jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'>Pizza de Dados</a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' >The Big Git Microbook</a>, creator of <a target='_blank' href='https://gitfichas.com/en'>GitFichas.com</a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'>LinkedIn Learning</a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Generative AI is everywhere, and since not every user has access to all data, learn how to use retrieval-augmented generation with fine-grained authorization to ensure that private information stays private.

Build Trustworthy AI: Implementing Access Control for RAG Systems Using FGA

Sam4-square

I'm an Identity nerd with many years of experience as a developer and advocate. I love explaining complex topics clearly and understandably. You can find me on stage at developer events worldwide or simply having great conversations in the hallway. Google has recognized me as a Google Developer Expert (GDE) in the domains of Web Technologies, Security, Privacy, Payments, and Identity.

Principal Developer Advocate

Sam Bellen

Supercharge your Auth0-issued access tokens with information, like organizations a user belongs to, from your Auth0 FGA decision engine.

Auth0 supports Roles and Permissions and allows you to add users' permissions to your access tokens with a convenient toggle in the dashboard. But what if you’re using a more fine-grained solution to make access control decisions, like [Auth0 FGA](https://a0.to/auth0-fga-content) or its open-source counterpart, [OpenFGA](https://a0.to/fga-content)?

Actions are our way of offering developers flexibility. There are many different use cases for Auth0 Actions, and enriching an access or ID token is one of them. In this blog post, we’ll explore how we can add some relevant user data from our Auth0 FGA decision engine to the access tokens issued by our Auth0 tenant so that we can use that data in our application logic.

## Prerequisites

For this blog post, we assume you are familiar with either Auth0 FGA or OpenFGA and have an instance up and running. If you’d like to follow along, you can use the following model and tuples to set up a test store, or you could adapt the code for our Auth0 action later to reflect your use case.

> If you are unfamiliar with Auth0 FGA, OpenFGA, or how to get started, read [this blog](https://auth0.com/blog/fine-grained-access-control-with-okta-fga-nextjs/) post to learn more.

## The OpenFGA Authorization Model

Our [model](https://openfga.dev/docs/getting-started/configure-model) will contain a “user,” an “organization,” and a “document” type. An organization can have admins who are defined users and members who are either directly defined users or any user who’s already an admin for the organization. One or more organizations can own documents, and access rights are determined by the “doc_creator” and “doc_admin” relations from these organizations.

```
model
schema 1.1

type user

type organization
relations
 define admin: [user]
 define member: [user] or admin
 define doc_creator: [user] or member
 define doc_admin: [user] or admin

type document
relations
 define owner: [organization]
 define can_create: doc_creator from owner
 define can_delete: doc_admin from owner
```

### OpenFGA Test Tuples

These are [the tuples](https://openfga.dev/docs/getting-started/update-tuples) I’ve added to our Auth0 FGA Store. The ``auth0|62...7f`` is a user identifier within Auth0 and will be part of the Access Token as the `sub` claim. We’ll use these user IDs in our action code to look up all organizations belonging to the current user.

```js
[
 {
 "object":"organization:devrel",
 "relation":"admin",
 "user":"user:auth0|62...7f"
 },
 {
 "object":"organization:openfga",
 "relation":"member",
 "user":"user:auth0|62...7f"
 } 
]
```

## Let’s Write Our Auth0 Action

We can create our [Action](https://auth0.com/features/actions) from the Library page under the Actions menu item. Once we’ve navigated to this page, click the “Create Action” button in the top-right corner. This will allow us to install an action from the marketplace, start from an existing template, or write one from scratch. We’ll choose “Choose a template”, as there’s a template available that can serve as a solid basis from which to start.

![Let’s Write Our Auth0 Action](https://images.ctfassets.net/23aumh6u8s0i/6MUa1wOTUXVfJjelvLvUNT/d006cd1500a5dd4531ba4b6f0e9190a5/enrich-auth0-access-tokens-with-auth0-fga-data_01.png)

On the next page, select the “Enrich profile” use case and click on the “Add Email to Access Token” template. This template will add an email address to your access tokens, but we’ll adapt it to add organizations from Auth0 FGA instead.

![Template for Actions](https://images.ctfassets.net/23aumh6u8s0i/4NDnN6YTO3fMSBNBGUfYXh/ff765bc5ef61b437d2b8862cda074bc3/enrich-auth0-access-tokens-with-auth0-fga-data_02.png)

You can now preview the code from the template and click on the “Use This Template” button to install it. The following popup will ask you to give a name to the new action. We will leave the “post-login” trigger and node runtime as is and click “Create”.

![Add Email to Access Token](https://images.ctfassets.net/23aumh6u8s0i/3UhXvF3kmvyW5JuqLILbHn/4f2c28ffb2af2d164ba3bdc5ed2bf9a9/enrich-auth0-access-tokens-with-auth0-fga-data_03.png)

![Create Action](https://images.ctfassets.net/23aumh6u8s0i/6JWXbwZJVcgnltt0oI7JXM/c1a7905d5d73d68f6964bc7798493d17/enrich-auth0-access-tokens-with-auth0-fga-data_04.png)

### Namespace our custom claim

The [OpenID Connect specification](https://openid.net/specs/openid-connect-core-1_0.html#AdditionalClaims) recommends adding a namespace to [custom claim](https://auth0.com/docs/secure/tokens/json-web-tokens/create-custom-claims#namespaced-guidelines) names. The first few lines of code in our `onExecutePostLogin` function do just that. They check for a secret called `namespace` and ensure that it ends with a trailing slash.

We can add the namespace to the secrets by clicking on the Key icon in the left-side menu of the Action editor and clicking on the “Add Secret” button. Namespaces are usually a URI, so we will add `https://example.com` as a `NAMESPACE` secret. Feel free to change this to a more appropriate namespace.

### Install and configure the OpenFGA SDK

The Actions editor also conveniently allows us to install packages from NPM. We can add the OpenFGA SDK by clicking on the box icon on the left side and clicking on the “Add dependency” button. The package name will be `@openfga/sdk`, and the version can remain “latest”. This will install the [`@openfga/sdk`](https://www.npmjs.com/package/@openfga/sdk) package so we can import and use it in the Action codebase.

Add the following line to the top of the Action’s codebase:

```js
const { OpenFgaClient, CredentialsMethod } = require('@openfga/sdk');
```

Now that we’ve imported the OpenFGA client, let’s create a new instance and configure the credentials. 

```js
const fgaClient = new OpenFgaClient({
 apiUrl: event.secrets.FGA_API_URL,
 storeId: event.secrets.FGA_STORE_ID,
 authorizationModelId: event.secrets.FGA_MODEL_ID, // Optional, by default it will use the latest model
 credentials: {
 method: CredentialsMethod.ClientCredentials,
 config: {
 apiTokenIssuer: event.secrets.FGA_API_TOKEN_ISSUER,
 apiAudience: event.secrets.FGA_API_AUDIENCE,
 clientId: event.secrets.FGA_CLIENT_ID,
 clientSecret: event.secrets.FGA_CLIENT_SECRET,
 }
 }
});
```

It is a good idea to create a new authorized client through the [Auth0 FGA dashboard’s](https://dashboard.fga.dev/) settings page for us to use in the Actions editor. Once you’ve created this new client, you can add its Client ID and secret to the Actions editor’s secrets, together with all other necessary configuration parameters. 

Here’s a quick overview of what they should look like. Be sure to change the `eu1` region in the API URL and Audience to `us1` or `au1` depending on which jurisdiction you choose when creating your store.

```
FGA_API_URL=https://api.eu1.fga.dev
FGA_API_AUDIENCE=https://api.eu1.fga.dev/
FGA_API_TOKEN_ISSUER=auth.fga.dev
FGA_CLIENT_ID=0U...4q
FGA_CLIENT_SECRET=pB...kf
FGA_STORE_ID=01...1M
FGA_MODEL_ID=01...9C
```

### List all assigned organizations from Auth0 FGA

Auth0 FGA exposes a `list-objects` endpoint that can return a set of objects of a particular type assigned to a user, such as all organizations for which a user is a member. This will also consider all indirect relationships, such as when a user is a member because they are an admin for a specific organization.

To use this endpoint, the OpenFGA client we just created exposes a `listObjects` method where we can pass a user, relation, and object type. Notice that we pass along the `user_id` from `event.user`. This is the actual ID of the user who is currently trying to log in.

Add the following snippet below the OpenFGA client initialization code in our Action.

```js
const {objects} = await fgaClient.listObjects({
 user: `user:${event.user.user_id}`,
 relation: "member",
 type: "organization",
})
```

### Add the Assigned Organizations to the Access Token

The last thing left to do is to add the returned organization to our access token. We can re-purpose the last existing line from the template by adding the email to add our organizations instead. With some minimal changes, that code will look something like this.

```js
api.accessToken.setCustomClaim(
 namespace + 'organizations', 
 objects.map(organization => organization?.replace('organization:', ''))
);
```

The `list-objects` endpoint returns the object type together with the actual objects, so in our case, we can strip `organization:` from each returned organization. This will keep the organization names, which we can add to the custom claim.

### Putting it All Together

If we add some error handling, we’ll end up with an action that should look like this. 

```js
const { OpenFgaClient, CredentialsMethod } = require("@openfga/sdk");

exports.onExecutePostLogin = async (event, api) => {
 let namespace = event.secrets.NAMESPACE || "";
 if (namespace && !namespace.endsWith("/")) {
 namespace += "/";
 }

 try {
 const fgaClient = new OpenFgaClient({
 apiUrl: event.secrets.FGA_API_URL,
 storeId: event.secrets.FGA_STORE_ID,
 authorizationModelId: event.secrets.FGA_MODEL_ID,
 credentials: {
 method: CredentialsMethod.ClientCredentials,
 config: {
 apiTokenIssuer: event.secrets.FGA_API_TOKEN_ISSUER,
 apiAudience: event.secrets.FGA_API_AUDIENCE,
 clientId: event.secrets.FGA_CLIENT_ID,
 clientSecret: event.secrets.FGA_CLIENT_SECRET,
 },
 },
 });

 const { objects } = await fgaClient.listObjects({
 user: `user:${event.user.user_id}`,
 relation: "member",
 type: "organization",
 });

 api.accessToken.setCustomClaim(
 namespace + "organizations",
 objects.map((organization) => organization?.replace("organization:", ""))
 );
 } catch (error) {
 api.access.deny("Could not list organizations");
 }
};
```

The issued access token will now have a custom `https://example.com/organizations` claim, and when decoded, it can look something like the following:

```js
{
 "iss": "https://<your-tenant>.eu.auth0.com/",
 "sub": "auth0|62...7f",
 "aud": [
 "https://example.com",
 "https://<your-tenant>.auth0.com/userinfo"
 ],
 "iat": 1740579493,
 "exp": 1740665893,
 "scope": "openid profile email address phone",
 "jti": "rDk6D9GigyYTfi2WN492AB",
 "client_id": "T1...aW",
 "https://example.com/organizations": [
 "devrel",
 "openfga"
 ],
}
```

## Wrapping Up

In this article, we’ve gone through the steps to create a new Auth0 Action. This action will run every time a user logs into our application and adds all organizations that the user is a member of to the Access Token. We can use this information in our backend systems by decoding the Access Token, which will be a JSON Web Token, and looking for our custom claim `https://example.com/organizations`.

The action does the following steps to accomplish this:

* Import the [OpenFGA Node.js SDK](https://github.com/openfga/js-sdk).
* Make sure we have a namespace configured and that it ends with a slash.
* Create a new instance of the imported OpenFGA client.
* Use this client to list all organizations assigned to the user by using the exposed `listObjects()` method.
* Return the list of organizations as a custom claim prepended by our namespace in our Access Tokens.

Enrich Auth0 Access Tokens with Auth0 FGA Data

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Browse AI Democratizes Access to Information on the Internet with Auth0

“I was captivated by the internet's inclusive nature, allowing a child with no knowledge of English in a small city in the Middle East to create and share something with the world,” [Ardy Naghshineh](https://ca.linkedin.com/in/ardalann), Founder and CEO of [Browse AI](https://www.browse.ai/), shared about his childhood. In January 2020, driven by his vision for a more inclusive online experience, Browse AI was brought to life with a mission to democratize access to information on the internet. He noticed that large enterprises were able to acquire and invest in business-critical data, leaving smaller organizations and individuals who couldn’t afford it behind. Since then, Browse AI has leveled the playing field for over 250,000 users by empowering them to make data-driven decisions and stay competitive in their industries.

