevent the next breach altogether.

<include src="asides/AboutAuth0" />

4 Security Measures Companies Implement After a Breach

Fintech companies must evolve their identity strategy for the future of banking.

A solid customer identity and access management (CIAM) strategy is a crucial ingredient in successful digital transformation. Over the last several months, many financial services organizations have been forced to recognize that they’re not ready to operate fully online. Features and capabilities that seemed like nice-to-haves in 2019 are being rushed to market in 2020 to meet consumers’ rapidly evolving needs. Delivering a seamless user experience without compromising a strong security posture is the fintech challenge of the moment. 

CIAM is among the best tools for building digital resilience and strengthening online banking security. [Auth0](https://auth0.com/) CEO and co-founder [Eugenio Pace](https://www.linkedin.com/in/eugeniop/) and [IMDWORKS](https://www.idmworks.com/) founder and CEO [Paul Bedi](https://www.linkedin.com/in/paulbedi/) talked with Nick Holland of Information Security Media Group (ISMG) about the role of CIAM in helping banks adapt to our new remote reality and what this means for the future of banking.

## Banks Must Change How They Interact With Customers

Life for most people has changed radically over the last several months, and we’ve reached an inflection point where we’re appraising and challenging established systems and procedures. Put plainly, banks, and fintech companies must change how they interface with their customers. 

**“The way that banks interact with their customers will evolve massively.” &mdash; Paul Bedi, Founder, and CEO of [IMDWORKS](https://www.idmworks.com/).**

For instance, [telehealth](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) has gone from an occasional use case to the new default for many types of healthcare. This shift has accelerated the pace of innovation as health systems and technology providers work to redesign their products and procedures for a new system of care.

The COVID pandemic has also created new opportunities for fraud and data theft, raising the security bar even higher. [The Federal Trade Commission](https://www.cnbc.com/2020/04/15/americans-have-lost-13point4-million-to-fraud-linked-to-covid-19.html) reports that Americans have lost more than $13.4 million to COVID-related scams since the beginning of 2020. Meanwhile, [VMWare noted](https://searchsecurity.techtarget.com/news/252481832/Ransomware-attacks-see-148-surge-amid-COVID-19) an alarming 148% surge in ransomware attacks between February and March 2020, along with a 38% increase in the number of cyberattacks in the same period. It’s never been more critical to leverage CIAM to seal up the cracks and ensure your identity strategy is sound. 

### Enable Contactless Transactions

To establish a financial relationship, people used to bring proof of their identity into a brick-and-mortar bank and show it to a bank employee. Before 2020, Millennials’ preference for online banking over in-person transactions was already driving the industry towards developing better remote capabilities, but the pandemic has accelerated this shift. Financial institutions must be able to authenticate customers remotely: not just when they are accessing an established account via ATM or mobile app, but also when they are first launching their financial relationship. The cost of face-to-face interactions, whether measured in terms of public health or time optimization, has risen.

In general, a trend toward contactless transactions has become apparent. When we ordered a takeout dinner in 2019, we met our delivery driver at the door as they handed over our eagerly-anticipated meal. Now food delivery services leave our orders outside the front door and text us because neither party wants to be exposed to unnecessary risk — and because we have the technology to enable us to neutralize that risk.

Other everyday procedures such as notarization, which traditionally involves a face-to-face interaction, analog signatures, and a physical stamp, need to evolve to match the current situation. Because of pandemic-related travel barriers, pace points out, and demand is growing for technology that facilitates international transactions and interactions. It’s no exaggeration to say that we are in the process of reimagining and rearchitecting the entire technological infrastructure upon which we’ve built our lives and livelihoods.

### Earn Customer Trust With User-Centric Security

People have faith in physical banks, Holland suggests because they can see the vault and the teller; there are powerful visual clues that the bank is secure, inviolate. The structures for cultivating and reinforcing this same level of trust in online banking security need to evolve.

A data breach has a devastating impact on customer confidence. [IBM reports](https://www.ibm.com/security/data-breach) that the average data breach costs $3.92 million — of which 36% ($1.42 million) is the direct result of lost business. [A 2019 customer survey from Ping Identity](https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf) found that 81% of respondents would stop engaging with a brand online if there were a data breach, while 25% would stop engaging with the brand across all channels. 

Bedi advocates for fintech companies embracing public, user-centric security policies and guaranteeing the security of user data across online and mobile apps. “The onus is on you, the company, to protect them, the users,” he says. He urges banks and financial services to consider establishing a contact center staffed with knowledgeable people who can help customers troubleshoot and resolve fraud issues. Now more than ever, Bedi suggests, people want to place complete trust in their financial institutions; they want the reassurance of guaranteed security and genuine accessibility.

## Balancing Security and UX Requires a Fresh Authentication Approach

Maintaining a strong security posture without creating friction that drives users away is a perennial challenge. This is especially true with fintech companies and banks: They operate under heavy regulation, and their top priority is protecting user accounts. Their user bases, meanwhile, often vary wildly in terms of technical sophistication, so the authentication function must be low-friction to avoid confusing, frustrating, and ultimately losing customers. 

### Lose focus on UX and lose 32% of your users

The impact of a cumbersome user experience is easy to dismiss, especially when it’s so important to [protect customer data](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/) (not to mention a legal requirement across 65% of the globe). But bad experiences for users translate directly to lost revenue for you. [PwC found](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) that almost a third of customers will abandon a brand they like after just one negative experience. That’s why it’s crucial to balance high security standards and a smooth customer experience. 

Bedi argues that achieving this balance means making the security paradigm completely invisible to users. In other words, making the systems and processes involved in verifying and managing identity so seamless that the user scarcely registers them. “That’s when you know you’ve succeeded [with CIAM],” he says.

### Put authentication decisions in context

A primary consideration in balancing security and user experience, says pace, is a keen understanding of the context in which interactions are happening. Situations with different levels of risk demand different levels of authentication. For instance, just checking an account balance might require a lower level of authentication than making a transfer. When a user attempts a higher-risk action, they’re prompted with an additional verification step, like multi-factor authentication (MFA) or a [CAPTCHA](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/).

Authenticating based on context also involves looking at what time of day a request was made, from what location, and using which device. Historical behavior patterns also come into play. For example, if you always pay your bills on Monday evenings from your laptop at home, a smartphone login in the small hours of Saturday morning from an unexpected location might trigger an additional verification step, because there’s contextual evidence that you are not the one making the login request. On the other hand, a Monday evening request from your living room might not require that additional authentication — and demanding it might create sufficient friction to drive you, the user, to another bank.

Pace explains that the security world has tended to view authentication in binary terms: a user is either authenticated or they’re not. Fortunately for today’s use cases, modern CIAM technology is sophisticated enough to evolve systems to evaluate all of these contextual factors when making decisions. Requesting different levels of authentication depending on context allows fintech companies to maintain high security standards without pestering the user for authentication every time they turn around.

## The Bank of the Future Isn’t Just a Bank

No one has a clear idea of what the future of banking will be, but what is clear is that many features will remain digital. Even once it’s possible to do more banking face-to-face, plenty of customers will still prefer to bank remotely. A hybrid structure is how fintech companies will thrive going forward. 

In a post-pandemic world, real-life interactions will incur a new kind of value, and this certainly applies to financial services companies. One possibility Bedi raises is that banks will transform into offshoots of the community. Like [Capital One Cafés](https://www.capitalone.com/learn-grow/money-management/explore-capital-one-cafes/), banks might leverage their real-estate assets by opening common spaces where people can transact business face-to-face — adding another layer of value to the banking experience. Another possibility is that banking locations could become remote call centers for customers with the kinds of questions that would once have been addressed in person. 

Bedi’s predictions largely align with how pace sees banks evolving in the near future. “The emphasis will be on relationship-building,” he says. In order to keep customers coming through the doors, banks will have an opportunity to deliver value users can’t get online. A bank branch could, for instance, proactively reach out to local customers who qualify for a higher line of credit or a lower interest rate on their mortgage, instead of waiting for customers to seek out their services.

## The Future Calls for CIAM

Ultimately, no matter what new revenue streams financial companies discover in the course of hybridizing their structures, both customers and vendors will be pressuring banks to digitize more fully. A sound CIAM strategy clears the way to next-generation UX without increasing the security risk to customer accounts.

<include src="asides/AboutAuth0" />

How FinTech Benefits From IAM

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How to protect customer data from internal and external attacks

On September 30, [American Express sent letters](https://media.dojmt.gov/wp-content/uploads/Consumer.pdf) to some of its cardholders, informing them that their personal information had been improperly accessed by a former employee, who apparently tried to use that data to open fraudulent accounts at other financial institutions. Amex has not disclosed how many accounts were compromised but told victims that their account numbers, addresses, dates of birth, and Social Security numbers had been stolen.

While the full scope of this crime is not yet clear, the implications are potentially serious, and not just for Amex. Incidents of data theft and mismanagement are on the rise—just days after the Amex story broke, [Twitter found itself](https://www.forbes.com/sites/emmawoollacott/2019/10/09/twitter-inadvertently-gives-user-security-data-to-advertisers/#29e3e2ea5f63) embroiled in its own user data scandal—and the costs are mounting.

These costs can take the form of lost revenue, lost customer trust, fines issued under new data privacy laws, and the increasing potential for credentials stolen in one attack to be used against other businesses.

Corporate titans such as American Express can weather the storm of a data breach, but SMBs can ill-afford the cost of a breach on their revenue and reputation. Yet despite the risks, many SMBs drastically underestimate the cost of a breach. [According to AppRiver's Q3 Cyberthreat Index for Business Survey](https://www.appriver.com/cyberthreatindexforbusiness/), 67% of respondents estimated a breach would cost less than $25,000. In reality, the average cost is $149,000.

Executives in every industry should take note of this breach and use it as an opportunity to examine their own data security. With that in mind, let’s take a look at what we know about the American Express data theft, how businesses can protect themselves from employee malfeasance, and the potential for stolen data to lead to further breaches

![Image of a credit card secured by a lock](https://images.ctfassets.net/23aumh6u8s0i/3dRPHqHpQRLsWibR1AWvgd/f67cb7415472656e0b9206f5bc071249/credit_lock)

## The Facts (So Far) about the Amex Breach

According to American Express, the employee accused of using cardholder data for identity theft no longer works for the company and is under investigation by law enforcement.

In its letter, Amex assured victims that they won’t be liable for fraudulent charges and offered two years of free Experian identity monitoring. (Ironically, to use that service, victims must disclose their SSNs and addresses to Experian, and some customers may feel uncomfortable trusting that information to credit monitoring services in the wake of the [Equifax breach](https://www.teampay.co/insights/b2b-fraud-schemes/).)

It bears mentioning that this [isn’t the first time](https://www.theregister.co.uk/2016/03/17/american_express_cardholder_data_breach/) American Express customers have had their personal information compromised. However, this breach is somewhat unusual in that it isn’t the result of [accidentally exposed data](https://www.pymnts.com/news/security-and-risk/2018/american-express-india-database-data-breach/) or a malicious intruder posing as a trusted third party but of an actual employee improperly accessing sensitive information.

## How Businesses Can Protect Themselves from Employee Fraud

American Express hasn’t revealed whether the employee responsible for this breach had the appropriate credentials to access unencrypted customer data or how they copied that data for their personal use. Whatever the specific circumstances, identity professionals know the most effective tactics for deterring employee fraud are carefully controlling and monitoring access to sensitive data.

![An image of a consumer using his credit card to buy online](https://images.ctfassets.net/23aumh6u8s0i/5qKdbPEP8YnwRPYcXwTE0x/a5f28025bbad3b6efd01988f2ef393da/creditcard)

[Cloud Identity and Access Management (IAM)](https://auth0.com/learn/cloud-identity-access-management/) is an effective way for cloud-based enterprises to manage access to resources. A good cloud IAM solution functions as a single, centralized resource for admins to grant access to data. With the flip of a switch, you can assign permissions based on what an employee needs for their current task and then revoke it when that task is completed, so valuable information is exposed as little as possible.

All cloud IAM solutions aren’t created equally, however, and you should look at one that lets you proactively keep an eye on employees and identify suspicious behavior. In its report on MFA for e-commerce, [NIST specifically recommends](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that businesses “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.”

