MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

There’s no patch for humanity, but that’s not a bad thing

Let’s face it. We all make mistakes. Even the most diligent, well-intentioned employee can inadvertently open the floodgates to an attack. Telecoms giant Verizon illustrated this earlier this year, when it published the 2021 edition of its Data Breach Investigations Report (DBIR).

The DBIR examined approximately 5,250 successful security breaches, gathering data about the methodologies used. It found 35 percent of attacks incorporated a social element. Of these, the vast majority (85%) used phishing tactics.

**In short:** you can deploy all the technological measures you want, but unless you address the human element, an attacker can defeat your defenses with a simple phone call or email.

Social engineering has always intrigued me. There’s something weirdly compelling about someone circumventing the defenses of a company with nothing but a winning smile and a confident tone, and industry raconteurs like Jenny “The People Hacker” Radcliffe and Kevin Mitnick have some incredible stories to share.

But there’s something else. Many of the tactics successfully employed by social engineers can be found throughout history, used in the fields of warfare, espionage, and criminality. Shadowy state actors targeting government departments can be found using the same playbook as Classical-era Greek military tacticians.

There’s a reason for this. Humans are social animals. We have certain inherent traits. We’re often willing to trust strangers, and we help those we don’t necessarily know. We live by a set of rules, both written and unwritten. These attributes allowed us to develop societies, permanent settlements, and eventually nation states. But they can also be exploited by malicious actors seeking to further a particular goal.

> Technologies and tactics change. Human nature is a constant.

This article will explore some of these historical parallels. We’ll take a journey through time that starts in the Roman city of Brundisium, circa 19 BCE, with detours through the swinging sixties, the latter years of the Vietnam War, and the early days of the Internet. We’ll put the tactics used by social engineers into context, and show why they’re so effective. And finally, we’ll learn how to defend against them.

## Our Unpatchable Human Zero-Days

Before we start our trip, it’s probably a good idea to talk about the human qualities commonly targeted by social engineers.

While researching this post, I sought out as many tales of real-world social engineering as I could find. I thumbed through books by Chris Hadnagy and Kevin Mitnick. I listened to conference talks from the likes of Paul Wilson and Jenny Radcliffe. I devoured entire episodes of The Darknet Diaries.

As I went through, I noted most attacks focused on certain human attributes. These included:

*   **Curiosity**  
    **Every great scientific and technological leap started with the words: “What if?” But you don’t need to be Einstein to have curiosity. We use trial-and-error and experimentation to make sense of our environment. Social engineers frequently exploit this when harvesting credentials or [deploying malware](https://darknetdiaries.com/episode/100/).
*   **Trust**  
    **Life’s easier (and nicer) when you assume everyone acts in good faith. And so, we take people at their word. If an unfamiliar voice calls and claims to be from your bank or phone company, you might instinctively believe them. Social engineers can — and often do — exploit this.
*   **The Desire to Help**  
    **Since we’re social animals, collaboration is inevitable. If we see someone in need of assistance, chances are we’ll offer it. When exploiting this, a social engineer might pretend to be a low-ranking employee in need of credentials, access, or documents. They’ll count on the target feeling pity for them.
*   **Fear**  
    **The “fear factor” frequently features in social engineering attacks. You’re probably familiar with phishing emails claiming your bank account has been hacked, or your social media profile will be deleted unless you click a link. This tactic pressurizes the target into making hasty decisions and dropping their skepticism.
*   **The Desire to Comply**  
    **Almost all organizations — both public and private sector — are hierarchical. There’s a pecking order, with some people at the top, and others at the bottom. We tend to listen to (and obey) those higher up in the echelons. Attackers can exploit this by masquerading as high-ranking employees and issuing edicts to junior employees.

Each of the historical examples listed in this article uses these innate attributes, often to devastating effect.