## Making the Internet More Inclusive

[Browse AI](https://www.browse.ai/) is a no-code web data extraction platform that allows non-technical users to train custom AI robots to turn any website into a spreadsheet or data pipeline in minutes. Their method provides a simple and cost-effective way to utilize valuable live data.

<include src="QuoteCard" body="Our first-of-its-kind platform reduces the time and expense required for data acquisition, allowing organizations to focus on analyzing and leveraging data to drive innovation and success." name="Ardy Naghshineh" title="Founder and CEO" team="" company="Browse AI" />

Popular [use cases](https://www.browse.ai/use-cases) include turning websites into APIs, price monitoring, product data extraction, and lead generation, but Browse AI is a very flexible product. They haven’t focused on a specific niche or vertical, which has made their product applicable to many. One of the more unique use cases came from a 9-year-old user who used the product for a school project. He extracted NFL game results and forecasts from different sites and, with the help of Browse AI and a few other applications, published a website that showcased everything in one place. Did we mention this was done on their [free plan](https://www.browse.ai/pricing)? Besides this use case being extremely clever, it speaks to not only the simplicity of getting started but also the power this product puts in the hands of all of its users — from the classroom to the offices of Fortune 500 companies. 

Browse AI’s vision is clear, and they consider their current product to be just one piece of the puzzle. While they know they’re helping users in meaningful ways, they also believe they have room for more advancement. “We’re in this for the long game, and we have really ambitious goals. We’re just getting started.” 

## Auth0: A Trusted Solution

Ardy shared that he spent his career developing multi-million dollar web applications for Fortune 500 companies. Even before he started Browse AI, he was familiar with the extensive engineering time spent on [building user authentication](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management/). After prototyping and reading through our [documentation](https://auth0.com/docs), they decided Auth0 was the best solution for their team. 

<include src="QuoteCard" body="We used Auth0 from day one to be able to spend our limited time on innovating and creating new user experiences rather than building another user authentication system." name="Ardy Naghshineh" title="Founder and CEO" team="" company="Browse AI" />

Auth0 became a valuable asset to Browse AI as their customer base grew rapidly. A lean but mighty team of four senior engineers oversaw over 200,000 new user signups over the course of six months. While this could have been a strenuous task, the team felt confident about their authentication system’s scalability and reliability. Auth0 has since helped the Browse AI team save about 4-5 months of engineering time. 

![Why Auth0?](https://images.ctfassets.net/23aumh6u8s0i/1k8YZcbJVayxcAgxmg2VRN/aea478bad289538aea19982c629d3a2c/Browse_AI_Checklist.png)

## Join Browse AI and the other 1700+ startups that benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Ardy and the entire Browse AI team. If you want to create your own NFL game results website or just want to take advantage of any of the other many use cases, get started with Browse AI [here](https://www.browse.ai/). If you want to follow their journey, check out their blog [here](https://www.browse.ai/blog).

Startup Stories: Browse AI

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Use Auth0’s Management API and account metadata to collect user information a little bit at a time instead of all at once.

Add Progressive Profiling to Auth0 Authentication in Android Apps Built with Jetpack Compose

Learn how to use user and app metadata in Auth0 user profiles to store additional information about your users.

Working with Auth0 User and App Metadata in iOS Apps

Working with Auth0 User and App Metadata in Android Apps

Learn about the three kinds of information stored with each Auth0 user account and how to access them in your Android apps.

Working with Auth0 User Profile Information and Metadata in Android Apps

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

U.S. Navy veteran and former security leader from Nike joins Auth0 C-Suite

**BELLEVUE, Wash. – March 1, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Jameeka Green Aaron](https://www.linkedin.com/in/jameeka/) has joined the company as Chief Information Security Officer (CISO). Aaron brings more than 20 years of industry experience and will be responsible for the holistic security and compliance of Auth0’s platform, products, and corporate environment. 

Aaron is a recognized industry thought leader and has dedicated two decades to managing and improving information security systems at each of her previous positions, including Nike, Hurley, Lockheed Martin, and the U.S. Navy. She is also committed to advancing women and people of color in Science, Technology, Engineering, and Mathematics (STEM) fields, and she participated in the U.S. State Department’s TechWomen program and the National Urban League of Young Professionals. She currently sits on the board of the California Women Veterans Leadership Council, is an advisor for U.C. Riverside Design Thinking Program, and is a member of Alpha Kappa Alpha Sorority, Inc.

“Jameeka is an incredible addition to our executive team, not only for her deep experience and leadership but for her leadership outside of the security industry as well,” said Eugenio Pace, CEO, and co-founder of Auth0. “As a company with a mission of inclusivity and access to technology, we were taken by Jameeka’s stewardship to her causes and looked forward to driving lasting positive change together. Her unmatched security expertise and dedication is an inspiration and invaluable asset to Auth0.”

The web of complexity involved in managing a competitive digital business broadens each day. Auth0 continues to innovate and evolve its identity management platform to make security, privacy, and compliance easier for global enterprises. The company is solving complex and large-scale identity use cases for global companies, and Aaron will help Auth0 and its customers ensure that they meet the highest levels of security and compliance. 

“In addition to the amazing roster of customers that puts their trust in Auth0 and fuels its growth, I was very much struck by the humanity of everyone I met with—a level of empathy that has been a rarity throughout my career,” said Aaron. “Being a CISO is a very unique job and is one that largely centers around accountability. I am approaching this position at Auth0 with a mission to ensure the optimal security of our platform, as well as be a strong collaborator and partner to both customers and employees alike.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Names Jameeka Green Aaron as Chief Information Security Officer

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

Our security best practices checklist will help you, and the kids you know, stay safe online.



Today, it’s hard to think about a part of our lives that’s not connected to the internet in one way or another. Work, relationships, entertainment, growth, finances, health, home appliances, cars. They all can have an **online component**.

But the online world is a hard thing to perceive. We can’t quite touch it. We can only experience it through a screen, headphones, or a microphone. So the associated risks and consequences sometimes may not seem as real and bad as a hurricane, an armed theft, or as cutting a finger while cooking. But *are they*? 

Yes, they are!

But it also depends on you, and your “threat model”, which is just a fancy (and possibly intimidating) word to sum up the answers to these six questions:

* What are my assets? 
* Who are my adversaries?
* What can my adversary do?
* How likely is it that I will have to protect my assets?
* How bad are the consequences if I fail?
* What can I do to defend myself against my adversaries?

The questions also sound a bit intimidating, but it’s just about listing what you value, who can hurt you, how, what are the odds of being affected, what the consequences could be and what are your defenses. It works for online and offline risk.

Since so much of our lives are online today, we all have **valuable assets on the web**. Our online identity, our private identifiable information (name, birthdate, home address, phone number, email accounts), our social media, credit card numbers, pictures, work data. We all have information to protect, and we all have a responsibility to protect it too, [_including children_](https://auth0.com/blog/auth0-cybersafe-camp/).

![Auth0 family security](https://images.ctfassets.net/23aumh6u8s0i/4VW4wTpm0aesOHQS6GZJiu/071af53dace08a20a87351ce43a5554d/auth0-personal-security)

And since there have been so many [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) up until now, we all have adversaries. All the data that has been breached is up for sale for a cheap price on the dark web, and it could be used against us in different ways. Depending on who we are and what we do, we may be an interesting target as well. 

In general, the consequences of an attack can be tremendously hurtful. Identity theft, ransom, data or financial loss, cyberstalking, and even physical damage. 

Now, we can all get ready and protect ourselves, and that is what **October National Cybersecurity Awareness Month** is about. A yearly effort aimed at helping you stay safe online. 

At Auth0 we care very deeply about cybersecurity, and we want to help make the internet safer. Not only by [_increasing the security of your business_](https://auth0.com/blog/how-auth0-makes-your-apps-more-secure/) through our platform, by helping you enable password policies, anomaly detection, and MFA quickly, and by protecting the credentials of your users which helps prevent data breaches. But also by spreading awareness about cybersecurity, and partnering up with the [_US government_](https://www.dhs.gov/national-cyber-security-awareness-month), the [_EU_](https://cybersecuritymonth.eu/), and [_Australia_](https://www.staysmartonline.gov.au/get-involved/stay-smart-online-week) during October National Cybersecurity Awareness Month.

So we have prepared an **easy checklist** to help you, and the kids you know, stay safe online. Download the [Personal Cybersecurity Checklist](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist)!

We believe in making cybersecurity accessible for everyone, so we’ve translated it to **9 languages** with the help of Auziros from all over the world. 

Follow us on [_Twitter_](https://twitter.com/auth0), where we’ll be sharing 31 days of tips and best practices, and also come talk to us in [_our online meetup_](https://www.meetup.com/Auth0-Online-Meetup/), [_Seattle_](https://www.meetup.com/Seattle-Identity-and-Security-Meetup/), [_London_](https://www.meetup.com/London-Identity-and-Security-Meetup/), and [_Hamburg_](https://cybersecmonth-hamburg.de/). 

Cybersecurity is everyone’s responsibility. We all have to Own It. Secure It. Protect it, so we can stay safe online.


Personal Information Security Checklist for Family and Friends

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Email addresses, passport numbers, and credit card information included in stolen data.

_Update: Marriott now says the breach wasn’t as bad as originally reported, lowering the victim number to [383 million](https://www.bankinfosecurity.com/marriot-mega-breach-victim-count-drops-to-383-million-a-11916)._

What can you do if you’re one of the 500 million [Marriott International Inc.](https://www.bloomberg.com/quote/MAR:US) guests affected by the massive data breach announced today? According to the company’s [announcement](https://answers.kroll.com/), the breach affects guests who stayed at the Marriott’s Starwood properties from 2014 through Sept. 10, 2018. For approximately 327 million of impacted guests, Marriott says the breached information includes some combination of:

- Mailing address
- Phone number
- Email address
- Starwood Preferred Guest (“SPG”) account information
- Birthdate
- Gender
- Arrival and departure information
- Reservation date
- Communication preferences.

Credit and debit card numbers were also included in the breach. While Marriott notes this information was encrypted according to the AES-128 standard, they do not yet know if the components required to decrypt these numbers have been compromised.

![Marriot's Starwood Property](https://images.ctfassets.net/23aumh6u8s0i/7LRWHLzMk1XQxnM9cWpnKJ/9f47c148a148fa5af76cfe857598b83c/marriot-starwood-data-breach)

[Source: [Wikimedia](https://commons.wikimedia.org/wiki/File:Guam_Marriott_Resort_%26_Spa.JPG)]

## 5 Steps to Protect your Data After This Breach

If you’ve made a reservation at a Starwood property in the last four years (this includes Sheraton, Westin, Four Points, [many other brands](https://answers.kroll.com/), and Starwood-branded timeshares), take these steps to minimize your exposure:

1. **Change your password.** This should be your default response to the news of any hack that might involve your information. If you use the same password in multiple places, be sure to change your password everywhere.

2. **Implement Multi-factor Authentication (MFA).** A breached password is only useful if malicious actors can use it. A second step of authentication, like a code sent via SMS to your phone, can render that breached password useless (but you should still change your password).

3. **Monitor your accounts.** Marriott’s system was compromised for an extended period of time. Check your accounts weekly.

4. **Consider freezing your credit.** You can put a credit hold on your accounts, but in most U.S. states, the hold remains permanent until you request a thaw. This [guide from NerdWallet](https://www.nerdwallet.com/blog/finance/pros-and-cons-freezing-credit/) provides more details.

5. **Watch out for phishing attempts.** “Phishing attempts can be more credible when someone has access to actual personal details,” says Auth0 Principal Security Engineer Emory Lundberg. This hack includes data that could make social engineering attempts easier. For more advice on avoiding phishing attempts, check out this [post](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/) by Annybell Villarroel, Auth0 Security Operations Manager.

![Steps After A Data Breach](https://images.ctfassets.net/23aumh6u8s0i/6k5RKe4zh50H8BrRaPqQC2/ad318219be99cf9089a470a643ef7d5e/security-after-data-breach)

[Source: [PixaBay](https://pixabay.com/en/photos/cyber%20security/?)]

