332d7898dae6bc56031ac3507a0248ba

I'm a full-stack developer with a passion for technology and code. I love writing tutorials for developers to showcase a particular technology whilst building something useful at the same time. Right now  I can mostly be found developing for the front-end, playing around with Docker, or tinkering with Unreal Engine and electronics!

Developer Experience Engineer

Steve Hobbs

Let's take a run through the OWASP Top 10 and see how Auth0 can help.

A Tour Through the OWASP Top 10 (2018)

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Email addresses, passport numbers, and credit card information included in stolen data.



_Update: Marriott now says the breach wasn’t as bad as originally reported, lowering the victim number to [383 million](https://www.bankinfosecurity.com/marriot-mega-breach-victim-count-drops-to-383-million-a-11916)._

What can you do if you’re one of the 500 million [Marriott International Inc.](https://www.bloomberg.com/quote/MAR:US) guests affected by the massive data breach announced today? According to the company’s [announcement](https://answers.kroll.com/), the breach affects guests who stayed at the Marriott’s Starwood properties from 2014 through Sept. 10, 2018. For approximately 327 million of impacted guests, Marriott says the breached information includes some combination of:

- Mailing address
- Phone number
- Email address
- Starwood Preferred Guest (“SPG”) account information
- Birthdate
- Gender
- Arrival and departure information
- Reservation date
- Communication preferences.

Credit and debit card numbers were also included in the breach. While Marriott notes this information was encrypted according to the AES-128 standard, they do not yet know if the components required to decrypt these numbers have been compromised.

![Marriot's Starwood Property](https://images.ctfassets.net/23aumh6u8s0i/7LRWHLzMk1XQxnM9cWpnKJ/9f47c148a148fa5af76cfe857598b83c/marriot-starwood-data-breach)

[Source: [Wikimedia](https://commons.wikimedia.org/wiki/File:Guam_Marriott_Resort_%26_Spa.JPG)]

## 5 Steps to Protect your Data After This Breach

If you’ve made a reservation at a Starwood property in the last four years (this includes Sheraton, Westin, Four Points, [many other brands](https://answers.kroll.com/), and Starwood-branded timeshares), take these steps to minimize your exposure:

1. **Change your password.** This should be your default response to the news of any hack that might involve your information. If you use the same password in multiple places, be sure to change your password everywhere.

2. **Implement Multi-factor Authentication (MFA).** A breached password is only useful if malicious actors can use it. A second step of authentication, like a code sent via SMS to your phone, can render that breached password useless (but you should still change your password).

3. **Monitor your accounts.** Marriott’s system was compromised for an extended period of time. Check your accounts weekly.

4. **Consider freezing your credit.** You can put a credit hold on your accounts, but in most U.S. states, the hold remains permanent until you request a thaw. This [guide from NerdWallet](https://www.nerdwallet.com/blog/finance/pros-and-cons-freezing-credit/) provides more details.

5. **Watch out for phishing attempts.** “Phishing attempts can be more credible when someone has access to actual personal details,” says Auth0 Principal Security Engineer Emory Lundberg. This hack includes data that could make social engineering attempts easier. For more advice on avoiding phishing attempts, check out this [post](https://auth0.com/blog/achieving-security-awareness-through-social-engineering-attacks/) by Annybell Villarroel, Auth0 Security Operations Manager.

![Steps After A Data Breach](https://images.ctfassets.net/23aumh6u8s0i/6k5RKe4zh50H8BrRaPqQC2/ad318219be99cf9089a470a643ef7d5e/security-after-data-breach)

[Source: [PixaBay](https://pixabay.com/en/photos/cyber%20security/?)]

## Marriot's Data Breach Response Plan

In addition, Marriott has taken the following steps to help guests monitor and protect their information:

**Dedicated Call Center**

Marriott has established a dedicated call center to answer questions you may have about this incident. The call center is open seven days a week and is available in multiple languages. Our dedicated call center may experience high call volume initially, and we appreciate your patience.

**Email Notification**

Marriott began sending emails on a rolling basis on November 30, 2018 to affected guests whose email addresses are in the Starwood guest reservation database.

**Free WebWatcher Enrollment**

Marriott is providing guests the opportunity to enroll in WebWatcher free of charge for one year. WebWatcher monitors internet sites where personal information is shared and generates an alert to the consumer if evidence of the consumer’s personal information is found. Due to regulatory and other reasons, WebWatcher or similar products are not available in all countries. Guests from the United States who complete the WebWatcher enrollment process will also be provided fraud consultation services and reimbursement coverage for free. Click on your country, if listed, to begin the enrollment process.

<include src="asides/AboutAuth0" />

---


Marriott's Starwood Data Breach - 5 Steps to Protect your Data

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

Everything you always wanted to know (but were afraid to ask)

"mitigations"