[Auth0’s dashboard](https://auth0.com/docs/dashboard) gives you a comprehensive, bird’s-eye view of user behavior, including customers, third parties, and employees.

[Using Auth0’s Rules](https://auth0.com/docs/rules), you can configure your dashboard to alert admins in the event of suspicious behavior, which you can define according to your needs. For example, you might want to be alerted if an employee continually tries to access sensitive resources unrelated to their work or logs in from a new device or at an unusual time of day.

## Guarding against the Ripple Effects of Data Breaches

The American Express data breach is unlikely to be the last scandal involving credit card companies since they are such high-value targets for thieves. But executives across every industry should understand that breaches such as this don’t just harm the individual company involved; they threaten the entire e-commerce landscape.

Data breaches like this have a spillover effect since hackers often use data stolen in one breach to impersonate users on other sites, a type of attack known as [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). The best protection against this is [multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication). MFA requires users to prove their identity via means that are more difficult to fake than simple data, such as a fingerprint scan or a one-time code sent to a personal device.

Auth0’s MFA comes with the added security of [breached password detection](https://auth0.com/breached-passwords). Auth0 keeps a constantly updated collection of breached credentials and alerts users if their login information may have been compromised. 

## Don’t Be the Next Casualty of an Amex-Style Breach

For executives, there are already valuable lessons to be learned from the American Express data breach. However, those lessons are unlikely to comfort the victims of this breach or restore their faith in their credit card company. So for now, one truth about this attack is already abundantly clear: when it comes to customer data, it’s better to invest in vigilance than damage control.

<include src="asides/AboutAuth0" />

What the American Express Data Breach Should Teach the C-Suite

Form an enterprise mobility strategy that prioritizes security from the start

The tension between freedom for users and manageability for enterprises can lead to security problems.

Employees want the freedom to do what they want and the flexibility to do it on the devices they prefer. IT wants the ability to manage, and secure, the waves of devices and applications accessing their networks. The threat of slowing down or waiting for IT can tempt employees to seek workarounds. 

A Nintex study found that [40% of surveyed employees](https://info.nintex.com/rs/272-JVS-996/images/Nintex%20AMBP%20Ebook%20Final.pdf) used unapproved devices or apps because IT failed to provide prompt service. This isn't just users vs. IT: that same survey showed that nearly two-thirds of IT sought workarounds, too. This is a symptom of that underlying tension between freedom and manageability. 

This tension only worsens as mobile security threats get more dangerous. The possibility of [damaging data breaches](https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/) is forcing enterprises to reconsider their enterprise mobility strategy. 

Mobile devices aren't going away — and neither are the threats that make them risky. Here are three ways to ensure security remains a priority as enterprise mobility evolves.

## Where Does Device Security Fit into Enterprise Mobility Strategies?

The harder it is to manage enterprise mobile devices, the harder it is to ensure their security. This conflict creates divergent mobility strategies. 

Most companies are embracing bring-your-own-device (BYOD) policies, even though [nearly a third](https://www.bitglass.com/press-releases/2018-byod-report-mobile-security-threats) cite security as the strategy's top challenge. Other companies are paying monthly, per-device licenses for enterprise mobility management (EMM) products that promise visibility and security.

Mobile devices present unique vulnerabilities that demand security strategies across the device mobility spectrum, including mobile applications, content, and identity. 

Employees bringing consumer devices into the enterprise might be bringing their bad habits, too. According to a Pew Research study, [more than a quarter](https://www.pewresearch.org/fact-tank/2017/03/15/many-smartphone-owners-dont-take-steps-to-secure-their-devices/) of smartphone users don't use a lock screen, which would leave data and credentials exposed if the device were stolen or lost.

With the rise of [remote work](https://auth0.com/blog/surprises-in-my-switch-to-remote-work/), bad security habits can follow people around the globe. The coffee shop might be a picturesque place to work, but its public wi-fi could offer a hacker the opportunity to steal your employee's credentials and access precious company data. 

At a minimum, an effective enterprise mobility security strategy includes the ability to react swiftly to any flaws or mistakes. Auth0's [anomaly detection](https://auth0.com/learn/anomaly-detection/) and [breached password detection](https://auth0.com/breached-passwords) can provide a backstop for your security plans. Anomaly detection spots suspicious behavior and breached password detection lets users know if someone has stolen and leaked their credentials. 

![Auth0 Anomaly detection and breached password detection within Dashboard](https://images.ctfassets.net/23aumh6u8s0i/1B6N6MBUWZQcgFKUk2nPqO/72e1b9759b075c1140d64fcbceafaef6/auth0-anomaly-detection-feature)

A [2018 Ponemon study](https://securityintelligence.com/ponemon-cost-of-a-data-breach-2018/) showed that a business with 10,000 compromised records or fewer lost an average total of $2.2 million. If a business had more than 50,000 compromised records, the average total cost reached $6.9 million. 

Despite the danger of these breaches, the Ponemon study showed it takes 196 days, on average, to detect a breach. Absolute security is impossible, but your ability to react quickly can reduce the worst effects of a breach. Enterprise mobility strategies have to take account of the wide range of mobile security threats and develop plans to react to them. 

## Design Mobile Device Security Policies That Suit Your Use Cases

Security depends on internal policies that regularly educate employees and provides software infrastructure that makes those policies easy to follow. Every phase of a growing enterprise mobility strategy needs security policies. 

The primary goal of a mobile device security policy is to assign and communicate clear responsibilities to different users. IT shouldn't bear the weight of security alone. Users across the company need to understand relevant security policies, and what they're responsible for handling. 

Even if your organization is embracing BYOD, internal rules are still necessary to regulate how employees access data with their devices. Though BYOD appears simpler, EMM products enable IT to take more responsibility, such as configuring updates and patches. 

Beyond regulating everyday user behavior, effective enterprise mobility policies isolate potential vulnerabilities and protect valuable data. IoT devices, including devices as mundane as wireless printers, should connect via a separate, isolated network, such as a virtual local-area network (LAN). IT should also disable unused functions to reduce vulnerabilities, especially ones that require network access. 

Comprehensive policies also determine which data should be encrypted. Encryption ensures that a breach, if one were to happen, only exposes inscrutable data. Without the key — the ability to decode and understand the data — it's useless to a hacker. 

Similarly, using multi-factor authentication (MFA) can make one set of credentials useless. Even if a user loses a password, you can still require a fingerprint or SMS code before granting full access.

![Multifactor authentication (MFA) within Auth0's Dashboard](https://images.ctfassets.net/23aumh6u8s0i/6g4JHS2NXYmmTzUtIYiUd2/e5bbd411362f561e41b1f8c49c7747a1/auth0-multifactor-authentication.png)

Enterprise mobility isn't exclusively about giving users flexibility. Products like Auth0's [Guardian](https://auth0.com/multifactor-authentication) can approve login requests from a variety of devices. With MFA as part of your enterprise mobility strategy, you can turn mobility into a strength. The better you can manage security, the more freedom you can grant your users.

## Build a Security Culture That Reinforces Mobile Device Security Best Practices

Mobile device security policies regulate user behavior from the top down, but an enterprise mobility strategy that prioritizes security isn't complete without bottom-up best practices. 

Devices go inside and outside the office, connect to different networks, and interact with a variety of websites and applications. The best protection against the threats that mobility faces is a strong security culture, and an infrastructure to support it. 

Culture consists of behaviors and practices you want to encourage and discourage. Asking people to participate in that culture means it's incumbent on you to explain those behaviors in terms that are real and relevant to the participants — your employees. 

In many cases, you might not want employees to connect to public wi-fi networks. This is inconvenient — acknowledge that. Instead of admonishing or encouraging them, walk your employees through the threats public wi-fi networks pose. Show them how a seemingly innocent behavior can expose their data, their credentials, and potentially an enterprise-wide data breach. With the threat understood, employees can make better use of relatively easy solutions, such as using encrypted virtual private networks (VPNs). 

The original tension between flexibility and manageability will remain a threat if your security culture consists exclusively of rules. Telling your employees to use different, complex passwords for every login reintroduces the friction that tempts employees to find workarounds. 

With [enterprise single sign on](https://auth0.com/blog/4-vital-ways-enterprise-sso-saves-your-employees-time/) (SSO), you can combine simplicity and security.

![Graph showcasing how Enterprise Single Sign-On provides simplicity and security](https://images.ctfassets.net/23aumh6u8s0i/7ADRQWfT9OioacOp26wQdN/6045c580e76148c5124b13b2f68a5ae0/auth0-single-sign-on-flow)

SSO uses a trusted, central server to process cookies. An employee's first login creates a cookie on the central server, so that when they need access to a second application, the central server can equip them with a token that keeps them logged in across applications. 

Your users, and your security, benefit from simplicity. With security infrastructure, you can make security the more convenient option. Every time they use a tool like SSO, they're following a best practice and reinforcing the security culture that needs them. 

## Effective Enterprise Mobility Makes It Easy to Be Secure

Security can be a priority for your enterprise mobility strategy — no matter what stage your plans are in. Whether employees are bringing their own devices to work or logging into an EMM product, you can provide the infrastructure that makes security easy. 

If your enterprise mobility strategy doesn't address that core conflict between freedom and manageability, expect security issues to crop up again. 

Security and ease-of-use don't need to be in constant tension. If you enable your users to stay secure as you (or they) introduce new technologies and use cases, then your business strategies can be proactive, instead of reactive. 

<include src="asides/AboutAuth0" />

How To Build Security Into Your Enterprise Mobility Strategy

Add these cybersecurity books to your library and develop the skills that will support your career.

30 Cybersecurity Books To Deepen Your Knowledge

How hackers got in, what they stole, and how to prevent more incidents in 2019.



> [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) have become commonplace — yet some industries are more vulnerable than others. Unfortunately, media is notorious for being a magnet for cyberthieves. 

In the last decade, dozens of media companies, ranging from prestigious publications like the *Washington Post* to social media platforms like [Facebook](https://mashable.com/2018/06/08/facebook-media-company-news-shows/#UMeaOo_oDsqI), have seen customers’ and the companies’ private data exposed.

Why? One reason is that billions of people have accounts with media companies. Facebook users alone hit [2.27 billion](https://www.statista.com/statistics/264810/number-of-monthly-active-facebook-users-worldwide/) in Q3 2018. As more and more people consume their news online, the surface area for cybercriminals continues to expand. Another reason, according to [Security Magazine](https://www.securitymagazine.com/articles/89404-media-and-entertainment-industry-unprepared-for-cyber-risks), is that media companies often rely on outside vendors. Even if the media companies themselves are confident in their security processes, it’s hard to track how safe third parties are. 

While some vendors like Auth0 take compliance seriously — acquiring [security certifications](https://auth0.com/security/) such as ISO 27001 and 27018, as well as SOC 2 and HIPAA  — this isn’t always the case with third parties.

Below is a roundup of 11 of the worst media breaches in the past decade. Hackers hit teams large and small, niche and high-profile, new and established. It’s clear that no company is immune.

We deliver tips for how all media teams can bolster their cybersecurity practices in 2019. 

## 1. BuzzFeed Data Breach

In 2016 BuzzFeed was hacked by a group called OurMine. On several BuzzFeed articles, headlines read  "HACKED BY OURMINE" with a link to the group's website. Several of the headlines also included profanities.

An [article in *Wired Magazine*](https://www.wired.com/2016/10/hack-brief-hackers-breach-buzzfeed-retaliation-expose/) described how the group had a history of getting into systems using passwords that were previously leaked in large-scale data breaches. They used the compromised passwords to access BuzzFeed accounts with the same login data.

## 2. Dow Jones Data Breach

In October 2015, hackers uncovered the personal data of current and former Dow Jones subscribers between July 2012 and August 2015. [Reports](https://www.wsj.com/articles/dow-jones-discloses-customer-data-breach-1444406517) divulged that the hackers got credit card information from close to 3,500 individuals — along with names, addresses, email addresses, and phone numbers.

The hackers' goal was to send fraudulent solicitations, according to the [*Wall Street Journal*](https://www.wsj.com/articles/dow-jones-discloses-customer-data-breach-1444406517)*. *The company suspected the incident was part of a much larger, multi-company data breach.