## Marriot's Data Breach Response Plan

In addition, Marriott has taken the following steps to help guests monitor and protect their information:

**Dedicated Call Center**

Marriott has established a dedicated call center to answer questions you may have about this incident. The call center is open seven days a week and is available in multiple languages. Our dedicated call center may experience high call volume initially, and we appreciate your patience.

**Email Notification**

Marriott began sending emails on a rolling basis on November 30, 2018 to affected guests whose email addresses are in the Starwood guest reservation database.

**Free WebWatcher Enrollment**

Marriott is providing guests the opportunity to enroll in WebWatcher free of charge for one year. WebWatcher monitors internet sites where personal information is shared and generates an alert to the consumer if evidence of the consumer’s personal information is found. Due to regulatory and other reasons, WebWatcher or similar products are not available in all countries. Guests from the United States who complete the WebWatcher enrollment process will also be provided fraud consultation services and reimbursement coverage for free. Click on your country, if listed, to begin the enrollment process.

<include src="asides/AboutAuth0" />

---

Marriott's Starwood Data Breach - 5 Steps to Protect your Data

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Implement MFA, store minimal information, and take employee cybersecurity training seriously to minimize data breach risk.

The holiday season is the biggest shopping time of the year, and for that reason, it's also the most popular time of year for cybercriminals. 

If you’re a [retailer](https://auth0.com/retail), it's on you to ensure that your customers' data is safe. [Data breaches](https://auth0.com/blog/what-is-a-data-breach/) hurt your customers and they hurt your reputation. 

With this post, we show retail teams how Auth0 can help them keep customers safe with three actionable tactics. 

While these strategies are critical during the holidays, they're also highly applicable throughout the year. Teams that take security seriously are those that will safely scale and thrive in 2019 and beyond.

## 1. Implement Multi-Factor Authentication

With data breaches of retailers on the upswing in 2018 — including ones at [Macy's](http://fortune.com/2018/07/11/macys-data-breach/) and [Adidas](https://www.newsweek.com/adidas-breach-hack-us-website-customers-warned-their-data-has-been-hacked-1000974) — teams clearly need extra support. [Multi-factor authentication (MFA)](https://auth0.com/docs/multifactor-authentication) delivers this. Implementing it correctly can make a huge difference in how secure your customers’ accounts are. 

MFA ensures that even if a data breach does occur and passwords are leaked, hackers still can't get into customer accounts. To do so, they need a second piece of sensitive information, like a customer's thumbprint, facial features, or mobile device.

With [Auth0 Guardian](https://auth0.com/multifactor-authentication), you can add MFA to your site simply and securely.

![Multifactor Authentication (MFA) with Auth0 Guardian](https://images.ctfassets.net/23aumh6u8s0i/4x4BhKDZLXWTlScCGVZ5B6/a53550e45f8a7d895b8ac2ae251c5a6d/multifactor-authentication-with-auth0-guardian.png))

After [installation](https://auth0.com/docs/multifactor-authentication/factors/push), retailers can easily switch on MFA push notifications. For your employees, it is a quick double-check that they are who they say they are (and that they can access sensitive customer data for work purposes). For your customers with the Guardian app, they receive a QR code on their device that they can scan before accessing their account. It's one more protective barrier to be sure they're not a hacker with the customer's credentials. 

With more than 80% of passwords having [inherent vulnerabilities](https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/), MFA is a critical investment to seal your customer data from unwanted eyes during times of high activity.

## 2. Only store the data and information you need

Storing only essential customer data means that if someone does get into your system, there’s less to exploit. This is a key component of complying with the EU's [General Data Protection Regulation (GDPR)](https://auth0.com/gdpr). Some teams think that adhering to GDPR's strict standards is primarily to avoid hefty fines (the greater of €20 million or 4% of the global annual revenue); however, the standards are a must for protecting end users’ data and the integrity of your company.

If a cybercriminal does gain access to a company's confidential customer information, they can make off with:

* names
* email addresses
* mailing addresses
* phone numbers
* customer device information
* financial data
* personal details like age, race, and religion

[When hackers got into Under Armour's system](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) this year, they were able to access many customers' hashed passwords. Since studies show that people tend to [recycle their passwords](https://securityboulevard.com/2018/05/59-of-people-use-the-same-password-everywhere-poll-finds/), hackers have the ability to take these and access even more personal data in other accounts. The damage can quickly spiral out of control.

Storing less data can make you less of a target. You can also separate data, depending on how confidential it is. With [Auth0's user management solutions](https://auth0.com/user-management), you can restrict access to specific data sets for only the most privileged employees.

## 3. Train employees in the importance of cybersecurity

Training employees in the importance of data security is an often overlooked—but essential—pillar of protecting your customers’ data. Taking the time to bring them up to speed on the latest cybersecurity concerns early in their [onboarding process](https://www.intercom.com/blog/onboarding-focus-culture/) can help ensure that when the holidays roll around, they're on high alert.

When employees are aware of common hacks such as malware infiltration and phishing, they'll be able to recognize threats as they arise. And when they understand the reasons behind provisions such as automatic updates and multi-factor authentication, it’s easier to get their buy-in. 

Our blog has many pieces you can use to help communicate security issues to your employees. Here are a few to get you started:

* [Four Cybersecurity Attacks Your Employees Need to Know](https://auth0.com/blog/four-cybersecurity-attacks-you-need-to-know/)
* [What is a Data Breach?](https://auth0.com/blog/what-is-a-data-breach/)
* [What is Data Security?](https://auth0.com/blog/what-is-data-security/)

You also might want to bring in experts for cybersecurity training sessions. While Auth0 doesn't offer these specifically, here are a few we recommend:

* *InfoSec Institute's [Security Awareness & Anti-Phishing Training](https://www.infosecinstitute.com/securityiq/).* The program includes more than 1,000 phishing simulations, along with tailored learner assessments, to bring employees up to speed.
* *[The SANS Institute](https://www.sans.org/about/)*. This non-profit was established in 1989 and now collaborates with 165,000 security professionals worldwide. Offers many private trainings to upskill existing IT team members.
* *Inspired eLearning. *These efficient modules even include [security awareness training programs for executives](https://inspiredelearning.com/security-awareness/awareness-c-suite/). 

Sometimes education isn't enough. If you do suffer a system breach, Auth0 can quickly step in to protect your customers with tools like [anomaly detection](https://auth0.com/docs/anomaly-detection) and [breached password detection](https://auth0.com/docs/anomaly-detection/breached-passwords). In the first instance, in the Auth0 dashboard, an admin will receive a notification of a strange behavior like multiple failed login attempts and can quickly block the user while researching the issue further. 

In the second case, Auth0's security team will work to keep a retailer informed if any of its customers' passwords match with those in our database of leaked passwords (which we update daily). If we see a match, we can work with a retailer's IT team to block the potential impersonator from getting further into the system.

### Take advantage of what the season has to offer.

Holidays are the most important time of the year for retailers. It's when most retail teams make the majority of their sales, and missing out due to a security breach can set you back several quarters or years from hitting your targets. It’s more important than ever to keep your customer data safe so they continue to trust and work with you.

It’s never too late – or too early – to start thinking about the best ways to do so. Auth0 would love to help. [Reach out](https://auth0.com/) at any time, and we'll be glad to set you up.

<include src="asides/AboutAuth0" />

3 Ways Auth0 Can Help Retailers Protect Customer Data During the Holidays

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Information and tools to help you mitigate risk against cyber attacks and data breaches. Learn more about Malware Infiltration, Phishing, USB Traps, and Mobile Attacks.

In 2017, nearly [_179 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. It's clear that cyber criminals are growing more creative with how they gain access to networks and valuable data.

Many of today’s most common cyberattacks have been socially engineered to rely on human error. Even your best employees can become your greatest weakness if they open a suspicious email, click on a malicious link, or pick up and use an anonymous USB device.

There are ways to protect your organization against sensitive data breaches. Here are four of the most common cyberattack examples and the ways you can avoid them.

## **1. Malware Infiltration**

**What makes you vulnerable: outdated software and lack of backup protocols**

Malware is a term that encompasses many different types of malicious software, including ransomware and spyware. Each type of malware can wreak havoc once it gains access to a system.

WannaCry, for example, a form of ransomware, recently [took advantage of a weak spot in Microsoft’s operating system](https://www.symantec.com/security-center/writeup/2017-051310-3522-99). Banks, health care providers, manufacturers, and other businesses across the globe reported WannaCry's encryption.

![WannaCry encryption](https://images.ctfassets.net/23aumh6u8s0i/1vTw3WKZIs3Fs1RZGhNNeI/18d3869c4068bf29ce62e9ce8eb6e9db/WannaCry-encryption)
 
[[Source](https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/)]

In order to regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [_bitcoin_](https://bitcoin.org/en/). [_Sixteen National Health Service’s offices_](https://developers.redhat.com/blog/2017/05/19/wannacry-ransomware-who-it-affected-and-why-it-matters/) and over 200,000 PCs worldwide reported this.

_Solution: Regularly updating your systems will go a long way toward removing dangerous holes. It's a simple fix that many teams, including [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/), have neglected._

_If you want added security, consider [moving to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/). Not only will this allow your enterprise more flexibility to scale, but you can also delegate specialized security tasks like IAM and encryption to expert providers._

## **2. Phishing **

**What makes you vulnerable: lack of education and attention to detail in suspicious e-mails**

In 2016, [91% of cyberattacks](https://phishme.com/2016-enterprise-phishing-susceptibility-report/) were the result of a spear-phishing email. Phishing e-mails steal data either by tricking recipients into giving it to the cyber criminals or by getting users to download a file that installs spyware—software designed to steal information directly from a user’s device.

Children’s Mercy Hospital [_recently reported a breach_](https://healthitsecurity.com/news/childrens-mercy-hospital-phishing-attack-impacts-phi-of-60k) that exposed the health care information of at least 60,000 people. E-mails tricked users into disclosing their work e-mail credentials, which led to the exposure of patient health data when the hackers gained access to the inboxes of the targeted hospital workers. Children’s Mercy [_is now being sued_](https://www.hipaajournal.com/childrens-mercy-hospital-sued-for-63000-record-data-breach/) for this major breach.

Here’s an example of an imitation Dropbox e-mail asking for confirmation of a user’s e-mail:

![Imitation Dropbox email phishing scam asking for confirmation of a user’s e-mail](https://images.ctfassets.net/23aumh6u8s0i/7jVF95LDb067AOrODuA8SI/2fb640b69a3567e208636c1abad55fc1/dropbox-email-asking-confirmation-of-user-email)

[_Source_](https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250)

When users click the “Verify your email” link, spyware software is automatically downloaded onto the users' computers.

_Solution: As these e-mails start to look more realistic, it’s important to educate employees on how to spot a questionable e-mail chain._

_Creative training programs include the following:_

- _Digital Defense's [SecurED training program](https://www.digitaldefense.com/professional-services/secured-training/) that works with award-winning Hollywood comedy writers_
- _Terranova's [customizable newsletters](https://terranovacorporation.com/solution/communication-material/)_
- _Inspired eLearning's [Security Awareness for the C-Suite](https://inspiredelearning.com/security-awareness/awareness-c-suite/)_
- _Wombat Security's [everyday tips](https://www.wombatsecurity.com/security-education/free-security-awareness-resources)_

_[See here for a larger list.](https://www.csoonline.com/article/3225471/security/please-dont-send-me-to-cybersecurity-training.html)_

## **3. USB Traps**

**What makes you vulnerable: lack of education and policy on outside device use **

Hackers who want a direct route to company data often use a hardware device, such as a USB drive. A [_recent Google study_](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/45597.pdf) revealed that at least 45% of people who find a USB drive will plug it into their computers. Planted USB drives may contain malware or a link that requests information, similar to a phishing e-mail.

The worst-case scenario is a drive that contains a HID spoof. This is where the USB drive tricks the computer into believing the drive is actually a keyboard and then issues a set of keystrokes that forces the computer to dump data back to the hacker. It can also allow them access to whatever network the computer is connected to.

![HID spoof process](https://images.ctfassets.net/23aumh6u8s0i/6tgD3dKhZRBiDXExHQw0H3/b36a8b23e6518b6d0c93f44e0e0f69f3/hid-spoof-process)

_Solution: Outlawing anonymous, external drives on company devices will send a clear message to your organization. Whether a drive was planted or simply purchased from an illegitimate source, removing the temptation to plug something in without properly vetting is a low-hanging fruit that can have enormous power to secure your team and your end users._

## **4. Mobile Attacks**

**What makes you vulnerable: employees accessing company data and networks via cell phones**

Hackers are well aware of the explosion of smartphone and tablet use and have created attacks specifically designed for mobile software. [_The Pegasus attack_](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message.


 <img style="width: 300px;" src="https://images.ctfassets.net/23aumh6u8s0i/1ii40f6m9VQ1rBmWpgY1pF/de53a4b3444b16e607d52ee34bb9933e/pegasus-mobile-attack-on-ios" alt="Example of Pegasus attack on Apple iOS mobile software."/>


[_Source_](https://www.hax4us.com/2017/03/hindi-english-smishing-brother-of.html)

Phishing text messages are composed to look legitimate, just as phishing e-mails are. With Pegasus, clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. The software also copied all of their calendar, contact, and e-mail data.

Pegasus was an especially frightening cyberattack because it took advantage of [_“zero day” vulnerabilities_](https://www.huffingtonpost.co.uk/entry/what-is-the-pegasus-iphone-spyware-and-why-was-it-so-dangerous_uk_57c0043fe4b0ba22a4d3f930?guccounter=1), meaning there wasn’t any prior knowledge of the vulnerabilities in Apple’s iOS until Pegasus struck. Once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

_Solution: If a mobile phone or tablet has been breached, you need a Plan B. Make sure employees quickly change their passwords by using a professional password manager, such as [LastPass](https://www.lastpass.com/) or [Valt](https://valt.io/). Many employees secure critical information with easy-to-guess iterations of a single password. Encouraging length and complexity in all passwords going forward will make it difficult for hackers to access multiple areas at once._

## Additional Security for All Systems at the Login Stage

Good password policy and sound employee education are key; however, taking the next step with [secure login procedures](https://auth0.com/b2c-customer-identity-management) will add a new dimension of safety to your system. Specialized identity solutions providers can offer support with [multifactor authentication](https://auth0.com/docs/multifactor-authentication).

Tracking your users from the start will help eliminate fraud at its origin, helping provide a secure foundation to allow your team to scale.

<include src="asides/AboutAuth0" />

Four Cybersecurity Attacks Your Employees Need to Know

Data security is top priority for Auth0. Introducing our latest information security certification: ISO 27001.

**BELLEVUE, Wash. -- July 31, 2018 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has achieved ISO 27001:2013 and ISO 27018:2014 certification, signifying Auth0’s ongoing commitment to providing its customers with the highest standards for information security. These certifications provide a more comprehensive way for Auth0’s customers to address their own privacy and security requirements.

ISO 27001 is a globally recognized standard and code of practice to ensure proper implementation of an Information Security Management System (ISMS). The standard specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving a documented ISMS within the context of the organization’s overall business risks. It sets forth a risk-based approach that focuses on adequate and proportionate security controls that protect information assets and give confidence to interested parties. Auth0's certification is an independent testament of compliance to these rigorous standards by a certified third party.

"The time and investment it takes to gain these important certifications is completely worthwhile since they give us the ability to service our customers even better," said Joan Pepin, CISO and VP of Operations at Auth0. "The addition of ISO 27001 and 27018 gives customers assurance that Auth0 is complying to an internationally-accepted information security framework." 

The certification was performed by Schellman & Company, LLC, an ANAB and UKAS accredited Certification Body based in the United States. Details of ISMS certification are publicly available at [https://www.schellman.com/certificate-directory](https://www.schellman.com/certificate-directory).

For more information about Auth0’s approach to security, please visit: [https://auth0.com/security](https://auth0.com/security). 

## About Schellmann

Schellman & Company, LLC is a leading national provider of attestation and compliance services - and the only company in the world that is a CPA firm, an ANAB and UKAS accredited ISO Certification Body, a globally licensed be PCI Qualified Security Assessor Company, a HITRUST assessor, and a FedRAMP 3PAO. Schellman’s approach builds successful, long-term relationships and allows our clients to achieve multiple compliance objectives using a single third party assessor. For more information visit [www.schellman.com](https://www.schellman.com/).

<include src="asides/AboutAuth0" />

### **Media Contact:**

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898

---

Auth0 Achieves ISO 27001:2013 Certification

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Access to information is valuable but it is also dangerous. Auth0 CISO Joan Pepin explains why information warfare is a big deal

## How Critical Thinking Skills Can Protect You From Malicious Actors

From the outside, my job as Chief Information Security Officer for Auth0 might look like it’s about devices, apps, protocols and procedures, but those are just my tools. Access to information is valuable but it is also dangerous. My job is really is about balancing the opportunities and risks that information presents.So information warfare is a big deal for me.

The thing is, information warfare didn’t start with the [Russians](https://www.washingtonpost.com/news/the-fix/wp/2018/02/16/3-things-we-just-learned-from-the-indictment-of-13-russians-in-the-mueller-investigation/).

**An Ancient Strategy for Modern Encryption**

“All warfare is based on deception.”
— Sun Tzu, The Art of War (550 BC)

Back in 550 BC, Sun Tzu recommended sharing false information as a means of attack.
Granted, back then, a single human was limited to face-to-face and hand-transported written communication. In the time it would have taken one of Sun Tzu’s spies to share a sentence, false information can now reach thousands via the internet, each of them geometrically expanding the reach of a single message.

Even thousands of years ago, during the time of Alexander the Great, an ancient general on the hill would see the battle and would get one of his chariot commanders to flank to the east and summon a trusted messenger.

He’d use his secret encoder ring to craft a message on a piece of papyrus, then he’d roll it up and seal it with wax, hand it to that trusted messenger, and send him down the hill.
The chariot commander would recognize the messenger and know that he was a trusted source information.

He’d also recognize the seal authenticating the message.

And since he’d be the first to crack the seal, he’d validate that it had not been intercepted.
Using his own secret encoder ring, the chariot commander would decode the message. For safekeeping, he would also kill the messenger and burn the papyrus.

That ancient strategy also describes modern encryption and privacy on the internet. Those fundamentals have not changed.

We still need to know that the sender is in fact who the message claims it to because this implies that the content of the message could be genuine.

We still need to ensure that the message has not been intercepted or used inappropriately. And, finally, similar to the killing of the messenger and the burning of the papyrus, we need to know that at the end of its life cycle a message was destroyed in a way that rendered it unable to be reproduced.

This is the full life cycle of safe information.

If you’re going to base a business decision on information, you want to validate these same basic things and verify them. And when you delete the message, you want it to be gone forever.
Today, after the very end of tax season, I have a friend who goes through a shredding ritual. He goes through his filing cabinet and shreds everything he doesn’t need, since information is both an asset and a liability. Deleting was just as valid in Alexander’s time as it is today, but much the way the methods for making [Greek fire](https://www.ancient.eu/Greek_Fire/) have been lost to time, we are losing the ability to validate and verify information.

**Swaying Public Opinion through Volume**

By the time the Klondike Gold Rush came around, person-to-person verification still occurred, as did accurate message sharing through the newspapers, but the volume of communication available through mass printing offered a new opportunity to control the story.

While promoting Seattle during the Klondike Gold Rush, Erastus Brainerd used newspaper advertising and feature stories to [sway public opinion](https://www.nps.gov/parkhistory/online_books/klse/hrs/hrs2.htm) in a way that had never been done before. His stories appeared in the local papers, in advertisements across the U.S., and again in letters sent directly to various chambers of commerce offering Seattle as the pathway to riches — which proved extremely convincing in the wake of one of the United States’ greatest economic depressions, the Panic of 1893.

People sold everything they had and rushed to Seattle. But travelling across the country (or globe) took time and money and snail mail delivering personal stories was equally slow. By the time the story of Seattle was proven to be more propaganda than truth, many didn’t have the funds or the heart to head home to share their stories. Of the 100,000 who rushed to the Klondike, only 30,000 made it, and only 4,000 found gold.

Historians often say the 1893 depression made people more vulnerable to stories of riches. But newspapers had evolved into a trusted source of information. These stories were reportedly “true,” which encouraged people to shift their critical thinking responsibilities to the papers.

This public opinion campaign established Seattle as a primary city in the Northwest. Companies like Nordstorm and Filson got their start as a result of the Klondike Gold Rush, eventually seeding the start of companies like Microsoft and Amazon. Clearly, opinion campaigns can have lasting effects on the real world that end up impacting global history.

Today, the machinery of our society runs on information and spreads it far faster than Brainerd’s stories. There’s far more information made daily than Brainerd produced in his entire campaign. There’s more machinery to produce it, distribute it, and consume it. Now more than ever, we need that ancient skill of being able to quantify and qualify our information.

![Information warfare infographic](https://images.ctfassets.net/23aumh6u8s0i/4dgBv709nq0eiwi0R429nE/4b9f19a1aa428d57e6643815e052b694/information-warfare-infographic)

<include src="TweetQuote" quoteText="There’s more machinery to produce, distribute, and consume information. Now more than ever, we need skills that helps us quantify and qualify our information."/>

## Why People Should Think More like Spies

*“…there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns – the ones we don't know we don't know.”*

Back in 2002, the U.S. Secretary of State Don Rumsfeld caught a lot of flak about his unknown knowns statement. The reporter was after a direct answer about the lack of evidence linking the government of Iran to terrorist groups with weapons of mass destruction.

“Unknown knowns” and “known unknowns” came across as gibberish to both the right and the left. But for the spooks and spies tasked with analyzing and understanding information from a globe of sources, Rumsfeld’s Unknown Knowns statement actually described a taxonomy of information.
Let me break down with an example about a suspected danger — maybe a bomb or a shooter — in a building and whether or not that intel can be validated:

**There are known knowns**: We have intel that tells us something bad might occur in a specific building in a specific city.

**There are known unknowns**: While we know the city and the building, we don’t know when the bad thing might happen or what it is.

**Unknown knowns**: Because we’re not entirely certain we can trust the source of the information, we might know additional information without realizing it’s a salient detail. For example, April might be a critical month one source. May might be a critical month for another.

**There are unknown unknowns**: Because we lack complete information, there may be additional things — like the number of bombs or shooters — that we aren’t able to determine.

<include src="TweetQuote" quoteText="Like a station chief looking to decide which intel to trust, an era of information warfare should lead you to ask similar questions."/>

## Thinking Beyond the TV Box

When I was growing up, public opinion could be swayed by the fact that the majority of us were tuning into the same TV shows at the same time on the same channels.
Maybe because TV was a relatively young medium or because Americans had become significantly more jaded since the Klondike, my mother would warned me not to believe most anything I saw on TV.
But I liked all the voices on TV. I liked them so much that my mother put me on a TV budget. I was allowed a half an hour in the morning and another half an hour in the evening.
For my evening budget, I chose the evening news with Walter Cronkite.
Why? Because even though my mother had warned me against all the other voices, Walter Cronkite was a bit different. With his voice and later Tom Brokaw, there was an understanding that the media might have a certain bias, but it was also understood that one could easily compensate for that bias by using your own brain.
I understood that someone had crafted the story I was watching. Maybe Walter is a little more on the left than the right, but they weren’t lying.
Typically, it was easy to find another reasonable POV to use as a check. You could watch the slightly left-leaning evening news and pick up the slightly right-leaning newspaper and between those two you could easily determine the truth, as well as gain a deeper understanding of both sides. Now information has become so divergent that picking two sources and triangulating between them is not good enough.

## The Risk of Unqualified Trust

Current frustrations can make it sound like the media is in full control of all the stories. Back then, my mom drilled into my head that I had to figure out **what** someone was really saying and **why** someone might be saying it, the media actually held more power than it does today because people got the majority of their news from television, radio, and the newspapers. With the social media we’ve gained voices we might never have heard, but lost the vetting and some of our individual critical thinking skills — and allowed untrustworthy sources direct access.
Within this context, the trust that resided with journalists has been transferred to our network of friends and colleagues.
If my mom reads something on Facebook she accepts it as truth because it’s been shared by people she trusts, which is why rapid sharing without fact checking and validating sources can be so dangerous.

Everyone knows fake news is out there, but if everyone trusts the people in their feeds, who are trusting the people in their feeds and so on, it gives malicious actors an easy way to sneak in.
We need a web of trust to make this internet thing work, but that also means that each of us has the responsibility to make sure that the message we’re amplifying is an accurate one, because regardless of your political position, inaccurate info does no one any good.