## 3. Avid Life Media Incident 

Also in 2015, the parent company to Ashley Madison, Avid Life Media, released a [statement](https://www.prnewswire.com/news-releases/ruby-corp-and-plaintiffs-reach-proposed-settlement-of-class-action-lawsuit-regarding-ashley-madison-data-breach-634551783.html) saying that hackers had gained access to computer networks and published nearly 10 gigabytes of sensitive personal information. These [included](https://www.wsj.com/articles/ceo-of-ashley-madison-parent-steps-down-1440773362?mod=article_inline) customers' names, email addresses, and credit card details contained in individual accounts.

Hackers, part of a group called The Impact Team, released nearly 10 gigabytes of data stolen from Avid Life. 

The company fought back, denying the severity of the attack:

![Avid Life Media Incident](https://images.ctfassets.net/23aumh6u8s0i/3wCntqxyboNdz1k6lpLMyo/062ee3dc8df5e5a760fd672bde6a2feb/avid-life-media)
[Image Source](https://www.databreaches.net/statement-from-avid-life-media-august-19-2015/)

Ultimately, the data breach led to Avid Life Media's CEO resigning. In 2017, Avid Life (now Ruby Corp) [reached a settlement of $11.2 million](http://www.prnewswire.com/news-releases/ruby-corp-and-plaintiffs-reach-proposed-settlement-of-class-action-lawsuit-regarding-ashley-madison-data-breach-634551783.html) with potential plaintiffs.

## 4. Facebook Scandal

Facebook's series of data breaches — including the [Cambridge Analytics scandal](https://auth0.com/blog/what-data-did-facebook-really-give-cambridge-analytica/), Russian interference in the U.S. elections, the realization that major apps continue to [illegally share user data](https://siliconangle.com/2018/12/31/report-finds-major-apps-illegally-sharing-data-facebook/) with the company, and recent exposure of [_50 million accounts_](https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-breach.html) in September 2018 — are some of the most high-profile of the year. 

To make matters worse, many believe the most recent breach of personal accounts actually began as far back as July 2017. For months, hackers were rooting around for private information, including names, sexes, hometowns, and photos. After obtaining the data, attackers used people's lists to steal access tokens for third-party apps like Spotify and Instagram. 

While the hack didn't expose [_financial information_](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), the breadth of personal data they were able to access still had enormous value. 

## 5. Sony Data Breach 

In 2014, hackers [accessed and wiped personal data](https://www.forbes.com/sites/josephsteinberg/2014/12/11/massive-security-breach-at-sony-heres-what-you-need-to-know/#23bcec9144d8) from Sony customer accounts. In addition, they alluded to attacking theaters set to release the film “The Interview,” with James Franco and Seth Rogen. (Sony was forced to release the film online instead.) 

Hackers released information to the public like the salaries of tens of thousands of employees and Hollywood stars and [sensitive email traffic between executives and movie moguls](http://time.com/3629480/sony-pictures-hack-amy-pascal-emails/). Reports noted the incident amounted to [100 terabytes](http://time.com/3639275/the-interview-sony-hack-north-korea/) of data. 

Sony employees immediately knew something was wrong when they arrived at work and found images of grinning red skulls on computer screens. Hackers identified themselves as #GOP — Guardians of Peace. 

## 6. Washington Post Scam

In 2011, [1.27 million](https://www.pcmag.com/article2/0,2817,2388200,00.asp) *Washington Post* user accounts were hacked. This was a major incident because it was one of the first attacks on a prestigious media institution. It shook public confidence in the security of the trusted company. 

Hackers were able to get in via the *Washington Post*'s Jobs site.They stole usernames and email addresses — likely in order to conduct [phishing scams](https://auth0.com/blog/phishing-attacks-with-auth0-facts-first/), according to [*PC Mag*](https://www.pcmag.com/article2/0,2817,2388200,00.asp).

The company released an informational piece on online scams following the attack.

![Washington Post Scam](https://images.ctfassets.net/23aumh6u8s0i/7ikzMFxC9eaSZVyOhAzsIt/f294320bf73f546245712e4b8f80632c/washington-post)
[Source: Washington Post](http://www.washingtonpost.com/wp-srv/jobs/product-pages/fraud-email.html?noredirect=on)

Because such an attack was relatively new at the time, the piece helped users [understand the risks](http://blog.idonethis.com/security-ringcaptcha/)and what they could do to move forward.

## 7. DailyMotion Personal Data Theft

When DailyMotion was hacked in October 2016, it was one of the most visited sites online. A Russian hacker named Peace breached 85.2 million accounts and stole email addresses and usernames. *The Hacker News* reported that [18 million users](https://thehackernews.com/2016/12/dailymotion-video-hacked.html) had [hashed passwords](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/).

In 2018, DailyMotion was fined [€50,000](https://www.broadbandtvnews.com/2018/08/03/dailymotion-fined-for-data-breach/) for the incident.

## 8. Myspace Data Breach

Hackers were suspected of taking usernames and passwords from [360 million stolen Myspace accounts](https://techcrunch.com/2016/05/31/recently-confirmed-myspace-hack-could-be-the-largest-yet/) and selling them to a forum online in 2016, according to [TechCrunch](https://techcrunch.com/2016/05/31/recently-confirmed-myspace-hack-could-be-the-largest-yet/).

At the time, the Myspace attack was suspected to be the largest data breach of all time. Although data was mostly from accounts that weren't currently active, because people [reuse the same passwords](https://auth0.com/blog/avoiding-password-reuse-attacks/), hackers had the potential to use the information to log into other active accounts of the users.

## 9. Quora Security Incident

The attack on Quora occurred just a few weeks ago — in December 2018. The company released a [comprehensive statement](https://blog.quora.com/Quora-Security-Update?awc=15748_1545351800_5f9ec96c657ae3bee293392a15c47366&uiv=6&txtv=8&source=awin&medium=ad&campaign=uad_mkt_en_acq_us_awin&set=awin) detailing what occurred, what information was involved, and what Quora was doing to rectify the situation. 

A portion of the statement is below: 

![Quora Security Incident](https://images.ctfassets.net/23aumh6u8s0i/5dP0e79zrDmeTkosePu77k/0aec22bc42bd30ac30c2a74e1024ed95/quora-security-update)
[Image Source: Quora Blog](https://blog.quora.com/Quora-Security-Update?awc=15748_1545351800_5f9ec96c657ae3bee293392a15c47366&uiv=6&txtv=8&source=awin&medium=ad&campaign=uad_mkt_en_acq_us_awin&set=awin)

The company continues to have up-to-date FAQ on security [here](https://help.quora.com/hc/en-us/articles/360020212652-Quora-Security-Update-FAQ).

## 10. Associated Press Attack

Taking a different approach, hackers in 2013 accessed the Associated Press's Twitter account and [tweeted](https://www.marketwatch.com/story/this-day-in-history-hacked-ap-tweet-about-white-house-explosions-triggers-panic-2018-04-23) that there were explosions in the White House and that Obama was injured. In six minutes, before order was restored, the Dow Jones Industrial Average plummeted. The hack impacted the stock market by [$136 billion](https://www.washingtonpost.com/news/worldviews/wp/2013/04/23/syrian-hackers-claim-ap-hack-that-tipped-stock-market-by-136-billion-is-it-terrorism/?utm_term=.6795bf505121). 

A group called the Syrian Electronic Army [claimed responsibility](https://www.marketwatch.com/story/this-day-in-history-hacked-ap-tweet-about-white-house-explosions-triggers-panic-2018-04-23) for the attack.

## 11. Twitter Data Breach

Finally, even Twitter hasn’t escaped unscathed. In May 2018, the company [shared](https://blog.twitter.com/official/en_us/topics/company/2018/keeping-your-account-secure.html) that they had identified a bug in their internal log of user passwords that prevented Twitter from completing the [hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) process and fully securing them. 

![Twitter Data Breach](https://images.ctfassets.net/23aumh6u8s0i/27CklKf5h0eco99KcmDXEi/98504ef54775e3f97b08b80fd18bf00a/twitter)
[Image Source](https://blog.twitter.com/official/en_us/topics/company/2018/keeping-your-account-secure.html)

They asked users to re-set their passwords to prevent unwanted access — but the company's reputation suffered.

## What These Data Breaches Have in Common

Many of these attacks have common threads:

* Cyberthieves use [passwords that have been recycled](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/) — allowing them to access multiple accounts for a single individual.
* Hackers often get in through [vulnerabilities](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/) in a company’s or third party’s system.
* Companies don’t always know how to respond to an incident in productive ways (although some are bold and clear with their communications).

Given similar issues among major data breaches, these are the areas to double down on to prevent future attacks.

## What You Can Do to Protect Yourself

There is no one-size-fits-all solution to protect your company against a data breach. If you’re new to [managing customer data](https://blog.getbase.com/8-ways-to-effectively-manage-your-customer-data) you might start with comprehensive employee training or make it a point to store only the data you really need.

_[Outsourcing cybersecurity to an expert team](https://auth0.com/forrester-total-economic-impact/)_ is increasingly popular among companies that deal with vast amounts of customer information. While internal IT teams are usually quite capable, they simply have too much on their plates to stay on the cutting edge of security — which is where you need to be to keep up with cybercriminals.

Solutions like Auth0 that come with [built-in security certifications](https://auth0.com/security/) can give you peace of mind knowing that you have a group working 24/7 on your security systems. It can free you up to build and roll out new products directly tied to your bottom line.

Among our many offerings, Auth0 has a special [breached password detection feature](https://auth0.com/breached-passwords) that monitors large-scale data breaches and notifies your users when their credentials are leaked. You can opt to block access until the user has reset their password.

See [here](https://auth0.com/) for our full suite of offerings to help you stay safe in 2019!


11 of the Worst Data Breaches in Media

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Email addresses, passport numbers, and credit card information included in stolen data.

_Update: Marriott now says the breach wasn’t as bad as originally reported, lowering the victim number to [383 million](https://www.bankinfosecurity.com/marriot-mega-breach-victim-count-drops-to-383-million-a-11916)._

What can you do if you’re one of the 500 million [Marriott International Inc.](https://www.bloomberg.com/quote/MAR:US) guests affected by the massive data breach announced today? According to the company’s [announcement](https://answers.kroll.com/), the breach affects guests who stayed at the Marriott’s Starwood properties from 2014 through Sept. 10, 2018. For approximately 327 million of impacted guests, Marriott says the breached information includes some combination of:

- Mailing address
- Phone number
- Email address
- Starwood Preferred Guest (“SPG”) account information
- Birthdate
- Gender
- Arrival and departure information
- Reservation date
- Communication preferences.

Credit and debit card numbers were also included in the breach. While Marriott notes this information was encrypted according to the AES-128 standard, they do not yet know if the components required to decrypt these numbers have been compromised.

![Marriot's Starwood Property](https://images.ctfassets.net/23aumh6u8s0i/7LRWHLzMk1XQxnM9cWpnKJ/9f47c148a148fa5af76cfe857598b83c/marriot-starwood-data-breach)

[Source: [Wikimedia](https://commons.wikimedia.org/wiki/File:Guam_Marriott_Resort_%26_Spa.JPG)]

## 5 Steps to Protect your Data After This Breach

If you’ve made a reservation at a Starwood property in the last four years (this includes Sheraton, Westin, Four Points, [many other brands](https://answers.kroll.com/), and Starwood-branded timeshares), take these steps to minimize your exposure:

1. **Change your password.** This should be your default response to the news of any hack that might involve your information. If you use the same password in multiple places, be sure to change your password everywhere.

2. **Implement Multi-factor Authentication (MFA).** A breached password is only useful if malicious actors can use it. A second step of authentication, like a code sent via SMS to your phone, can render that breached password useless (but you should still change your password).

3. **Monitor your accounts.** Marriott’s system was compromised for an extended period of time. Check your accounts weekly.

4. **Consider freezing your credit.** You can put a credit hold on your accounts, but in most U.S. states, the hold remains permanent until you request a thaw. This [guide from NerdWallet](https://www.nerdwallet.com/blog/finance/pros-and-cons-freezing-credit/) provides more details.

5. **Watch out for phishing attempts.** “Phishing attempts can be more credible when someone has access to actual personal details,” says Auth0 Principal Security Engineer Emory Lundberg. This hack includes data that could make social engineering attempts easier. For more advice on avoiding phishing attempts, check out this [post](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/) by Annybell Villarroel, Auth0 Security Operations Manager.

![Steps After A Data Breach](https://images.ctfassets.net/23aumh6u8s0i/6k5RKe4zh50H8BrRaPqQC2/ad318219be99cf9089a470a643ef7d5e/security-after-data-breach)

[Source: [PixaBay](https://pixabay.com/en/photos/cyber%20security/?)]

## Marriot's Data Breach Response Plan

In addition, Marriott has taken the following steps to help guests monitor and protect their information:

**Dedicated Call Center**

Marriott has established a dedicated call center to answer questions you may have about this incident. The call center is open seven days a week and is available in multiple languages. Our dedicated call center may experience high call volume initially, and we appreciate your patience.

**Email Notification**

Marriott began sending emails on a rolling basis on November 30, 2018 to affected guests whose email addresses are in the Starwood guest reservation database.

**Free WebWatcher Enrollment**

Marriott is providing guests the opportunity to enroll in WebWatcher free of charge for one year. WebWatcher monitors internet sites where personal information is shared and generates an alert to the consumer if evidence of the consumer’s personal information is found. Due to regulatory and other reasons, WebWatcher or similar products are not available in all countries. Guests from the United States who complete the WebWatcher enrollment process will also be provided fraud consultation services and reimbursement coverage for free. Click on your country, if listed, to begin the enrollment process.

<include src="asides/AboutAuth0" />

---

Marriott's Starwood Data Breach - 5 Steps to Protect your Data

Invest in cybersecurity insurance, steer clear of email money transfers, and improve your data and identity management.

In June 2018, the Memphis-based real estate company Crye-Leike found itself embroiled in an international online fraud scheme. Eight people were caught stealing nearly $15 million from the firm. Evidence later emerged linking them to phishing scams.

Crye-Leike is not alone. In 2017, the FBI warned of a large spike in cyberattacks specifically targeting real estate companies. They noted that fraudulent real estate transactions jumped 5,000%, from [$19 million](https://www.cyren.com/blog/articles/cybercriminals-see-real-estate-firms-as-profitable) in 2016 to nearly $1 billion (US $969M) in 2017. 

The FBI also saw inbound complaints of cyberattacks related to real estate jump [480%](https://www.cyren.com/blog/articles/cybercriminals-see-real-estate-firms-as-profitable) between 2016 and 2017. 

What makes real estate so alluring and easy to hack? 

In 2017 Zillow valued the U.S. real estate market at [$31.8 trillion](https://www.housingwire.com/articles/42176-value-of-us-housing-market-climbs-to-record-318-trillion) (1.5x the value of the nation's GDP). Real estate tech is also one of the fastest growing tech sectors. High-value areas often draw criminals.

![Ocean’s 8 Film Steals $4 Million at Theater's Box Offices](https://images.ctfassets.net/23aumh6u8s0i/2xuXCFmyUEund3YONGKwNe/ee9ad7f1260a160cf125eb615dd57a33/oceans-8)

([Source](https://www.thewrap.com/oceans-8-steals-4-million-at-thursday-box-office/))

With real estate in particular, no federal law mandates that businesses have to implement information-security programs (like banks and hospitals do). This has resulted in companies with exceptionally vulnerable systems. 

A recent survey showed that [50 percent](https://www.nreionline.com/technology/top-five-cybersecurity-threats-real-estate-businesses) of real estate companies do not have sufficient resources to prevent or even mitigate a cyberattack. The industry has fallen behind.

This piece will break down ways that real estate firms can come up the curve and protect their sensitive information.

## 3 Ways To Brace Your Team Against Cybercrime

### 1.) Invest in cybersecurity insurance.

The average cost of a data breach topped [$3.8 million](https://www.forbes.com/sites/niallmccarthy/2018/07/13/the-average-cost-of-a-data-breach-is-highest-in-the-u-s-infographic/#5b3d9ea72f37) in 2018—and [small businesses remain particularly vulnerable](http://blog.idonethis.com/security-ringcaptcha/). While many real estate companies are large corporations, others are still local and family-run and have been working with the same systems for generations. 

Costs to recover from a breach (e.g., additional PR for damage control, IT spending, and nonfinancial damages like decreased brand reputation or having to fire an executive) are often more than companies can handle.

Real estate teams have insurance for natural disasters — why not for cyber disasters? 

Cybersecurity insurance (or cyber liability insurance) is stand-alone coverage that helps mitigate loss from a security incident. With the number of breaches and the volume of exposed personal records escalating every year, no organization is safe.

With cybersecurity insurance, many major providers, like AIG and Chubb, can help reduce the effects of the following:

* Damaged or stolen data and software
* First-party costs, such as event management, data restoration, and network interruption
* Lost business opportunities
* Extortion (in the event a hacker holds data for ransom)
* Money stolen through false requests or other methods

Nearly all insurance plans are customizable and offer options to further insure the customers or vendors whose information was exposed or taken. 

A data breach never looks good, but being able to reimburse your customers will go a long way toward maintaining their trust and retaining them going forward.

### 2.) Never conduct and confirm wire transfers by email.

Business email compromise (what Crye-Leike sustained in 2018) is a common method for hackers targeting realtors. 

In 2017, one couple in Washington, DC, [lost $1.5 million](https://wamu.org/story/17/08/08/hackers-allegedly-steal-1-5-million-d-c-couple-home-buying-phishing-scheme/) in such a scam. They received a request to wire the title company money for their home at a different address. After re-directing the funds, the couple learned that the company didn't even know about this new request. It was a false organization.

Business email compromise in the form of a bucket brigade attack, also known as man-in-the-middle (MITM) attack, is often very difficult to detect. If they're well designed, they're nearly indistinguishable from routine forms:

![DocuSign Phishing Scam Example](https://images.ctfassets.net/23aumh6u8s0i/73bcOarUqgNmdCPFBAGynZ/6dcb94787e351fb420d9ec22049f581d/docusign)

([Source](https://activerain.com/blogsview/5056521/docusign-scam))

This DocuSign spam email is formatted to look legitimate and includes correct names and dates for context. If an employee is in a rush, it's easy to simply sign without careful scrutiny. 

Recently, hackers have been gaining illegal access to real estate professionals’ email accounts to get information about impending transactions, according to reporting from [WAMU](https://wamu.org/story/17/08/08/hackers-allegedly-steal-1-5-million-d-c-couple-home-buying-phishing-scheme/). If a deal has closed, the hackers often reach out to the buyers while impersonating the real estate company and request that they wire funds to a new address—a similar pattern to what the couple in DC suffered. Buyers end up sending down payments to fraudulent accounts. 

To stay safe from phishing scams, tell your customers that they should never wire funds through email. If they have questions, have them reach out to you directly. 

### 3.) Use a cloud security platform.

While a subset of the real estate industry (tech firms like [Homespotter](http://blog.homespotter.com/), Redfin, and Cadre) is already digital, many traditional shops still rely on printed paper, physical filing systems, and outdated hard drives. This leaves critical data ripe for theft or vulnerable to simply being lost or damaged.

[Moving your data to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/) brings numerous advantages, such as the following:

* Distribution (no single point of potential failure)
* A more stable back end, with multiple backups
* Greater capacity for insight into irregular behaviors

Teams across the board, whether in real estate or other sectors, like [retail](https://auth0.com/retail), [media](https://auth0.com/media-publishing), and [finance](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), are dealing with larger volumes of customer information. Names, email and physical addresses, phone numbers, genders, locations, devices, and even race and religion are valuable in creating more-targeted marketing materials and personalized communications. As teams collect and process more of this data, their repositories are ripe for theft if they don't have the proper security.

Some digital security teams deliver robust identity management solutions that make sure you know who's working within your system at any time. [Auth0](https://auth0.com/), for example, provides a dashboard that allows users to monitor customers logged into their accounts, consultants authorized by a company, and even its own employees. You never know when a hacker is impersonating a user you know and attempting to access sensitive data.

![Auth0 Dashboard and How to Implement MFA and Other Security Features](https://images.ctfassets.net/23aumh6u8s0i/5kLCr8wuGuyrW6HiP8xpzs/06121d1e514fa5fbe6e59df8995f73b8/auth0-dashboard)

Even teams that operate digitally can be scattered, with data in many different locations—not to mention a [mobile workforce](https://www.teampay.co/insights/tools-for-managing-a-remote-workforce/) logging in from all over the world on various devices. The dashboard allows admins a centralized view to better understand what's happening across the board. You can view current and new active users, compare their current and historical behaviors, and even use the tool to quickly block or communicate with users you think are out of line.

Shifting to a cloud security platform will open up a range of new possibilities for organization and security. 

## There's No Better Time to Improve Real Estate Security 

You can't control hackers' behavior. Even the largest corporations with the most robust security systems are vulnerable. But you can control your own security plan. Investing in cybersecurity insurance, educating your employees about email scams, and bolstering your digital and identity-management infrastructure are all important steps you can take to ensure that you and your customers will be able to recover if a breach occurs.

<include src="asides/AboutAuth0" />

Real Estate Security is More Important Than Ever: 3 Ways To Brace Your Team Against Cybercrime

This piece breaks down the new meaning of data leak in today's complex threat environment.

It’s June 1972. A man named Frank Wills notices tape covering the locks in the building he’s guarding in Washington, D.C. He untapes them, thinking nothing of it. A few hours later, he returns and the locks are taped once again to keep the doors open. He calls the police. 

Five men are arrested in their attempt to wiretap the Democratic Party’s headquarters in the Watergate complex. The group was subsequently found to have ties to President Nixon, and the Watergate scandal became one of the first high-profile data breaches in recent history. 

Today, we think of data breaches as the [_Reddit_](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) or [_T-Mobile_](https://auth0.com/blog/3-critical-lessons-from-the-t-mobile-data-breach/) incident or the Equifax scandal. But before the internet was ubiquitous, a data breach could mean something as simple as viewing sensitive personal information, like medical or financial records before they were thrown out, or listening in on phone conversations.

Here’s a breakdown of the largest data breaches in the past decade:

![Chart of largest data breaches in the past decade - including Yahoo, Ebay, Target, and other breaches](https://images.ctfassets.net/23aumh6u8s0i/7uNbL3bf3ndM737gY4bFJU/e9c29726a8561aa897a17978627e41d0/millions-of-accounts-compromised)

In the first half of 2018 alone, there were [668 breaches and over 22 million records exposed](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/).

Incidents are occurring at an increasing pace, volume, and complexity. What's going on beneath the surface?

## How Does a Data Breach Happen?

Cyber attacks on company and personal information can occur in several ways, including [common attacks](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/), like:

* Malware (infiltration of malicious software, such as ransomware and spyware, through holes in outdated systems)
* Phishing (e-mails designed to steal data by tricking recipients into installing spyware) 
* USB traps (hardware devices that employees often plug into their computers that contain malware)
* Mobile attacks (e.g., phishing text messages)

Unauthorized access is at the root of many harmful data leaks. In March 2018, for example, a user gained access to Under Armour's MyFitnessPal user data. [150 million accounts were compromised](https://www.reuters.com/article/us-under-armour-databreach/under-armour-says-150-million-myfitnesspal-accounts-breached-idUSKBN1H532W), including usernames, email addresses, and hashed passwords — all because a hacker was able to get into their network and extract data undetected.

### What a Data breach Can Cost Your Company

A data breach can cost you millions — not to mention lasting reputational damages and loss of customer trust. With the credit card numbers, social security numbers, and other sensitive data from customers that you've stowed suddenly up for grabs, you're vulnerable to a tirade of complaints and churned accounts.

If you're in the U.S., you could be particularly unlucky, with the average financial loss ticking in at $7.91 million per incident.