## Vetting Info in the Era of Divergence

Although spooks and spies gather information, it’s the station chief who decides its value.
In the absence of a Cronkite or a Brokaw, that responsibility when reading a news story has shifted to you.
We are each our own information qualifier — and qualifying a news story today is harder than it was when I was a kid watching the evening news.
Instead of having to adjust for tone or delivery, thanks to information warfare, you could be staring at something from an untrustworthy or highly motivated source that was shared to gain a specific reaction — [like influencing presidential elections](http://www.businessinsider.com/cambridge-analytica-boasts-won-trump-election-facebook-data-2018-3).
Even if you try the old trick of triangulating with multiple voices, you might realize you’re in a social media echo chamber, where multiple people or companies you respect have reposted information from the same source. In this environment, it’s spectacularly easy for a single individual to reach out to multiple sources to control the narrative.
During the Cronkite era, information consumers regularly enjoyed vetted stories told with the help multiple validated sources. Consuming structured information made it easier to look for and recognize the most reliable patterns.
Since we’re consuming so much unstructured information, we have to work harder to ask the questions that help us know if the information before us is genuine and to validate and authenticate before sharing.
Because information is now so divergent, the burden is on you.

Information Warfare Offensive

authstrong

Guest Author

Víctor Moreno

In this article we will learn about the many ways that Microsoft Azure Storage enables us to store information.

## What is Azure Storage?

Azure Storage is the Microsoft solution for cloud storage. Their solution provides four different types of storage:

- [Table Storage](https://docs.microsoft.com/en-us/azure/cosmos-db/table-storage-how-to-use-dotnet)
- [Queue Storage](https://docs.microsoft.com/en-us/azure/storage/queues/storage-dotnet-how-to-use-queues)
- [Blob Storage](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-dotnet-how-to-use-blobs)
- [File Storage](https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction)

Before diving into the details about each type, let's talk about *account storages*. An account storage provides a unique namespace for Azure Storage objects. Based on what customers use, Microsoft bills them through their account storages. Every account storage contains a subdomain that is used to access the different storage types. For example, if we had an account storage id called `storagesample` we would get the following subdomain:

- storagesample.blob.core.windows.net
- storagesample.table.core.windows.net
- storagesample.file.core.windows.net
- storagesample.queue.core.windows.net

## What is Azure Table Storage?

Azure Table Storage is a service that stores NoSQL data in the cloud. This storage type enables developers to store schema-less data in a key/value fashion. The main characteristics of Azure Table Storage are:

- Tables are independent of each other.
- Features like foreign keys, joins, and custom indexes don't exist.
- Table schemas are flexible. That is, it's not mandatory to have all fields on all records.

Each table on Azure Table Storage is composed of five main components:

- Entities: We can see these as rows (typical records) on relational databases.
- Partition keys: Strings that contain no more than 1 KB of data. They cover one or more entities in a table, grouping them into blocks of entities that share an ID.
- Row keys: Strings that contain no more than 1 KB of data. They are used to identify rows inside tables uniquely.
- Timestamps: Properties that store when entities were inserted or updated.
- Partitions: Collections of entities in a table. Partitions are identified by their partition key to group them like several tables but inside one object.

![Table Storage structure on Microsoft Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/78pG0FN0kok96vlutuxCN9/69b12f7d1847194cc43dbeb3046a9a17/table-storage)

In the following sections, we will learn how to create tables on Azure Table Storage and how to add entities to them. To see other operations (like table removal or how to update entities), we can check [this Table Storage GitHub repository](https://github.com/vemoreno/TableStorageWithCsharp).

### Creating Tables on Azure Table Storage

In this section, we are going to learn how to create tables on Azure Table Storage. The following C# code snippet shows four easy steps to create a demo table:

```C#
public CloudTable CreateDemoTable()
{
	// 1 - Retrieve the storage account
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key); 

 // 2 - Create a CloudStorageAccount instance
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// 3 - Create the table client.
	CloudTableClient tableClient = storageAccount.CreateCloudTableClient();

	// 4 - Retrieve a reference to the table.
	CloudTable table = tableClient.GetTableReference("Demo");
 table.CreateIfNotExists();

 return table;
}
```

The first step creates an instance of `StorageCredentials`. To do this, we just need to pass our `Account` name and account `Key`. This information can be retrieved as shown in the following screen:

![Retrieving account name and account key from Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/7CX2MQqNms4rnkFYNGuVjf/229300a3d31d78f02d1babbd5fd468f2/6rIuv)

After that we create an instance of `CloudStorageAccount` passing the reference for the `StorageCredentials`. Then, in the third step, we call the `CreateCloudTableClient()` method of our `CloudStorageAccount` to create a new `CloudTableClient`.

Step four consists of using `CloudTableClient` to get a reference to a table called `Demo` and creating it on Azure Table Storage if it doesn't exist.

### Adding Entities to a Table on Azure Table Storage

Now that we know how to create tables on Azure Table Storage, let's learn how to use them to add new entities. In the following example, we use a class called `CustomerEntity`. [The implementation details of this class can be found here](https://github.com/vemoreno/TableStorageWithCsharp/blob/master/AzureTableStorage/AzureTableStorage/Models/MyTableEntity.cs).

```C#
public void AddEntity()
{
 // 1 - retrieve demo table reference from last sample
	CloudTable table = CreateDemoTable();

	// 2 - create an instance of CustomerEntity
	CustomerEntity customer = new CustomerEntity("Harp", "Walter");
	customer.Email = "walter@contoso.com";
	customer.PhoneNumber = "425-555-0101";

	// 3 - insert customer into demo table
	table.Execute(TableOperation.Insert(customer));
}
```

The process to create entities into Azure Table Storage, as we can see, is quite simple. The first step is to retrieve a reference to `CloudTable`. After that, we create a new `CustomerEntity`, with some arbitrary `Email` and `PhoneNumber`. Then, in the third and last step, we instruct `CloudTable` to execute an insert `TableOperation`, passing the customer instance that we just created.

## What is Azure Blob Storage?

Blob, an acronym to "Binary Large OBject", is a collection of binary data that can represent any type of file (like images, videos, documents, programs, etc). Microsoft Azure enables developers to store two types of blobs: *Block Blobs* and *Page Blobs*. In the following sections, we are going to learn about these types and how to store them into Microsoft Azure Storage accounts.

### Block Blobs

[Block Blobs](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-dotnet-how-to-use-blobs#blob-service-concepts) allow developers to handle big files with efficiency. Block Blobs main features on Azure Storage are:

- A single blob can be divided into many blocks, but can never exceed 50,000 blocks.
- Together, these blocks cannot exceed 200 GB.
- Each block can have a maximum size of 4MB.

![Block Blobs Structure on Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/jctwOpTCORYaX2QE5lTcR/6cab09dc477476dc1a1e6062b169f5fb/blob-storage)

### Page Blobs

[Page Blobs](https://docs.microsoft.com/en-us/azure/storage/blobs/storage-dotnet-how-to-use-blobs#blob-service-concepts) perform incredibly well on random read/write operations. This characteristic makes Page Blobs the perfect solution for virtual machines and OS data disks. Page Blobs main features on Azure Storage are:

- Capacity of 1 TB of size.
- Compound by a collection of 512-byte pages optimized for random read and write operations.
- Each write operation alter several pages at the same time.

![Page Blobs Structure on Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/1gZSWBgFdjHoRN0UTnU1xN/89f4909148b41d9144094acd013ea674/page-blob)

### Using Azure Blob Storage

Both Page Blobs and Block Blobs share a concept called *containers*. Some features of containers, in this context, are:

- A container provides a grouping of a set of blobs.
- All blobs must be in a container.
- An account can contain an unlimited number of containers.
- A container can store an unlimited number of blobs. Note that the container name must be lowercase.

The following code snippets show how to create a new container, or how to get the reference to an existing container called `demo-container`:

```C#
public CloudBlobContainer CreateContainer()
{
 // Retrieve the storage account
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);

 // Create a CloudStorageAccount instance
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// Create the blob client.
	CloudBlobClient blobClient = storageAccount.CreateCloudBlobClient();

	// Retrieve a reference to a container.
	CloudBlobContainer container = blobClient.GetContainerReference("demo-container");

	// Create the container if it doesn't already exist.
	container.CreateIfNotExists();

 return container;
}
```

After creating the container, we can upload a blob to it, as shown in the following snippet:

```C#
public void UploadBlobToContainer()
{
 // Get the "demo-container" container reference
	CloudBlobContainer container = CreateContainer();

	// Retrieve reference to a blob called "myblob".
	CloudBlockBlob blockBlob = container.GetBlockBlobReference("myblob");

	// Create or overwrite the "myblob" blob with contents from a local file
	string fullPath = Path.GetDirectoryName(
 Path.GetDirectoryName(System.IO.Directory.GetCurrentDirectory())
 ) + "pin.png";

	using (var fileStream = System.IO.File.OpenRead(fullPath))
	{
		blockBlob.UploadFromStream(fileStream);
	}
}
```

To learn about other operations—like how to list, download, and delete blobs—take a look into this [GitHub repository](https://github.com/vemoreno/BlobStorageWithCsharp).

## What is Azure Queue Storage?

Microsoft Azure provides instant messaging on the cloud between applications through [Queue Storage](https://azure.microsoft.com/en-us/services/storage/queues/). Due to this service, we can process significant amounts of messages and get access to them from anywhere through HTTP/HTTPS calls. Some features of Queue Storage are:

- Messages can have a maximum size of 64 KB of data.
- Any queue can store millions of messages.
- Great for asynchronous processing.

![Queue Storage Structure on Azure Storage](https://images.ctfassets.net/23aumh6u8s0i/6rCs5Jqr5xJh1UbFQNAcuJ/5d1b3bd701a0a74a596949f054b389df/queue-storage)

The following code snippets show how to create a new Queue Storage, or how to get the reference to an existing container called `my-queue`:

```C#
public CloudQueue CreateQueue()
{
 // Retrieve the storage account
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);

 // Create a CloudStorageAccount instance
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// Create a Queue Storage client
	CloudQueueClient queueClient = storageAccount.CreateCloudQueueClient();

	// Retrieve a reference to a container
	CloudQueue queue = queueClient.GetQueueReference("my-queue");

	// Create the queue if it doesn't already exist
	queue.CreateIfNotExists();

 return queue
}
```

After creating the Queue Storage, we can insert messages into it, as shown in the following snippet:

```C#
public void InsertMessage()
{
	// Retrieve a reference to my-queue
	CloudQueue queue = CreateQueue();

	// Create a message and add it to the queue.
	CloudQueueMessage message = new CloudQueueMessage("Hello, World");
	queue.AddMessage(message);
}
```

To learn about other operations—like how to peek, change, and dequeue messages—take a look into this [GitHub repository](https://github.com/vemoreno/QueueStorageWithCsharp).

## What is Azure File Storage?

Another way of store information on Microsoft Azure is through File Storage. This service offers shared resources in the cloud. Applications executing locally, on virtual machines, or any other service inside Microsoft Azure can mount a shared resource of files in Azure.

File Storage is flexible and can be handled through the following clients:

- Azure Portal.
- PowerShell.
- API Rest.
- Azure Libraries with .Net and other frameworks.

With File Storage, it is possible to replace file systems based on typical servers hosted on-premises environments. File Storage is secure because it uses the Server Message Block (SMB) Protocol and Common Internet File (CIFS).

A "File Share" is an SMB space in Azure. All directories and files must be created in a parent share. An account can contain an unlimited number of shares, and a share can store an unlimited number of files, up to the 5 TB total capacity of the file share.