![Chart showing average financial loss of a data breach - U.S. avg. is $7.91 million per incident](https://images.ctfassets.net/23aumh6u8s0i/6fnxCPnYFJqIwC1U4mLiWX/8096eeed664ef1f2678687941e317edd/average-financial-loss)

<include src="TweetQuote" quoteText="The average financial loss in the U.S. is ticking in at $7.91 million per incident."/>

This just scratches the surface, however. Equifax, for example, is seeing costs from its massive data breach in 2017 [surge past $400 million](https://uk.reuters.com/article/us-equifax-cyber/equifax-breach-could-be-most-costly-in-corporate-history-idUKKCN1GE257) in 2018. 

In settlement costs alone, [Target has had to shell out over $18 million](https://www.nytimes.com/2017/05/23/business/target-security-breach-settlement.html) following its 2013 incident.

Whether it's legal costs, coughing up money to overhaul your current security system, or increased customer churn — you can’t afford a major data leak. 

In a rapidly evolving threat environment, how do you stay safe and avoid a worst-case scenario that derails your progress?

## How to Avoid Data Breaches

It’s impossible to fully remove the risk of a security breach as threats are evolving more rapidly than solutions. In recent years we've seen a rise in:

* state-sponsored attacks
* [disinformation scandals like Facebook’s](https://auth0.com/blog/what-facebook-disinformation-scandal-means-for-your-company/)
* higher instances of denial of service attacks on IoT devices, and even 
* “whaling” of high net worth individuals (a step beyond spear-phishing that lures people to send money to a fake account). 

But despite escalating threats and more cases of information stolen, there are several simple steps you can start with (along with more complex solutions after you've nailed down the basics) that can significantly reduce the chances of an incident — [_no matter what your company size is_](http://blog.idonethis.com/security-ringcaptcha/). You don't have to be a large enterprise to start safeguarding your most important assets.

You’d be surprised at how few companies are taking the basic precautions. Wombat Security recently revealed that nearly 30 percent of employees [don't know what phishing is](https://www.wombatsecurity.com/user-risk-report), and almost 60% haven't heard of [ransomware](https://www.esecurityplanet.com/malware/stop-ransomware.html). Don't be one of these stats!

### Regularly Update Your Software

Many companies, even big successful ones, are working with outdated systems. [_Modernizing legacy systems and apps_](https://auth0.com/app-modernization) can go a long way towards creating a wall that hackers don't breach. 

Equifax, for example, had ample opportunity to [_avoid its massive data leak_](https://www.wired.com/story/equifax-breach-no-excuse/) if it had simply used an available software patch on time. 

Instead, attackers entered its system through an unprotected web-application vulnerability. Don’t wait to take precautions.

### Implement and Measure Employee Risk Training

While your employees are your biggest asset, they can also be your weakest link when it comes to security. Well-meaning employees might pick up a stray USB device and install it out of curiosity (not knowing it’s plagued by malware) or open an email from an unfamiliar address and unintentionally open a portal to sensitive corporate information. 

There are several training programs you can use to make sure your team has the basics down and to help bolster your security. While this is not a comprehensive list, try out courses from:

* Rapid7
* Cofense (formerly PhishMe)
* Wombat Security
* Symantec Security Awareness
* Barracuda PhishLine

If you’re a government organization, the Federal Virtual Training Environment (FedVTE) provides free online modules on risk management and malware analysis. Managed by the U.S. Department of Homeland Security, FedVTE also helps with industry certifications like Certified Information Systems Security Professional (CISSP).

Whatever training route you take, make sure you measure its effectiveness by quantifying changes in employee behavior afterwards. Just [_48 percent_](https://www.esecurityplanet.com/threats/employee-security-awareness-training-that-works.html) of organizations said they took time following a training to assess this. You don’t want to make investments that don’t deliver results. 

### Focus on Identity Management

In addition to an inconsistent user experience, lower conversion rates, and higher developer costs — an inability to manage the identity of your users leads to vulnerable web and mobile applications.

Build or outsource your identity-management needs to proactively vet all users on your platform. This will allow you to more easily implement proven security tools like [_Multi-factor Authentication_](https://auth0.com/docs/multifactor-authentication) or [_Social Login_](https://auth0.com/learn/social-login/).

## What to Do If a Data Breach Occurs

In the unfortunate event of a security breach, [put your customers first](https://blog.ujet.co/5-ways-start-modernizing-customer-support-ux). While it’s imperative to investigate the incident, patch and/or completely update your security systems, and train your employees so that they are better able to stop threats before they spiral out of control — you need to quickly communicate the occurrence to your affected (or potentially affected) user base. 

Deliver as much information as you can to help your customers understand the scope and details of the incident, reassure them that you are taking steps to rectify the damages, and give them the reins to make additional fixes on their own. This will help them feel more in control of their own security and sensitive information.

For example, start by publishing an initial announcement on your website:

![Announcing a data breach to your customers publicly](https://images.ctfassets.net/23aumh6u8s0i/70PuXEJOaGAOkE1If7FexN/eec61bb5a92fc856d7aa19852586e481/security-incidents)

Include critical information like the date of the breach, what was stolen, what your company is doing to rectify the situation, and what users can do on their end to mitigate damage.

Consider holding off on certain forms of communication like text message alerts. Like we saw with the [T-Mobile data breach](https://auth0.com/blog/3-critical-lessons-from-the-t-mobile-data-breach/), these can amplify concerns about phishing and make you seem less professional. While SMS can be a great [marketing tactic](https://www.voicesage.com/blog/sms-marketing-guide/) in campaigns where your users have already opted in and are expecting alerts, it can feel like another intrusion if coupled with a data breach.

Once you communicate the incident in a clear and professional manner, work quickly to update your software, provide additional employee training, and refocus on identity management tools and processes that provide more security and transparency. 

Taking swift measures will help you regain customer trust and bolster your organization against further threats so that you can scale without worry.

What is a Data Breach?

Implement identity management tools for all of your users as you scale.

On August 21, Facebook took down over 600 accounts, pages, and groups that originated in Iran. These accounts were disseminating political disinformation, largely targeted at users in Latin America and the Middle East.

Cybersecurity firm FireEye initially tipped Facebook off about a network of pages called Liberty Front Press. Their reach was 74 Facebook pages, 70 accounts, and 3 groups, as well as 76 Instagram accounts.

The tip also led Facebook to discover an array of other networks, pages, and accounts that were disseminating false information — and engaging in cybersecurity attacks.

With these issues so widespread on the platform, how could Facebook not have figured it out sooner?

Coupled with numerous other [data breaches](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) across multiple companies this year, the most recent Facebook incident highlights how important it is for companies to continually update their user-management practices as they scale — before bad activity gets out of control.

## Facebook's Disinformation Incident Reveals the Challenge of Monitoring All of Your Users

The number of daily active users on Facebook has nearly tripled since 2011. Today, it boasts 1.47 billion users worldwide.

![Facebook daily user statistics](https://images.ctfassets.net/23aumh6u8s0i/1A3WvCiIUCsatoS3Du1l7f/87c64d7a41a81547cc3261de519f27f3/facebook-scandal_daily-users)
 
In addition, as of Q2 2018, the company had over 25,000 employees, and it shares its data with numerous third parties. 

Although it recently ended this practice, following the [Cambridge Analytica scandal](https://auth0.com/blog/what-data-did-facebook-really-give-cambridge-analytica/), Facebook historically shared user information with major online and offline data brokers through its Partner Categories program. This included what the company had collected itself (e.g., page likes) and information from its advertisers.

<include src="TweetQuote" quoteText="With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of Fake news, and accounts are rampant."/>

These providers helped other businesses understand and optimize their marketing campaigns. As an example, [according to Facebook](https://www.facebook.com/help/494750870625830):

"An auto dealer may want to customize an offer to people who are likely to be in the market for a new car. The dealer also might want to send offers, like discounts for service, to customers that have purchased a car from them. To do this, the auto dealer works with a third-party company to identify and reach those customers with the right offer. The third-party partner provides Facebook with information that helps Facebook connect those customers with the offers." 

With so many stakeholders accessing different parts of the Facebook platform at different times, it's clearly too much for Facebook to keep track of [Fake news](https://www.zuora.com/2017/05/26/social-platforms-channel-fake-news-next-revolution-journalism-2/) and accounts are rampant.

How can your team do better?

## Avoid Your Own Disinformation Scandal with Strong Identity Management Tools

Even if you’re not as large as Facebook, there are key steps you can take as your company scales to be sure you are keeping track of who your users are (customers, employees, and third parties) and what behaviors they display in order to root out fake accounts and nefarious activities.

### Identity management for your employees

As your team expands on multiple levels, across new geographies and time zones, following everyone working within your system can be a headache.

Pushing certain [Rules](https://auth0.com/learn/cloud-identity-access-management/) in the cloud, like blocking people or even entire groups from logging in on particular devices or at certain times, can help cut down on inefficient DIY tactics and organize access in a streamlined way.

If using Auth0's solutions, you can quickly pull [user-profile details](https://auth0.com/docs/user-profile/user-profile-details), including

* first name and last name;
* email address; and
* specific company identifiers, such as an employee number or a listed department name.

Given the range of data sources that this information could come from, including custom databases, an Active Directory, or even a social provider like LinkedIn, Auth0 will normalize this and return a basic set of data, with attributes like `user_id`, `name`, `nickname`, and `picture`, to allow admins and programs to retrieve the information they need when double-checking employees.

Giving admins the control to rapidly parse an employee user base will help them notice any suspicious behaviors — like repeated failed login attempts in real-time — mitigating the risk of false accounts or system breaches.

### Identity management tools for third parties

For third parties such as consultants or auditors (or, in Facebook's case, purchase-data providers like Datalogix, Epsilon, Acxiom, and BlueKai) that you allow into your system but that are not regular employees, providing them with a single sign-on (SSO) feature through [Auth0 Universal Login](https://auth0.com/universal-login) will not only make things cleaner and more efficient on their end but also help consolidate all of their credentials into a single location for vetting purposes.

Auth0 Universal Login provides a secure login infrastructure to authenticate users to your apps.

![Auth0 Universal login page](https://images.ctfassets.net/23aumh6u8s0i/6TwsXjuNeMnkg5I4ZN3y5o/c4b1c77a6e5b8e10b44dc000bde49d19/auth0-centralized-login)

On the back end, after the authentication event occurs, admins can call the `getUserInfo` method to acquire all of the user's profile information (as needed).

Keeping track of external users is critical in maintaining order and privacy within your system as needed (as Facebook's canceled Partner Categories program highlighted). Because these users aren't formal employees, you want to be sure that they still adhere to your company's standards and practices and aren't straying or creating unwanted programs.

### Customer identity management tools

Knowing your customers is key to growing your company. Strong customer-identity and customer-access tools can make onboarding quick and fun, up your daily active-user base, reduce churn, and [drive conversions](https://blog.nomnominsights.com/turning-customer-feedback-into-research-hypotheses/).

It also helps you ensure that no one is masquerading as someone they're not.

This year, British shipping company Clarksons revealed that a single fake account was to blame for [stealing confidential information](https://www.zdnet.com/article/clarkson-says-single-user-account-to-blame-for-data-breach/). The account accessed corporate databases and made off with highly sensitive data, such as Social Security numbers, criminal convictions, medical information, tax and insurance details, signatures, and login credentials — along with even more personal details, like ethnicity and religion.

To get out of the mess, Clarksons had to hire outside forensic help to find and disable the problematic account.

Implementing social integrations can help you avoid this by immediately double-checking that all users are who they say they are. A social login feature relies on existing login information from a social network provider like Google to verify a users identity.

![Log into a Wordpress site using social login provider](https://images.ctfassets.net/23aumh6u8s0i/4DR1XvnUhTlC5oOYIQw4vU/c5c39ff1cd0ec9e4a6d26cb97ca860ed/facebook-scandal_auth0-wordpress)

A customer can sign into a third-party website like WordPress through Google instead of creating an entirely new account. Since the provider (Google) has already authenticated the user, it provides an extra layer of security.

Any further support you can get to vet users — even your loyal and trusted customers — can go a long way toward avoiding a costly data breach.

<include src="TweetQuote" quoteText="Creating or outsourcing tools like Auth0 Universal Login for rapidly pulling and storing current user data, and features like social login will help secure your company at its foundation so that you can grow."/>

## Use Identity Management Tools to Stop Bad Behavior at the Source 

As your company grows, it's a blessing to bring on more users — whether new customers, freelancers, consultants or employees. But it can quickly become a curse if you don't implement strong practices for monitoring them.

As the Facebook disinformation scandal clearly shows, without proper tracking, small issues can balloon out of control. Ideally, you'd stop any fake accounts at the login source so they don't snowball at all.

Creating or outsourcing tools like [Auth0 Universal Login](https://auth0.com/universal-login), [Rules for rapidly pulling and storing current user data](https://auth0.com/docs/rules/current), and features like [social login](https://auth0.com/learn/social-login/) will help secure your company at its foundation so that you can grow.

What the Facebook Disinformation Scandal Means for Your Company

3 lessons business leader can learn from the T-Mobile data breach to protect their teams and customers.

On August 20, T-Mobile discovered that a hacker had gained personal information from unauthorized access to its system. Over 2 million of its 77 million customers were exposed.

Although T-Mobile quickly reported the incident to authorities, it's apparent that the cybercriminal is [aiming to sell the data](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420), including names, ZIP codes, phone numbers, email addresses, and payment information.

While it's still too early to determine the financial consequences T-Mobile will face from the incident, a recent [study](https://blog.kenan-flagler.unc.edu/risky-business-the-impact-of-data-breaches/) from UNC found that data breaches can cost companies as much as 3% of their market value. Dashlane estimates the average dollar cost at [$7.35 million](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) in the U.S., 60% of which is customer (revenue) loss.

 What can business leaders learn from this incident to protect their teams and their customers going forward?

## Lesson 1: Hackers Go for Weak Points, So Protect Yours

Understanding how hackers get in is the first step. There are [four common ways](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/) that hackers access systems:

1. Malware infiltration (placement of malicious software, including ransomware and spyware)
2. Phishing (emails that trick recipients into giving away sensitive data or downloading a file that installs spyware)
3. USB traps (a hardware device that contains a HID spoof)
4. Mobile attacks (attacks specifically designed for mobile software)

In all cases, hackers look for the simplest vulnerability they can possibly use to compromise your system. That means they're not necessarily going to try to waltz in the front door. In the T-Mobile data breach, the thief was able to access the system through a hole in an API.

It's critical to plug your leaks. Since APIs run on web servers, they are available to all internet users. Like websites, hackers can crawl APIs.

### Authorize Your Users

To be sure you know who is working within your system at any one time, implement a strong user management system. You can build one in-house or outsource it. Many choose to outsource their identity management since the field is increasingly complex and time-intensive — a challenge for in-house teams to manage with the rest of their workload.

Auth0's [user management](https://auth0.com/user-management) dashboard, for example, lets administrators grant permissions for certain users to access sensitive customer information.

![Auth0's user management dashboard](https://images.ctfassets.net/23aumh6u8s0i/QocoCmdAqGCxzA9wCSqsp/c0f08f478e78129808dea8aa38477077/authorization-permissions)

With this powerful web interface, they can add or remove users, modify their profiles, and identify any root-cause login issues.

With APIs, it's also important to remember to authenticate your apps in addition to authorizing users. You can use a [standardized protocol](https://auth0.com/docs/api-auth) for both authentication and authorization.

## Lesson 2: Update Your Password Practices

A 2017 Verizon report found that [81%](https://blog.dashlane.com/data-breach-statistics-2018-forecast-everything-you-need-to-know/) of hacking-related breaches were due to stolen and/or weak passwords. While for years teams relied on the MD5 (message-digest) algorithm to hash passwords (create mathematical representations of plain text), today it's not considered the safest method.

<include src="TweetQuote" quoteText="A 2017 Verizon report found that 81% of hacking-related breaches were due to stolen and/or weak passwords."/>

Although originally MD5 hashes were designed to prevent anyone from working backwards from the hash to determine the real password, it's now possible to rapidly generate MD5 hashes to eventually find a matching password.

[Evidence](https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420) points to T-Mobile password hashes being MD5, which suggests the company may have been using outdated password practices.

To prevent the risk of password hacking, many providers are using bcrypt instead — a more resistant algorithm. bcrypt uses a salt, an additional layer safeguard for passwords in storage. Over time, users can increase bcrypt's iteration count to slow the process. This makes it more resistant to brute-force search attacks.

### Implement Two-Factor Authentication

Two-factor authentication or 2FA is an alternative verification method. In addition to requiring users to type in a password, 2FA can also request a TOTP (a time-based one-time password algorithm) that it sends to the user's cell phone or other hardware device.

2FA can also require the second form of identification to be a biometric, such as a thumbprint or Face ID.

![iOS 11 iPhone X Face ID](https://images.ctfassets.net/23aumh6u8s0i/i6mkIBMKzZboV96MAaR8I/a18fc7a031c9f5660c611d89a7e52de0/ios11-iphone-x-face-id-hero)

[[Source](https://support.apple.com/en-us/HT208109)]

While none of these solutions are foolproof, a second method of authentication has been found to prevent breaches in [80%](https://www.slideshare.net/cheapsslsecurity/vip-strong-authentication-no-passwords-infographic-by-symantec)of the cases.

## Lesson 3: Improve Communication with Customers After a Data Breach

Although T-Mobile did attempt to notify customers whose accounts might have been compromised a few days after they discovered the incident, many of these recipients were put off — thinking the text message itself was a form of phishing.

![T-Mobile Data Breach Tweet](https://images.ctfassets.net/23aumh6u8s0i/1mspiKVeO2GUD8nXvUZw8z/7ba4d36cdc43e5edbcdbcf60907236b0/tmobile-tweet)

[[Source](https://techcrunch.com/2018/08/24/t-mobile-says-hackers-stole-customer-data-in-data-breach/)]

Texting can be a tricky form of communication for something so sensitive (particularly from a large, impersonal corporation). Organizations like [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/) and Equifax have succeeded with well-crafted PR campaigns and explanations on their websites:

![Reddit data breach press release](https://images.ctfassets.net/23aumh6u8s0i/KD5ZLDwuM8UeOKhP3UW2K/bcb28aeb0eda8d90b2a6daee7e69f580/reddit-breach-release)

As a portion of the full announcement (which you can read [here](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)), Reddit clearly defines the scope of the breach, including details of what information the hacker accessed and how to know which users were affected.

Reddit also lets users know ahead of time that they will be contacting them through email to verify if their account has been compromised.

This is in stark contrast to T-Mobile's [vague description](https://go.skimresources.com/?xs=1&url=https%3A%2F%2Fwww.t-mobile.com%2Fcustomers%2F6305378821&xguid=85UTUFk2RzAa&id=66960X1514734&checksum=fc5d6ea7126bb8e6a7af56a7049975e787946c4e625ac9ceef083a8513bb04da) that their team shut down “an unauthorized access to certain information.”

![T-Mobile data breach press release](https://images.ctfassets.net/23aumh6u8s0i/3di8OI1TiR8WKlOTKzEIX3/560aff9c400227387f70fbc291cfad36/tmobile-breach-release)

Being as specific and transparent as possible (as quickly as possible) will help your customers trust that you are handling the situation and keeping them safe.

## Recent Data Breaches by the Numbers

It seems like every week there is a new catastrophe for personal data in the headlines. [Reddit](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/), Saks, Ticketfly, Panera, Lord & Taylor — these are just a handful of the major incidents so far in 2018.

The first half of 2018 saw nearly 700 breaches, on pace to equal 2017's staggering 1,579 breaches.

![T-Mobile Data breach chart](https://images.ctfassets.net/23aumh6u8s0i/2zNkiAn1hkY4MHzNlS1usB/28808e7918247c784def7780f80ae734/data-breach-chart)

The total number of exposed records from these incidents in the past five years tops 580 million.

<include src="TweetQuote" quoteText="The first half of 2018 saw nearly 700 data breaches, on pace to equal 2017's staggering 1,579 breaches."/>

In addition to data breaches, data exposures — when data is improperly defended and open for access on the internet — are on the rise. Instead of a malevolent hacker getting through a protected system, a data exposure occurs if a database isn't correctly configured or doesn't require appropriate authentication. In 2018, Exactis, for example, exposed [340 million records](https://www.wired.com/story/exactis-database-leak-340-million-records/), putting 2 terabytes of personal information at risk.

You don't have to be as large as T-Mobile to take powerful steps to secure your company. [Small businesses](https://www.godaddy.com/garage/online-security-advice-small-business/), for example, can still implement multi-factor authentication and improve their password practices. Taking steps to secure your customer data — whatever your size — will help you avoid becoming an easy target for hackers.

## Bolster Your Security in Order to Scale

Data breaches and exposures can quickly erode customer and investor trust — particularly at critical times in a business's lifecycle. For example, T-Mobile is currently in [a $26 billion merger agreement](https://www.zdnet.com/article/t-mobile-and-sprint-to-merge-finally-strutting-5g-clout/) with Sprint. The deal, which has already been subject to regulatory scrutiny, could face even more hurdles if parties see T-Mobile's lack of updated security practices as a liability.

On the flip side, if you strengthen your defenses and clearly communicate your progress, you have a better chance of emerging from any issues with your reputation intact.

Make sure you are on top of the latest security practices and protocol to avoid worst-case scenarios that could obstruct progress.

3 Critical Lessons from the T-Mobile Data Breach

Learn how advanced forms of two-factor authentication and identity management can prevent data breaches.

On June 19, [Reddit learned that an attacker had breached several employee accounts](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb) via the company's cloud and source-code hosting providers:

![Reddit 2018 data breach public release note](https://images.ctfassets.net/23aumh6u8s0i/3vvdTEoXaRdiioBWnvYVGw/304ad288397fd4941d530ee9feffba77/reddit-data-breach-release-note)

[[Source](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb)]

No Reddit information was altered, and the company quickly moved forward to lock down proprietary data, but it's still caused ripples of concern among Reddit's community of users. The theft contained a complete copy of an old database backup that held personal data from Reddit's early users. This largely included account credentials (username + salted hashed passwords), email addresses, and messages — valuable information that thieves can recycle to access other accounts, such as health or financial records.

This is one of hundreds of breaches this year. According to Statista, [the U.S. has seen 668 data breaches](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) that have exposed more than 22 million personal records.

![2018 US data breaches statistic numbers](https://images.ctfassets.net/23aumh6u8s0i/kmr11NOwGzu3xUNCzXeUH/9c715131409344e33a249f3e0a3561b8/2018-us-data-breaches-by-the-numbers)

The pace of break-ins has been steadily rising for over a decade.

How do companies like Reddit protect themselves in an increasingly dangerous environment? This piece digs into key strategies you can use to brace your company against attacks before they happen — and tells you what to do if the unfortunate occurs.

## Why Didn't Two-Factor Authentication Stop Reddit's Data Breach?

Although Reddit employed a [two-factor authentication](https://auth0.com/learn/two-factor-authentication/) (2FA) shield, it was SMS-based, and the main attack occurred via SMS intercept.

All forms of 2FA require a user to provide a second form of identification — over and above a simple password — to gain access to a system. The most common 2FA method sends the user a unique token via SMS/text message.

![Text messaging SMS showing two-factor authentication 2FA code](https://images.ctfassets.net/23aumh6u8s0i/3aTnxxkyFkwyPh8Mk0EeJR/5f46a5d0fc3e2cf01d8de31beb455de4/text-message-two-factor-authentication-code)

[[Source](https://spriv.com/automated-two-factor-authentication/)]

This is generally a 5- to 10-digit code, which the user types in after the successful entry of their username and password. Many enterprises have opted for this method because [two-factor authentication is user-friendly](https://www.appcues.com/blog/privacy-conscious-consumer) (nearly everyone is familiar with receiving text messages) and is inexpensive to set up.

Yet the method clearly has holes. SMS 2FA is vulnerable to swings in cell-phone connectivity and can be easily intercepted by third parties.

A more secure version is employing software tokens. Software tokens in 2FA have gained popularity in recent years with the rise of smartphones.

The [Microsoft Authenticator](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/end-user/microsoft-authenticator-app-how-to) is an example of a popular software token-based solution, which could have provided Reddit a tighter wall against hackers.