![File Storage Structure on Azure Store](https://images.ctfassets.net/23aumh6u8s0i/1q3urAew8sT9FPEy0Ix524/6355fd326606dc32d7f9c523b67339c0/file-storage)

The following C# code snippet shows how to interact with File Storage on Azure Storage programmatically:

```C#
public void AccessFileStorage()
{
	// Retrieve storage account from connection string.
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// Create a CloudFileClient object for credentialed access to File storage.
	CloudFileClient fileClient = storageAccount.CreateCloudFileClient();

	// Get a reference to the file share we created previously.
	CloudFileShare share = fileClient.GetShareReference("logs");

	// Ensure that the share exists.
	if (share.Exists())
	{
		// Get a reference to the root directory for the share.
		CloudFileDirectory rootDir = share.GetRootDirectoryReference();

		// Get a reference to the directory we created previously.
		CloudFileDirectory sampleDir = rootDir.GetDirectoryReference("CustomLogs");

		// Ensure that the directory exists.
		if (sampleDir.Exists())
		{
			// Get a reference to the file we created previously.
			CloudFile file = sampleDir.GetFileReference("Log1.txt");

			// Ensure that the file exists.
			if (file.Exists())
			{
				// Write the contents of the file to the console window.
				Console.WriteLine(file.DownloadTextAsync().Result);
			}
		}
	}
}

public void SetMaxSize()
{
	// Parse the connection string for the storage account.
	StorageCredentials Credentials = new StorageCredentials(this.Account, this.Key);
	CloudStorageAccount storageAccount = new CloudStorageAccount(Credentials, false);

	// Create a CloudFileClient object for credentialed access to File storage.
	CloudFileClient fileClient = storageAccount.CreateCloudFileClient();

	// Get a reference to the file share we created previously.
	CloudFileShare share = fileClient.GetShareReference("logs");

	// Ensure that the share exists.
	if (share.Exists())
	{
		// Check current usage stats for the share.
		// Note that the ShareStats object is part of the protocol layer for the File service.
		Microsoft.WindowsAzure.Storage.File.Protocol.ShareStats stats = share.GetStats();
		Console.WriteLine("Current share usage: {0} GB", stats.Usage.ToString());

		// Specify the maximum size of the share, in GB.
		// This line sets the quota to be 10 GB greater than the current usage of the share.
		share.Properties.Quota = 10 + stats.Usage;
		share.SetProperties();

		// Now check the quota for the share. Call FetchAttributes() to populate the share's properties.
		share.FetchAttributes();
		Console.WriteLine("Current share quota: {0} GB", share.Properties.Quota);
	}
}
```

To learn more about how to deal with File Storage on Azure—like how to access, copy, or manage shared files—take a look into this [GitHub repository](https://github.com/vemoreno/FileStorageWithCsharp).

## Aside: Securing .NET Applications with Auth0

One of the most complex features to implement in an application is [user authentication and identity management](https://auth0.com/user-management). [Security for authentication and identity](https://auth0.com/docs/security) is [an entire glossary](https://auth0.com/identity-glossary) unto itself.

![Auth0 hosted login screen](https://images.ctfassets.net/23aumh6u8s0i/4ve30M1qt7GmE2nAYNKOhs/358e1f9aab4405b66fbeb5ca4cfa1eae/angular-aside-login)

If we need to implement a robust, highly customizable [identity and access management](https://auth0.com/learn/cloud-identity-access-management/) system quickly and easily for our .NET applications, Auth0 can help. As shown in this [quickstart ASP.NET Web API (OWIN) Authorization](https://auth0.com/docs/quickstart/backend/webapi-owin), we need to perform four simple steps. First, we create a Resource Server (API) in our Auth0 account.

![Create a Resource Server (API)](https://images.ctfassets.net/23aumh6u8s0i/pkl7oy76Iowh7JjqxujBT/4749a50a68abea34164fcca448e3c6c3/create-api.png)

Then we update the `web.config` file in our project with the correct Domain and API Identifier for our API, e.g.

```xml
<appSettings>
 <add key="Auth0Domain" value="bkrebs.auth0.com" />
 <add key="Auth0ApiIdentifier" value="https://bkrebs.auth0.com/api/v2/" />
</appSettings>
```

After that, we install two NuGet packages:

```bash
Install-Package Microsoft.Owin.Security.Jwt
Install-Package Auth0.OpenIdConnectSigningKeyResolver
```

And then we update the `Configuration` method of our `Startup` class to add a call to `UseJwtBearerAuthentication` passing in the configured `JwtBearerAuthenticationOptions`.

```C#
// Startup.cs

public void Configuration(IAppBuilder app)
{
 var domain = $"https://{ConfigurationManager.AppSettings["Auth0Domain"]}/";
 var apiIdentifier = ConfigurationManager.AppSettings["Auth0ApiIdentifier"];

 var keyResolver = new OpenIdConnectSigningKeyResolver(domain);
 app.UseJwtBearerAuthentication(
 new JwtBearerAuthenticationOptions
 {
 AuthenticationMode = AuthenticationMode.Active,
 TokenValidationParameters = new TokenValidationParameters()
 {
 ValidAudience = apiIdentifier,
 ValidIssuer = domain,
 IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) => keyResolver.GetSigningKey(identifier)
 }
 });

 // Configure Web API
 WebApiConfig.Configure(app);
}
```

[The full set of instructions on how to use Auth0 to secure ASP.NET Web APIs (OWIN) can be found here](https://auth0.com/docs/quickstart/backend/webapi-owin). Auth0 also can be easily integrated with [ASP.NET Core Web API](https://auth0.com/docs/quickstart/backend/aspnet-core-webapi) and [a lot of other platforms and frameworks](https://auth0.com/docs).

## Frequently Asked Questions

As we can see, Azure Storage offers developers multiple ways to store information in the cloud. Now that we know a little bit more about Azure Storage, let's look into some frequently asked questions:

### When should we use Table Storage?

Table Storage is useful when we don't need to store data that are linked to each other, like tables on a relational database. Table Storage does support tables, but their schema is flexible and we cannot join different tables through queries. To achieve similar results, we need to this in memory.

### When should we use Blob Storage?

Block blobs are ideal for storing text or binary files, such as documents and media files. Append blobs are similar to block blobs in that they are made up of blocks. Though, as they are optimized for append operations, they are useful for logging scenarios.

Page blobs can have up to 1 TB of data and are more efficient for frequent read/write operations. Azure Virtual Machines use page blobs as their main storage.

### When should we use Queue Storage?

Queue Storage helps developers to create scalable applications that are less sensitive to individual component failure. If part of our architecture goes down, messages are buffered, and then naturally picked up by other message processing nodes, which maintains the integrity of workload.

### When should we use File Storage?

File Storage is a great way to share files in the cloud. It uses HTTPS and SMB to secure data at rest and in-transit and the access to Storage Account is restricted to users having access to Storage Account Key.

Azure Storage Introduction

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Personal identifying information was compromised for 143 million Americans in a massive Equifax data breach from May to July, 2017.

## 143 Million Consumers Compromised in Equifax Data Breach

On September 7, 2017, consumer credit reporting agency [Equifax announced a data breach that potentially exposed personal data for 143 million US consumers](https://www.equifaxsecurity2017.com/). [Equifax](https://equifax.com) is one of the three largest American credit agencies, alongside [TransUnion](https://transunion.com) and [Experian](https://experian.com).

From mid-May through July 2017, criminals were able to access personal identifying information, including names, Social Security numbers, birthdates, addresses, and some driver's license numbers. In addition, credit card numbers for 209,000 US consumers were compromised, as well as dispute documents for 182,000 people. During the investigation, Equifax also discovered that limited personal information for some UK and Canadian residents had also been accessed. The hack was discovered on July 29, 2017.

Almost half of all Americans may have been affected by this data breach. **Your information may have been compromised even if you haven't signed up to use Equifax.** The data breach of a credit reporting agency (CRA) such as Equifax is particularly insidious because many consumers are _not aware_ that their data is stored with a CRA. [Equifax and other CRAs acquire their data](https://blog.equifax.com/credit/how-do-credit-reporting-agencies-get-their-information/) from credit card companies, banks, retailers, auto and mortgage lenders, debt collectors, and public records in order to generate credit scores. You don't need to have personally signed up with a CRA to have your data stored with Equifax!

## What Should I Do?

You _can_ check to see if your data has been exposed by visiting [Equifax's 2017 Incident Potential Impact website](https://www.equifaxsecurity2017.com/potential-impact/) and clicking the "Check Potential Impact" button. You can fill in your last name and last six digits of your Social Security number to find out if your data has potentially been leaked and receive a date to come back to enroll in free credit monitoring for a year. The [Federal Trade Commission also has detailed instructions available here](https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do).

Another thing you should do is actively check your bank and credit card statements regularly. If you see any suspicious or unusual activity, report it immediately to your financial institution. Don't become complacent and stop checking a week or two after a breach. Staying aware and vigilant with your accounts is important at all times. [Unfortunately, large data breaches have occurred many times in the past](http://money.cnn.com/2017/09/07/technology/business/biggest-breaches-ever/index.html), and in the digital age, we should be as prepared as possible to face more in the future.

In addition, you can monitor your own credit by requesting a free copy of your credit report from each of the three major CRAs once a year. If requests are staggered between the agencies, you can check your credit once every four months. Alternatively, you may wish to use services such as [CreditKarma](https://www.creditkarma.com/) to obtain free scores to monitor your own credit. You can also [freeze your credit](http://clark.com/personal-finance-credit/credit-freeze-and-thaw-guide/) if you choose. If you do this, make sure you freeze it with all three major CRAs, not just Equifax.

## Aside: Use Auth0 to Protect Your Users From Data Breaches

Auth0 provides [breached password detection](https://auth0.com/breached-passwords) that can be enabled simply and easily. The Auth0 security team maintains a database of third party breached credentials. This database is updated daily. On each login, user credentials are checked against the leaked passwords database. If a breach is suspected, the user is notified and cannot log in until they change the compromised password.

<video autoplay="" loop="" width="600">
 <source src="https://cdn.auth0.com/blog/breach/lock-2.m4v">
<img src="https://images.ctfassets.net/23aumh6u8s0i/3DpdlDPwLfrdGGb7RUQ6NU/d959326b776a71764727d5e3eae43c8a/lock"/>
</video>

Read about [Breached Passwords](https://auth0.com/breached-passwords) and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) to learn more about how to protect users and their credentials with Auth0. You can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account and start protecting your users today</a>!

Equifax Data Breach Compromises 143 Million People

Better information and transaction storage could mean big things.



It's rare that a technological development that completely revolutionizes how we conceptualize the world comes along. That status is reserved for things like the printing press, germ theory, the steam engine, and the internet.

So when something is lumped in with this category, it's best to sit up and take notice — and that's where blockchain technology is at today. It's discussed as a revolutionary digital technology that could cause a monumental shift in the way we understand structures like nation states and the economy.

Since it's a huge step in the digital realm, it will affect our ideas of identity, which have become inextricable from our digital lives. Although we can't predict the future, exploring the possibilities of blockchain technology is too tempting to resist. [As experts in identity management, Auth0 is always thinking about where identity is going](https://auth0.com/user-management), and how we will get there.

From the power of an individual actor to the privatization of data, here are some ways that we could see blockchain change digital identity.

## The trust problem

A blockchain is a database of transactions, each of which can be verified (owing to the [computational intensity of the block-creation task and public-key cryptography](https://auth0.com/blog/an-introduction-to-ethereum-and-smart-contracts/)) by any third-party. No record can be modified retroactively, each one contains a link to the record that came before it, and most importantly, it's all peer-to-peer.

It is a decentralized system wherein all the devices together create a functioning service, rather than some central entity providing the base functionality.

First imagined by [Satoshi Nakamoto](https://en.wikipedia.org/wiki/Satoshi_Nakamoto) in 2008, the blockchain is most widely known as the technology behind digital currencies such as Bitcoin, but is also starting to be used for much more. [Walmart](https://www.nytimes.com/2017/03/04/business/dealbook/blockchain-ibm-bitcoin.html?_r=0), for example, has started to use a blockchain to keep track of products from manufacturing to sale.

Why adopt this novel technology for a standard practice? Because shipments require a lot of documentation (think customs), and if some of that documentation isn't immediately available, it slows the process of the container. That leads to inconveniences down the line, or even spoiled goods.

When a blockchain stores all the information for a container, everyone can trust the documentation is in place as soon as it arrives at a checkpoint.

Another example might be a manufacturer wants to keep track of a peanut butter order. In a blockchain, they could store all the steps it takes for that peanut butter to get from jar to store, in sequence.

The manufacturer could see the details of payment to the peanut farmer, then the details of payment to their shippers, then the details of purchase from their distributor. All of these would be recorded in a “chain” that represents the life of the peanut butter jar, but would also be connected to the parties involved.