![Microsoft Authenticator app in action](https://images.ctfassets.net/23aumh6u8s0i/3hUiPXdXBRNCeNWxpA9Mqu/c14c2ce1fd77d24ae5ba9ee388422c9f/microsoft-authenticator)

The Microsoft Authenticator is one of many similar tools, including the Google Authenticator, Twilio Authenticator, and LastPass Authenticator. They all rely on a time-based one-time password (TOTP) algorithm to generate a short-lived (30 seconds or less) password. The user must [copy the password into the website](https://uk.godaddy.com/blog/how-to-avoid-web-design-mistakes-that-could-sabotage-your-business/)'s or app's required field for verification before it expires.

<include src="TweetQuote" quoteText="SMS 2FA is vulnerable to swings in cell-phone connectivity and can be easily intercepted by third parties. A more secure version is employing software tokens."/>

### Other Forms of 2FA That Could Have Stopped the Reddit Data Breach

Hardware tokens are another method that many enterprises use. They rely on a physical device, such as a key fob or USB dongle, that generates a token for the user.

![DUO hardware token for two-factor authentication](https://images.ctfassets.net/23aumh6u8s0i/5qQ6dhwRziynoTxCrEzVbh/7f76c542b435941ba28d5c00a00d70b2/duo-hardware-authentication-token)

[[Source](https://guide.duo.com/tokens)]

Unlike SMS and software tokens, hardware tokens don't require cell-phone reception or even Wi-Fi; however, they are costly to set up and maintain. In addition, employees often misplace hardware tokens or confuse them with other personal devices.

Several teams rely on email or phone verification, where the user receives a link or a voice recording with an alphanumeric token. While these options are also relatively inexpensive and easy to set up, they can, like SMS tokens, fail in delivery and are vulnerable to interceptions.

An exciting area of [multifactor authentication (MFA) that is on the rise is biometrics](https://auth0.com/blog/identity-as-a-service-in-2018/). This eliminates additional devices altogether and instead relies on a user's inherent credentials, such as fingerprints, a retina, or even gait.

## Incorporate 2FA as Part of a Larger Identity Strategy to Stop Cyber Theft

Two-factor authentication is a critical component of security for enterprises today — despite [the fact that only 28% of people employ 2FA](http://fortune.com/2017/11/07/cybersecurity-2fa-two-factor-authentication/). While it's important to help all of your users implement 2FA, there are other elements of identity management that companies like Reddit should consider.

For example, identity-management providers like [Auth0 have several Rules](https://auth0.com/docs/rules/current) that its users can turn on quickly to immediately detect fraud within a system and take action against it. A dashboard view also allows system administrators to observe all of the activity that is taking place at a given time.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/10u8AWJkh17HuFzODWxKoB/ec0260b5f23338d27577d6cddcd4afac/auth0-dashboard)

Instead of trying to work with disparate streams of user data (e.g., new sign-ups in one place and historical usage over time in another), a well-constructed dashboard can offer multiple visualizations of this information in the same location. From there, admins can take swift action when they see something is amiss.

With Auth0's [anomaly-detection feature](https://auth0.com/docs/anomaly-detection), you can implement several shields from the dashboard that will block users after a certain number of failed login attempts. In addition, if you know that their information was recently compromised in a major security incident, you can screen for logins from these accounts. For example, if Reddit makes the information available, Auth0 will flag these emails in case the Reddit thieves are using these credentials to impersonate the users.

The more steps you can take to build out your identity management system, the better off you will be as attacks come from multiple angles.

## How to Help Users After a Data Breach Occurs

The most important thing to do when you learn that your system has been compromised is to immediately communicate it and take action.

1. Report the breach to law enforcement, including any data you have on the number and types of accounts the thieves were able to access.
2. Test the accounts that you believe might have been compromised by sending emails or otherwise attempting to verify if the account holders are still who they say they are.
3. Immediately improve your login systems and any current 2FA approaches, and consider [outsourcing more elements of your identity-management system](https://auth0.com/b2e-identity-management-for-employees) to experts.

Reddit quickly [published data breach mitigation steps on its site](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/?st=jkk18vb3&sh=ad92bacb):

![Reddit data breach mitigation steps notice](https://images.ctfassets.net/23aumh6u8s0i/5zhdOhTCsOpYxpQD7y9nYA/016f7549c2d8c920ac272e29a098ca6c/reddit-data-breach-mitigation-steps-notice)

Offering immediate, actionable steps accompanied by links to more detailed pages of information is a great way to help your users without overwhelming them with technical information.

<include src="TweetQuote" quoteText="The most important thing to do when you learn that your system has been compromised is to immediately communicate it and take action."/>

Hopefully, you won't have to employ these final tactics; however, given today's challenging threat environment, particularly for teams with large user bases, it's critical to stay up to date on the latest solutions and security strategies to avoid a worst-case scenario.

<include src="asides/AboutAuth0" />

What Companies Can Learn From The Reddit Data Breach

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

A new global ransomware attack is affecting European countries and governments



In May, a ransomware called [WannaCry](https://auth0.com/blog/a-massive-ransomware-attack-targets-organizations-around-the-globe/) became famous around the world for holding computers' file systems as hostages. Today, government institutions (like [Ukraine's national bank](http://www.independent.co.uk/news/world/americas/petya-cyber-attack-us-pharma-merck-ukraine-ransomware-national-bank-power-wpp-ad-agency-wannacry-nhs-a7810906.html)) and companies from the private sector reported that another outbreak has started.

The ransomware responsible for haunting organizations today is called Petya, although this name originates from a [ransomware that attacked last year](https://blog.kaspersky.com/petya-ransomware/11715/). Similarly to WannyCry, today's Petya ransomware starts by encrypting a computers file systems and then it demands payments to restore access to these files.

## What Is a Ransomware?

The very definition of ransomware is a malware that blocks access to the victim's data until a ransom is paid. There are some ransomwares that lock the systems in a way that is not difficult to reverse, but the more advanced ones are using a technique called [cryptoviral extortion](https://en.wikipedia.org/wiki/Cryptoviral_extortion). This technique consists of encrypting victims files, makes them inaccessible. To regain access, the authors demand a ransom payment to reverse the encryption. Nowadays, most ransomwares are requesting [Bitcoins](https://bitcoin.org/) as ransom payment, to [take advantage of cryptocurrency's anonymity](https://bitcoinmagazine.com/articles/is-bitcoin-anonymous-a-complete-beginner-s-guide-1447875283/).

## What Is Petya Ransomware?

The real name of the ransomware that is striking today has not been defined. But, as this ransomware is supposed to be a variant of [Petya](https://blog.kaspersky.com/petya-ransomware/11715/), the name is being reused. Petya locks a computers hard drive as well as individual files stored on it. It's not easy to recover data from the computers affected by this malware.

One interesting fact is that cyber security experts at Kaspersky Lab have released a report that said the ransomware was not related to Petya but was in fact a new ransomware it called [NotPetya](https://www.forbes.com/sites/thomasbrewster/2017/06/27/petya-notpetya-ransomware-is-more-powerful-than-wannacry/#16c86cff532e). The contradictions are yet to be clarified.

![NotPetya/Petya screenshot](https://images.ctfassets.net/23aumh6u8s0i/3YZyJ4v23esutsMRvDiiqf/04e819bd692dafe953ca066274fdfcf9/notpetya)

## How Petya Started?

[A Ukrainian software firm is alleged to be the source of today's outbreak](https://www.forbes.com/sites/thomasbrewster/2017/06/27/medoc-firm-blamed-for-ransomware-outbreak/#20ca49ae73c8). Although there is no confirmation about this, and that the company has denied these claims in a [Facebook post](https://www.facebook.com/medoc.ua/posts/1904044929883085), the outbreak is indeed striking Ukraine harder then any country.

![Petya/NotPetya attacks by country](https://images.ctfassets.net/23aumh6u8s0i/79338Jos1R3YU6mfYS64kT/dff234a5379b9d3a8e5cb66c029a5c72/by-country)

## How The Petya Ransomware Spreads?

Researchers are saying that the this new outbreak is hitting systems via the same leaked NSA vulnerabilities used by [WannaCry](https://auth0.com/blog/a-massive-ransomware-attack-targets-organizations-around-the-globe/). The analysis of some of Petya's samples confirmed that the malware author used the [EternalBlue exploits](https://en.wikipedia.org/wiki/EternalBlue), which targeted a vulnerability in Microsoft Windows. [Microsoft already created patches to solve EternalBlue vulnerability](https://www.theverge.com/2017/4/15/15311846/microsoft-windows-shadow-brokers-nsa-hacks-patched), but many computers out there don't have this patch applied.

## How Do I Protect Myself?

Although no solutions were found for retrieving data from computers affected by Petya so far, you can review and [update your devices](https://www.theverge.com/2017/4/15/15311846/microsoft-windows-shadow-brokers-nsa-hacks-patched) and also check that your approach to security is good. Recently we wrote a blog post that shares some good practices regarding [Personal Information Security Guide for Family and Friends](https://auth0.com/blog/personal-information-security-identity-guide/).

Be sure to check out this [guide](https://auth0.com/blog/personal-information-security-identity-guide/) to learn how to secure your wireless network, backup your data so that it is not lost if you become a victim of ransomware such as WannaCry, detect phishing scams, and more.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Global Ransomware Strikes Again

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

A global cyber-attack using leaked NSA tools is targeting organizations worldwide including UK's National Health Service, Spain's Telefonica telecom, and many more.



A ransomware, called [**WannaCry**](http://money.cnn.com/2017/05/12/technology/ransomware-attack-nsa-microsoft/), is making rounds across the globe and infecting vulnerable systems worldwide. Amongst the affected include FedEx, UK's National Health Service, Spain's Telefonica telecom, Russia's Interior Ministry, and many more. Hackers exploiting leaked NSA secrets and tools are said to be behind the massive attack, although no specific group has been identified as of yet.

The **WannaCry** ransomware encrypts a computer's file system and demands payment to restore access to the files. If a payment is not made in 7 days, the ransomware will delete all of the files on the machine. The attack, circulated initially through email, targets Windows machines that have not received the March 2017 security update where Microsoft fixed the vulnerability that makes this particular attack possible.

![WannaCry Ransomware](https://images.ctfassets.net/23aumh6u8s0i/5uOAgDiG784chdydy4fMHI/e1f7f71a48912fd9ba6396731004ec71/wannacry)

Ransomware attacks are nothing new. In 2016, a [Los Angeles hospital paid $17,000](https://www.nytimes.com/2016/02/19/business/los-angeles-hospital-pays-hackers-17000-after-attack.html) to regain access when hackers seized control. In fact, in our [Security Trends for 2016](https://auth0.com/blog/security-trends-for-2016/), we mentioned that **cyber extorsion** is likely to evolve and keep security specialists up at night, and we hate that we were right. The **WannaCry** cyber-attack is looking to be one of the biggest attacks recorded!

The **WannaCry** cyber-attack has been reported in 99 countries and over 75,000 attacks have been carried out so far, but perhaps the most concerning is the attack on UK's National Health Service (NHS), as it has life-or-death implications. An important thing to note is that these numbers are only from victims that have self-reported the attack, which means that the scope of this cyber-attack is most likely larger than reported.

Companies can protect themselves and their users agains cyber-attacks by developing strong incident response capabilities to complement their traditional security measures. As prevention can not be successful everytime, being capable of detecting and responding to incidents quickly is crucial. For individuals, the best way to prevent becoming a victim of ransomware and other cyber-attacks is to always keep your operating system up-to-date by enabling automatic updates. It may be annoying to see the *"You need to restart your computer to apply updates"* message, but a 5-10 minute downtime beats losing years worth of data.

## Personal Information Security Guide

Although you may not be affected by the **WannaCry** ransomware, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, detecting phising scams, backing up data, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

Be sure to check out the [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) to learn how to secure your wireless network, backup your data so that it is not lost if you become a victim of ransomware such as **WannaCry**, detect phishing scams, and more.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


A Massive Ransomware Attack Targets Organizations Around the Globe

An unsecured database allowed hackers to steal personal information from over 820,000 Cloudpets customers. Learn how this may affect you and what to do next.

[Spiral Toys](http://spiraltoys.com/) is a company that creates toys for children. It has an internet-connected product called [CloudPets](http://cloudpets.com/) which allows parents and children to record and send voice messages to each other through a mobile app. On January 7, hackers discovered that the database the company was using to store data for this product was unsecured. Hackers took control of the database, deleted all information, and demanded a payment to restore the data.

![Cloudpets Homepage](https://images.ctfassets.net/23aumh6u8s0i/4ISXmWTbhcqnqACVvBoSLv/6c7cb193c8c49f69d71da5ffd32cc7bc/cloudpets)

The database contained information for 820,000+ users containing emails, bcrypt hashed passwords, and links to voice recordings customers and their children had made which could now be publicly accessed. Additional information stored included pictures, names, birthdays, and relationships. Customers were not notified that their data had been compromised.

[Troy Hunt](https://twitter.com/troyhunt) wrote an excellent [article](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/) covering this incident. Some highlights include that the database used was publicly accessible and did not even require a password to access. Cloudpets was also notified at least four times that their database was exposed and the reporters never heard back from the company. Finally, staging and test databases were also discovered which had production data that could have also been compromised.

Aside from the devops failure to secure the database properly, password requirements for user accounts were non-existant. Although the passwords were stored as bcrypt hashes, Troy was able to use [Hashcat](https://hashcat.net/hashcat/) and find valid passwords such as "qwe", "password", and "123456".

![Cracked Bcrypt Hashes](https://images.ctfassets.net/23aumh6u8s0i/1ChTEWQXZQBJD3YjBclNhX/76bdc049376598ed8261792961ad335d/cracked-bcrypt-hashes)

Source: [Troy Hunt](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/)

Since the database has been publicly exposed since at least December 25, 2016, it is safe to assume that many malicious parties have accessed and downloaded the data. We urge customers that have Cloudpets accounts to change their passwords and monitor their other accounts for signs of malicious activity.

## Personal Information Security Guide

Even if you don't have a Cloudpets account, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, best practices for choosing good passwords, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

## Auth0 Can Protect Your Users and Apps

Managing identity is a complex and difficult task. At [Auth0](https://auth0.com), our goal is to make identity simple for developers. A recent feature we launched called [Breached Password Detection](https://auth0.com/breached-passwords) can help alert your users that their credentials have been compromised in a data breach when they login to your app. We are still working on getting and adding credentials from this breach to our database to better protect your users. This feature helps your users stay safe, but also protects your apps from malicious access. Additionally, Auth0 meets the standards for various [password strength requirements](https://auth0.com/docs/connections/database/password-strength), provides [multifactor authentication](https://auth0.com/multifactor-authentication), and more.

If you want to make identity simple and secure for your applications, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">give Auth0 a try</a>.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

Cloudpets Data Breach Affects Over 820,000 Customers

667b1c82b6cc2241ff176d50c65da603?s=200 avatar

667b1c82b6cc2241ff176d50c65da603?s=200

Guest Author

Eugene Kogan

Security is a challenge at most startups. Here's some advice on how to create a data breach response plan for the worst case scenario, a large-scale data breach.

A serious data breach can have massive negative repercussions for any organization, including the loss of customers, revenue, reputation, even intellectual property. For a startup, it can mean the end of your business. 

## Security for the Lean Startup

Unfortunately, startups are often completely unprepared to deal with a major security incident that involves a breach of sensitive data. Unlike larger, more mature organizations, startups have no choice but to be lean and spend their limited resources carefully. Startups are also worth much less than bigger companies, and all of their energy is focused on growth and proving a business model. So it’s no wonder that they tend to spend less time and money on issues like security, let alone data breach response.

On the other hand, no one wants to see their fledgling company go out of business because of a security breach. So how much time and money does it make sense for a startup to invest in preparing for a breach? I think of planning for the worst as somewhat of an insurance policy. You hope that a data breach doesn’t happen to your company. You put some effort into preventing one through reasonable security controls. But just in case something goes wrong (like if that small security incident suddenly becomes a breach of your credit card database) you want to be prepared.

Now that I’m responsible for security at Auth0, issues like this are increasingly on my mind. It’s my first time working at a startup, having spent the last 15 years working security at huge organizations like AT&T, Amazon.com, and the US Department of Defense. These folks are seriously prepared for anything, from a laptop with malware to a major natural disaster. But when you join a startup, you quickly learn how to pave the road as you’re driving it. Auth0 is a rare startup, since security has been a core part of our business from day one. But even for us, it can be hard to find enough time to plan for unlikely (yet potentially devastating) scenarios like a data breach.

## Data Breach Response Plan is sort of a Big Deal

Let’s assume your startup has enough valuable intellectual property, a growing user base, and increasing amounts of customer data. It’s likely that you’re already dealing with security incidents on a regular basis. You have a decent incident response plan that is sufficient for the common security issues that small companies face, and it’s probably not a big deal to quietly take care of these in-house.

A data breach is not a run of the mill security incident. What I’m talking about here is a major “oh crap” moment when you realize your entire user database was posted on Pastebin, along with those passwords you meant to [hash](https://crackstation.net/hashing-security.htm) with something better than SHA-1 but didn’t quite get around to doing. (It’s ok, we’re a startup, right? No! Bad startup! That’s what [Auth0](https://auth0.com) is for.)

## Planning for the Worst

So how would your company respond to such a breach? Do you know the legal requirements for notifying your customers? Should you contact law enforcement? Who do you call first and how long can you wait? Every data breach is different, so I’m not going to attempt to provide specific answers to these questions. A lot will depend on how big your business is, how many users were impacted, where they live, what kind of data was lost, and so on. 

** My goal is to help startups prepare for a data breach and to come up with a simple response plan without spending too much money. **

For a small company trying to respond to a major security incident like a data breach, the best thing to do is to ask for help. It’s just not practical or realistic to have all the necessary expertise in-house, at least not until your business can justify having a very large (and expensive) information security organization.

** I recommend having the following relationships in place _before_ you need them: **

* Cyber liability insurance
* Legal council with data breach experience
* Public relations (PR) firm with data breach experience
* Incident response (IR) and digital forensics consulting firm

Having these vendors under contract prior to an incident occurring is critical. I hope it’s obvious why you’d want cyber insurance in advance, just like you’d want car insurance before getting into an accident. But there are several good reasons for lining up the rest of your response network in advance. First is the issue of timeliness. It takes time to negotiate a contract with a new vendor, even at a startup. But when you’re responding to an incident, you don’t have any time to spare. You’re already late! Also, a lot of the best vendors will be booked up for weeks in advance, working for their current customers. If your plan is to call an IR firm and hope that they can come help you later today, you will be sorely disappointed (or shocked by how much they want to charge you).

## The Costs Involved

Speaking of cost, there are ways to help reduce the upfront expense of being prepared while simultaneously reducing the cost of an eventual response. Lawyers are expensive, and I don’t have any tips on fixing that problem just yet. So pick a good lawyer with a track record of working on major data breaches, and sign a contract to have him or her on a retainer. You should be able to do this without paying much (or anything) up front.

A public relations firm will be a major asset when it comes time to communicate with your customers. The way a company handles a data breach in the public eye can have a huge impact to how people react. You want to provide just enough details but no more, be accurate so you don’t have to issue a correction later, and take responsibility when appropriate. A PR firm with experience in dealing with data breaches will be able to help you get the right message across. That can go along way to mitigating the damage to your reputation and hopefully reducing the number of lost customers. Once you have a PR firm finalized, it may be worth paying them to draft up some boilerplate press releases for potential breach scenarios, just to save time later on.

Something to keep in mind is that even if you already have a PR firm that your startup uses for standard PR needs, they might be totally clueless when it comes to security incidents. You need to ask them the right questions to find out. If your current firm isn’t up to speed, it’s worth having a second PR firm on board just for breach response. Remember, you want to take responsibility for what happened and be honest in your communications, so don't let anyone try to talk you into denying everything or shifting blame.

## Using an Incident Reponse Firm

Do you really need an external IR firm to help you respond to a data breach? If you’re a startup, the answer is almost definitely _yes_. First of all, it’s unlikely that you have a security team with deep technical expertise in digital forensics. You need that expertise to be certain that the cause and extent of the breach has been accurately identified. And if you can’t be sure of that, then you can’t be sure the breach has been fully contained. This is especially true if the cause is an intentional intrusion by an attacker, who may be actively evading your response efforts. For a serious breach that involves law enforcement, you’ll be grateful to have security consultants with LE backgrounds helping you out.

Even with a team of experts, there is never a 100% guarantee that everything has been found and cleaned up. But you stand a much better chance of doing this correctly if you engage an experienced IR firm. Also, when it comes time to do a press release, having a well-known firm on your side will help your users feel like you’re taking the incident seriously.

When choosing an incident response firm, reputation goes a long way. The firms with better reputations attract better talent, at least on average. As always, it pays to ask around for recommendations from people you trust. The bigger firms are generally all decent, and will have several advantages over the smaller firms. First, all major firms offer a zero cost retainer option, so you can sign a contract and have them ready to go without spending any money upfront. Second, they will probably be quicker to respond than a smaller firm, simply because they have more consultants available at any given time.

Another advantage bigger firms have (not just IR, this goes for PR and legal as well) is their breadth of experience. This can be especially important if your startup has customers in foreign countries with strict privacy laws or notification requirements, or if you’re using a complex or niche technology stack. Is your product built with OpenBSD, Scala, and Spark, hosted on Oracle’s cloud? You should probably make sure the IR firm has people with experience using those technologies. Startups tend to be on the bleeding edge and most security consultants simply can’t keep up.

## You Need Insurance

Up until now I’ve mostly avoided talking about cyber insurance, partially because I hate the word “cyber.” But the reality is that every significant business should have some cyber liability coverage to help absorb the financial burden of a large-scale data breach. You will need a policy that’s tailored to your company, its projected growth, and the risks associated with your industry.

The first step to getting cyber insurance is to find a knowledgeable broker. It pains me to say this, since we techies generally don’t enjoy dealing with middlemen like brokers, but that’s really the only way to go at this point (until a startup comes along and successfully disrupts this model). Again, ask your industry peers for recommendations on a cyber insurance broker, and don’t assume your regular business insurance guy will know anything about this stuff. If you start this process with the wrong broker, you may end up with an inappropriate policy that will fail you when it comes time to file a claim.

Selecting a cyber insurance policy should actually be one of your first steps, once you have a clueful broker and a basic incident response plan in place. The reason for this is that almost all agencies will have a list of approved vendors that you’re strongly suggested to use in the event of an incident. They have pre-negotiated rates with these vendors, and they are (allegedly) vetted and deemed competent. It’s usually possible to get an exception to use a vendor that’s not on your insurance agency’s list, but that means jumping through more hoops to get them approved. If you go down this road, your broker should help you out and provide advice. So if you have a particular PR or IR firm in mind that you really want to work with, you should let your broker know before you start shopping around for a policy. I don’t recommend signing any contracts until you are sure that your cyber insurance policy will allow you to work with the vendor in question. This includes legal council and other vendor categories that I haven’t even mentioned, such as credit monitoring and notification service providers.

## The 8-Step Plan

** Here’s my recommended action plan for getting your startup in a good place, ready to respond to a large-scale data breach: **

1. Think about security, work on improving it, and have a decent incident response plan.
1. Document some potential data breach scenarios that your company might face, including the kinds of data that might be impacted, the number of users you have, where they’re located, and so on.
1. Contact a few cyber insurance brokers, ideally from trusted recommendations. Pick one who is knowledgeable and willing to work with startups.
1. Work with your broker, CFO, and security team to find a policy that meets your requirements.
1. Be aware of the agency’s approved vendor list, and ask for exceptions (if you have any in mind) before buying a policy.
1. Carefully select vendors to help you in case of a breach. That includes at least legal, PR, and IR firms.
1. Sign a contract with these vendors so that they are ready to help you respond at a moment’s notice. Go for zero cost retainers if that makes financial sense for your business.
1. Review all of the above as your startup grows and changes over the year. If your revenue explodes, you will need to increase your insurance coverage sooner rather than later.

<include src="TweetQuote" quoteText="Think about security, work on improving it, and have a decent incident response plan."/>

You can never be too prepared when it comes to security. So what are you waiting for?

"data-breach"