![Tracking a record](https://images.ctfassets.net/23aumh6u8s0i/5u1vLp7jyR8YO0crKrN83I/8fd726de3f3d11283de0671d3be10f70/factory-example)

So, if the factory wanted to go back to check where a bad batch of peanut butter came from, they would be able to quickly retrace the life of that jar of peanut butter to find out where it originated. Since each transaction stores unique information from each party that can't be retroactively changed, the peanut butter pipeline is a reliable source of information for the factory. This inability to make retroactive changes is what makes blockchain technology stand out from other systems.

## The double spending problem

Right now, most of the speculation surrounding blockchain's implications have been aimed at the financial industry, especially since cryptocurrencies are the most known uses of a blockchain system. Although we won't be focusing on fintech, addressing how blockchain could disrupt the financial world is a good starting point to understanding its potential impact.

Fintech discussion of blockchain centers on disrupting the role of banks and governments as agents that allow you to trust a financial transaction.

For example, if you wanted to send money overseas, you might use a transfer service available from your bank. You trust your bank to take the right funds from your account, and safely deposit them into someone else's account abroad. You trust that this transaction will happen only once and that the money will be deposited into the correct account.

If you were sending money overseas with a cryptocurrency like Bitcoin, the blockchain structure ensures that you are sending a one-time payment from your account to the account of another individual, eliminating the need for the bank.

The implication here is that the institutions that provide trust and validation will no longer be necessary to complete many basic tasks. This has a host of implications for things like the structure of the world economy, generating questions like: how will international economics be affected by secure exchange becoming independent from a government or a bank?

That's a difficult question that we can't answer yet. So, now that we've got an idea of the types of questions being asked about blockchain technologies, let's narrow our focus to identity.

## How blockchain could reshape the idea of identity

### Historically Verifiable Records

A blockchain can provide more than just a record of a financial transaction or a log of where a shipping container has been. It can theoretically store a variety of data, including property ownership, financial, intellectual property, and even medical data.

With this type of storage, keeping a historic record of the disparate parts of one's identity would be much easier. Digital identity would more closely model the complexity of someone's actual identity — all their spending habits, their rental history, permanent records of legally binding agreements in one place.

For example, you go to a bank to ask for a loan. That bank needs to check your financial history to qualify you for the loan. If your financial data was stored in a blockchain your potential lender could rely on [the work other financial institutions did](https://www.americanbanker.com/news/how-blockchain-fits-into-the-future-of-digital-identity) to keep your data to easily qualify you.

Think of it like using an app through Facebook: the app asks you to share your email, location, and friends to use the app. However, instead of Facebook, in this case it's parts of your blockchain-backed data. It could be used, for example, by a real estate agent to show a landlord you are a reliable tenant — just by allowing their server access to that part of your history.

On the other hand, this poses interesting questions for privacy. Although it is not necessary to store data on the blockchain for cases like the above (for example, you could store a hash), you still need to keep your data somewhere. If this data is ever exposed, whomever gets access to it can verify it is you who owns it by looking at the blockchain. In a sense, this gives people with access to your data all the tools they need to associate the data with you. As long as there is one copy of the data somewhere, you can never take it back, it will always be mapped back to you.

### Privatization

Since blockchains can store sensitive data, we might see a radical privatization of identity.

For example, individuals generally do not store all of their medical data themselves. In order to access that information, or to grant others to access that information, they have to go through large organizations (healthcare, hospitals), or small businesses (a local dentist, a pharmacy).

One reason we're willing to let banks and hospitals keep our sensitive information is that it's difficult to keep ourselves. An adult might have a mound of medical paperwork that is cumbersome to keep secure at home and to shlep around. Hospitals, on the other hand, are obliged to protect and organize our medical data, which saves us the hassle.

But in storing their information, these corporations may use their stored data as a representation of an individual for research, marketing — anything that could benefit from demographic data.

For example, if you apply for a loan, the bank collects information about you to verify you for that loan. In today's world, they can — and will — [share that information](https://www.fdic.gov/consumers/privacy/yourrights/) with telemarketers, the airlines, and other third parties who are trying to target you as a consumer.

Giving all of one's recordable data back to an individual would be a radical shift in the way that we can access and grant access to personal information about ourselves. It would also save us time and energy, since we wouldn't have to jump through bureaucratic hoops every time we wanted to recall a piece of information about ourselves, whether that's from the bank, government, or hospital. This identity would be shared with specific actors and backed with proofs-of-existence in a blockchain. Many blockchains already exist and could be used for this.

### Separation

Instead of centralizing all of their data, people could also decide to split their information into a number of different blockchain “identities” for different things. We call "identities" to the owners of specific transactions associated to a blockchain address.

For example, household spending could be a joint blockchain identity for a family, while each spouse also maintains a separate, personal blockchain identity for their own spending. There might be a separate identity for a trust fund or property inheritance and yet another identity for stock portfolios.

While people might feel comfortable keeping all of these things linked to one account, many individuals today already have separate accounts and identities for different functions.

For example, spouses might keep separate bank accounts, and family money might remain in a trust set up at a separate institution. Reliance on blockchains could eliminate the need for a central authority like a bank, and encourage people to further separate.

![Blockchain Separation](https://images.ctfassets.net/23aumh6u8s0i/pQEPmAfnp7zDc94pyXM85/0d16eff8fb2fe8a2f7917fb3c5a35fad/blockchain-flow)

Or, if you could transfer blockchain identities as part of your will, it might make sense to keep different properties, intellectual information, and financial information about high-value assets like jewelry or art in different identities.

### Verification

We often feel apprehensive if we're completing a transaction with a stranger, especially online. That's why sites like Etsy, Airbnb and Ebay give you access to reviews and ratings based on user history. Airbnb, shown below, even has an option for verification through the site, to build a sense of trust and legitimacy.

![Blockchain Verification](https://images.ctfassets.net/23aumh6u8s0i/3RhOL1lMh22YsPq3IKAKPR/56f7447cd47b0ba0a289a8d6f64dabbd/blockchain-verification)

But in a world of easily recorded public transactions, it could be enough to verify an exchange partner as “trustworthy” simply by being able to look at their transaction record through their blockchain history, or to have some sort of transaction score attached to it.

Just how much could we verify simply based on information encoded in blockchains? It depends on how and what we choose to store in the blockchain, but we are beginning to see that. For example, today people can prove they own a certain amount of money by simply signing a challenge with their private Bitcoin key. You can mathematically prove to anyone that you have enough money to enter a loan!

Imagine reapplying for a visa and having all your employment records, previous visa applications, passport information, and relevant personal history available to the application just through your authorization. Although you are the “keeper” of your identity, governments and other entities would be able to trust that data instantly, and you would not have to reach into their bureaucracy — our current centers of verification — to get it. This is by no means a solved problem with blockchain technology today, but it is a step forward. Data privacy, especially with blockchain technology is an evolving work in progress.

With the power and security of blockchains, it's possible that one day, we can use blockchain technology to build a source of trust for transactions and identity. But it would take a huge buy in from the top down to get us there, which means that the government and industry standards would be necessary to pave the way.

## Blockchain could mean big things

Although some speculations surrounding blockchain seems hyperbolic, the truth is that we have no idea of where this technology could take us. Just as communications companies [never imagined](https://hbr.org/2017/01/the-truth-about-blockchain) that TCP/IP development would one day be used for video chat, the blockchain future could be the realm of sci-fi today.

For authentication and identity management, there is a good chance blockchains will have an impact. Identity is all about proving things about someone, and blockchains augment private-key proofs with historical records. They are essentially verifiable ledgers that can store and link to any type of information.

What ways do you see blockchain changing identity — and how do you think that will affect the digital future?

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Opinion Piece: How the Blockchain Could Change The Idea of Identity

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Sensitive personal information of 198 million Americans citizens, with potential political inclinations, was exposed by a data analysis firm.

On June 19, 2017, a cybersecurity company called [UpGuard](https://www.upguard.com) reported that a huge amount of data about Americans citizens and their political inclinations was publicly available on an AWS S3 bucket. More precisely, personal information of over 198 million American voters was left exposed to the internet. The leak revealed sensitive personal information like voter's date of birth, mailing addresses, phone numbers, political inclinations, voter registration status, and so on.

## The Data Leak

One week before announcing the leak, a Cyber Risk Analyst of UpGuard found out that a AWS S3 bucket (a cloud storage) was misconfigured. This misconfiguration enabled anyone with an internet connection to gain access to the data simply by navigating to a six-character Amazon subdomain called "dra-dw". The cloud storage bucket and its contents were owned by [Deep Root Analytics](https://www.deeprootanalytics.com/), a data firm that identifies audiences for political ads, and were created to feed the Republican National Committee in their efforts to elect Donald Trump.

The data included 1.1 terabytes of unsecured personal information compiled by Deep Root Analytics and two other contractors: TargetPoint Consulting, Inc. and Data Trust. In total, the personal information of potentially all of America's 200 million registered voters was exposed, including names, dates of birth, home addresses, phone numbers, and voter registration details.

<include src="TweetQuote" quoteText="1.1 terabytes of U.S. citizens leaked by an analytics contractor."/>

## The Nature of the Data

Two critical directories entitled *data_trust* and *target_point* were found in the cloud storage. The first folder, *data_trust*, contained data gathered on an effort to host a comprehensive and detailed information about potential 2016 voters. This data was organized on two file repositories: one for the 2008 presidential election; and the other one for 2012. Each of these repositories contained a file for every state in the U.S, formatted as a comma separated value (CSV), and uniquely identified every potential voter in the database.

Chris Vickery, the researcher that discovered the leak, and Dan O'Sullivan, the reporter that wrote the [data leak announcement](https://www.upguard.com/breaches/the-rnc-files), looked up in the spreadsheets (CSV are usually read as spreadsheet) found and confirmed that the files contained accurate and sensitive personal information. They have identified one hundred and forty seven different categories of data in these spreadsheets, with columns like: "State", "Town", "MT10_ObamaDisapproval", "SD_NextElection", "SDProper_NextElection", "NamePrefix", "FirstName", "MiddleName", "LastName", "Sex", etc.

The second directory, *target_point*, contained information about voters' likely positions on 48 different political subjects. Ranging from how likely it is the individual voted for Obama in 2012, to whether they agree with the Trump foreign policy of "[America First](https://www.whitehouse.gov/america-first-foreign-policy)", to how likely they are to be concerned with auto manufacturing as an issue, among others.

The reporter responsible for the official announcement was able, after determining his identifier in the spreadsheets, to view his modeled policy preferences and political actions as calculated by the contractors. He stated, to his surprise, that the results forecasted by the companies were pretty accurate. Therefore, what we can see here is that a reckless action taken by Deep Root Analytics, ignoring the most basic security measures, exposed a very detailed and precise dossier about virtually all potential voters in America.

<include src="TweetQuote" quoteText="Virtually all potential voters in America had their personal data leaked."/>

To take a deeper look in the security breach details, [check the official announcement made by UpGuard](https://www.upguard.com/breaches/the-rnc-files).

## Aside: How Auth0 Helps to Protect Your Data

At Auth0 security is of the utmost importance. Our authentication and authorization services let you set up multiple policies that greatly improves the security of your web and native applications. Some features that customers can benefit from are:

- [Multifactor Authentication](https://auth0.com/multifactor-authentication?utm_source=blog&utm_medium=sc&utm_campaign=navy_leak),
- [Automatic Breached Password Detection](https://auth0.com/docs/anomaly-detection?utm_source=blog&utm_medium=sc&utm_campaign=navy_leak#breached-password-detection),
- [Custom Rules](https://auth0.com/docs/rules?utm_source=blog&utm_medium=sc&utm_campaign=navy_leak),
- [Passwordless Authentication](https://auth0.com/passwordless/?utm_source=blog&utm_medium=sc&utm_campaign=navy_leak),
- and [Per-Client On-Site Installations](https://auth0.com/docs/overview/deployment-models)

To check how we protect the most sensitive data of our customers and their users, visit our [Security & Privacy webpage](https://auth0.com/security). There you are going to find an overview about our security approach, and a list of certifications and compliance capabilities. You will also find a link to our *Information Security White Paper* with a detailed explanation about our security measures, practices, and certifications.

<a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Sign up today</a> and try a free account to get a taste of how easy these features can be set up on application of any size.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

## Conclusion

Security has always been hard and it will become even harder as companies continue to migrate to cloud solutions. One of the ways to approach security is by [keeping multiple layers that complement each other](https://auth0.com/blog/navy-data-leaked/). But, when it comes to sensitive data, like personal information, it is better to rely on companies where employees are fully focused on improving data security, at rest and in motion, like Auth0.

While one can (and must) invest time on, at least, basic security checks and configuration, they will never be able to achieve the same level of security of companies that are specialized on handling sensitive data. [That's why sometimes it is better to buy external solutions, from reliable companies, than building your own](https://auth0.com/blog/when-to-build-and-when-to-buy/).

Massive Data Leak Exposes 198 Million US Voters

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

An unsecured database allowed hackers to steal personal information from over 820,000 Cloudpets customers. Learn how this may affect you and what to do next.

[Spiral Toys](http://spiraltoys.com/) is a company that creates toys for children. It has an internet-connected product called [CloudPets](http://cloudpets.com/) which allows parents and children to record and send voice messages to each other through a mobile app. On January 7, hackers discovered that the database the company was using to store data for this product was unsecured. Hackers took control of the database, deleted all information, and demanded a payment to restore the data.

![Cloudpets Homepage](https://images.ctfassets.net/23aumh6u8s0i/4ISXmWTbhcqnqACVvBoSLv/6c7cb193c8c49f69d71da5ffd32cc7bc/cloudpets)

The database contained information for 820,000+ users containing emails, bcrypt hashed passwords, and links to voice recordings customers and their children had made which could now be publicly accessed. Additional information stored included pictures, names, birthdays, and relationships. Customers were not notified that their data had been compromised.

[Troy Hunt](https://twitter.com/troyhunt) wrote an excellent [article](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/) covering this incident. Some highlights include that the database used was publicly accessible and did not even require a password to access. Cloudpets was also notified at least four times that their database was exposed and the reporters never heard back from the company. Finally, staging and test databases were also discovered which had production data that could have also been compromised.

Aside from the devops failure to secure the database properly, password requirements for user accounts were non-existant. Although the passwords were stored as bcrypt hashes, Troy was able to use [Hashcat](https://hashcat.net/hashcat/) and find valid passwords such as "qwe", "password", and "123456".

![Cracked Bcrypt Hashes](https://images.ctfassets.net/23aumh6u8s0i/1ChTEWQXZQBJD3YjBclNhX/76bdc049376598ed8261792961ad335d/cracked-bcrypt-hashes)

Source: [Troy Hunt](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/)

Since the database has been publicly exposed since at least December 25, 2016, it is safe to assume that many malicious parties have accessed and downloaded the data. We urge customers that have Cloudpets accounts to change their passwords and monitor their other accounts for signs of malicious activity.

## Personal Information Security Guide

Even if you don't have a Cloudpets account, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, best practices for choosing good passwords, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

## Auth0 Can Protect Your Users and Apps

Managing identity is a complex and difficult task. At [Auth0](https://auth0.com), our goal is to make identity simple for developers. A recent feature we launched called [Breached Password Detection](https://auth0.com/breached-passwords) can help alert your users that their credentials have been compromised in a data breach when they login to your app. We are still working on getting and adding credentials from this breach to our database to better protect your users. This feature helps your users stay safe, but also protects your apps from malicious access. Additionally, Auth0 meets the standards for various [password strength requirements](https://auth0.com/docs/connections/database/password-strength), provides [multifactor authentication](https://auth0.com/multifactor-authentication), and more.

If you want to make identity simple and secure for your applications, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">give Auth0 a try</a>.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

Cloudpets Data Breach Affects Over 820,000 Customers

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Prosper Otemuyiwa

Help your family and friends being secure with this printable security guide

**TL;DR:** The digital age is upon us. As much as it has blessed us and made collaboration and work easier, faster and more efficient, it also has its downsides. A lot of damage can be done by someone in a remote village over the internet. Cybercriminals carefully exploit loopholes to steal information and perform unauthorized transactions across devices and applications that are not secured enough.

This article aims to serve as a personal information security identity guide for you, family and friends. Follow this guide and keep your family and friends safe from cybercriminals this season!

<div class="alert alert-info alert-icon">
 
 Find the printable guide to give it to your family and friends here: <a href="https://cdn.auth0.com/blog/personal-info-security-guide/Personal-Information-Security-Guide.pdf">Personal Information Security Guide for Family and Friends PDF</a>.
</div>

## The Guide

We came up with a list of questions that sums up the common security challenges that a lot of people experience and also provided answers that can guide you below:

### How do I make sure my email is secure?

* Set up [Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication/). This adds an additional step to verifying a user logging into their email, e.g Your email provider sends a code to your phone that you must enter into a form to successfully authenticate and gain access to your email.
* Avoid sending confidential information such as passwords or social security numbers through email.
* Assume links in your emails are not from a secure and reputable source e.g links that lead to banking services and billing sites. Type the address in the browser to go to these sites instead.

![2FA](https://images.ctfassets.net/23aumh6u8s0i/3aoXPDNrzYX9QSlwQ811HU/94256dc0e5937a702adf56f09bee237e/tfa-what)

### How do I secure my social network accounts and prevent them from being hacked?

* Don’t use the same password across multiple online services.
* Use a password manager such as [LastPass](https://www.lastpass.com) or [1Password](https://1password.com) to store and also generate secure passwords.
* Change passwords frequently.
* Register yourself on [Have I Been Pawned](https://haveibeenpwned.com) to ensure your accounts haven't been hacked.
* Set up [Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication) if it’s available on the social network.

### Is my home network secure?

When setting up your wireless network at home, ensure you have a very strong WPA-2 (Wi-Fi Protected Access 2) password by following this process:

* Log into your account
* Open the wireless tab to edit your wireless settings
* Click to enable **WPA-2** from the dropdown option
* Set a strong password. Check out how to pick a good password on question #5

![WPA-2 Settings Dialog](https://images.ctfassets.net/23aumh6u8s0i/qxKEKQUBsAA4YtkNpIkXX/4ec646da1616fe96a06426fa9d900f26/X5wMl)

### How do I detect phishing emails?

**Phishing** emails are emails designed to look like legitimate messages from actual banks, businesses, and other organizations. In reality, they are crafted messages from cyber-criminals intended to steal your identity, personal information, or money. 

Do not click on any links that you do not recognize, especially if they come from an unknown source. Better still, assume all links from emails are phishing attempts. If it’s a mail from the bank, type the address in the browser rather than clicking on the link. Often, phishing emails do not include your name but something generic like **“Dear Client,”...**. 

Watch out for such emails.

![Phising Email](https://images.ctfassets.net/23aumh6u8s0i/6kvkEo4fq3jmKVoqTh5Tmf/27b93bfaed750d2ba87fc8c608565ee0/phishingemail)

_Phishing Email_

### How to pick a good password?

* Your password should be at least 10 characters long.
* It should be a combination of alphanumeric, special, lower and uppercase characters.
* Check out this [guide](https://auth0.com/docs/connections/database/password-strength) for more information on defining a strong password.

![How to pick a good password](https://images.ctfassets.net/23aumh6u8s0i/4Fi0J601exBxy5EBXti6jD/2840507af25ad497fd94a665ab872627/password-strenght)

### Do I need antivirus software on my computer?

Yes, antivirus software is needed on your computer. It detects, prevents, and removes malicious software on your computer. You can install trusted antivirus software like [Kaspersky](https://www.kaspersky.com) or [Avast](https://www.avast.com) on your computer.

### Why is it not good to share too much information about yourself and family on social media platforms?

If you post too much information about yourself, friends and family, an identity thief can find information about your life, use it to answer *challenge* questions on your accounts, and get access to your money and personal information.

Make as little content as possible public. For example, *share only with friends*, is a good default option for Facebook accounts.

![Sharing too much information on social media](https://images.ctfassets.net/23aumh6u8s0i/1FVp2HYk6ZhMp4DjoYZntp/d1c112dc22fea1d50bb54210e1e36d6b/2016-09-30-1475236577-9265213-socialmediaimage)

_Source: Huffingtonpost.com_

### Should I care about security while connecting to Wireless Networks?

While connected to public WiFi networks, ensure that the sites you visit or submit information to are secure by ensuring that the URL starts with **https** instead of **http**.

Enable the firewall on your computer. You can configure the application firewall on your Mac by going through the [apple support instructions](https://support.apple.com/en-ng/HT201642). You can also configure the application firewall on your Windows PC by going through this [instructions](https://goo.gl/CKKPcB).

### How do I detect phone scams?

**What are Phone Scams?** Phone scams are text messages or phone calls designed to trick you into providing sensitive information to unauthentic authorities. 

 * Make sure you check out for typos
 * Watch out for “Too good to be true” deals sent via text messages.

![Phone Scams](https://images.ctfassets.net/23aumh6u8s0i/4wi0zL8pD35Vf6po1lm2b0/10580c8f026dc30e3ce1504c1b6ab445/phonescams)

### How to use a password manager?

A password manager is software that helps store and organize user passwords. It is not advisable to use the same passwords across various websites and services, thus using a password manager helps alleviate the challenge of committing complex and strong passwords to memory. There are several password managers available to use. Notable ones and instructions on how to use them include [1Password](http://www.businessinsider.com/1password-manager-how-to-2015-6), [Dashlane](https://blog.dashlane.com), [LastPass](https://lastpass.com/how-it-works) and [KeePass](http://keepass.info/help/base/firststeps.html).

### Why should I not reuse my password on every website?

Reusing a password on several services is a high-risk venture. If your password is compromised on one service, hackers can have access to your accounts on several services and cause lots of damage.

### How would I know if a website is secure to enter my credit card information?

Look out for the encryption symbol, *padlock*, in the URL. Verify that the site is secure by ensuring that the URL starts with **https** instead of **http** before providing sensitive information to the website. In addition, prefer recognized brands over unknown ones, even if the padlock icon for https is present in the address bar.

![Unsecure Sites](https://images.ctfassets.net/23aumh6u8s0i/7wJqzJ0zgyqqCbHlvqpjdw/cfb8474d9a636d4c621c4c78ec5ea306/Unsecure-Sites)

### How do I make sure a website is real?

Look out for typos in the site name and URL. A typical example is [https://www.paypal.com](https://www.paypal.com) , a fake version of this might be *https://paypa1.com*. Also look out for the encryption symbol, *padlock*, in the URL. Verify that the site is secure by ensuring that the URL starts with **https** instead of **http**.

![secure_website](https://images.ctfassets.net/23aumh6u8s0i/2zmsKZfQFzJmycmk6rAdrD/c50f434ca37b8dc0333190ba1f3e8493/secure_website.png)

### How to secure your mobile devices?

* Ensure that your mobile device Operating System(OS) is always up-to-date.
* Have a lock system for your device, e.g password lock, fingerprint lock or pattern lock.
* If there is an option for *“encryption”* in the device settings, enable it.
* Do not use alternate app stores e.g Alternatives to Google Play & App Store

![Fingerprint Hero](https://images.ctfassets.net/23aumh6u8s0i/5mTklB19ML2ZkbRu9nDse6/acc0fb06fdf2323e68e4320a2a4b6f44/Fingerprint-Hero)

### What are your personal backup strategies?

We recommend that you backup your personal information securely on a regular basis. There are several good options for automatically backing up your data. Some popular and trusted options are [Crashplan](https://www.crashplan.com), [Carbonite](https://www.carbonite.com), [SpiderOak](https://spideroak.com) and [BackBlaze](https://www.backblaze.com). For Mac users, you can also use [Apple Time Machine](https://support.apple.com/en-us/HT201250).

![Backups](https://images.ctfassets.net/23aumh6u8s0i/4RMJTko1iCpclEwajl62vz/1d10f933fd5529f1c3a710ca59f0c11d/backup)

## Conclusion

Finally, we would like to give you a word of advice to complement these tips to ensure you, your family and friends stay safe this season and beyond! Keep these things in mind, and we are hopeful that you will enjoy this season with your friends and family.

<div class="alert alert-info alert-icon">
 
 Find the printable guide to give it to your family and friends here: <a href="https://cdn.auth0.com/blog/personal-info-security-guide/Personal-Information-Security-Guide.pdf">Personal Information Security Guide for Family and Friends PDF</a>.
</div>

Merry Christmas and Happy new Year in Advance!

Personal Information Security Guide for Family and Friends

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

The recent leak of US Navy sailors' personal information puts in the spotlight the difficulties of keeping sensitive data secure, here's what you can do about it

"information"