## From USB Sticks to Wooden Horses

The year is 2008. A threat actor, most likely working for a foreign state, had broken into the heart of the United States defense establishment. Showing remarkable skil, the attacker had successfully deployed a data-siphoning worm onto a Central Command (CENTCOM) computer. From there, it proliferated like a fungus, spreading undetected into other computers.

William J. Lynn III, an Obama-era Deputy Secretary of Defense, later described it as "[the most significant breach of U.S. military computers ever.](https://archive.defense.gov/home/features/2010/0410_cybersec/lynn-article1.aspx)" He wasn’t wrong. The worm took almost 14 months to eradicate, and it infected both classified and unclassified machines. It’s hard to quantify the damage it inflicted on the Department of Defense.

Adding insult to injury, the damage was arguably self-inflicted. The virus, later dubbed Agent.biz, was distributed on USB sticks dropped in the parking lot at an unnamed Middle East military base. A CENTCOM employee picked one up and plugged it into their laptop.

The Department of Defense never identified the employee responsible for the first infection. We’ll never know their motivations. Were they curious about the drive’s contents? Did they want to reunite the drive with its owner? Or did they just want to save the $20 on a new memory stick? It’s not clear.

In the end, it doesn’t matter. The damage was done. The Department of Defense was forced to spend critical resources identifying and wiping infected machines, as they eliminated the worm one computer at a time. And it forced the military to radically change their approach to computer security, ultimately leading to the creation of the United States Cyber Command.

Still, I can’t help but wonder what the ancient Roman poet Virgil would think of this tale. Two millennia prior, Virgil was spending his twilight years in the city of Brundisium (now Brindisi), where he worked on his opus, the epic poem Aeneid.

Aeneid described the Siege of Troy. This is perhaps the most famous battle that never actually took place — or, at least, in the way depicted. Pretty much everything below is apocryphal. Still, it’s a great story, so indulge me.

Here’s the TL;DR: Greece was at war with Troy. It wasn’t going well. Both sides were effectively at a stalemate. Troy had retreated behind the walls of its capital city, where it could hold out indefinitely. After an exhausting decades-long siege, the Greeks were eager to end the campaign. And so, their leader, Odysseus, conjured a devious ruse.

Greece would pretend to surrender. Their forces would retreat. By means of apology, they left a large wooden horse at the gates of the city, which the Trojans interpreted as a tribute to their greatness.

We all know what happened next. The Trojans hauled the horse into the city, unbeknownst to the shock force of Greek warriors lurking within its interior. As night fell, they crept out and unlocked the gates to the city. The rest of the Greek army surged forward, flooding in and bringing the war to its conclusion in a matter of hours.

Technologically, USB drives and wooden horses couldn’t be more different. But in both of the examples cited, they were used to inflict devastating losses to the target. More importantly, they were only effective because the victim implicitly trusted they wouldn’t be used to harm them. Trust can be a dangerous thing.

## Helpful Humans

In the 1990s, Kevin Mitnick was the ultimate cybercrime bogeyman. He won his notoriety by breaking into some of the most powerful technology and telecommunications companies in the world. His misadventures were front-page news and even inspired two feature-length movies (one documentary, another dramatic).

Now, Mitnick is a legitimate cybersecurity professional and author. Through talks, articles, and books, he warns about the risks posed by social engineering attacks, giving examples from his own criminal past.

Many of his tales describe interactions with relatively low-level employees at the target company. He would build a rapport with the worker and gather information, which he would later use to achieve his larger goals.

In one example, detailed in his book [Ghost in the Wires](https://www.amazon.com/Ghost-Wires-Adventures-Worlds-Wanted/dp/0316037729), Mitnick sought to access the phone records of a friend he suspected of working for the FBI. He repeatedly called the phone provider, each time building a rapport with the employee and teasing out details relating to the account. Once he gathered enough information, he convinced the provider to fax the target’s previous invoice, claiming he needed it to rebuild his phone book.

Mitnick was successful because the employees didn’t question whether he was the real account holder. They weren’t motivated by data security, but rather customer happiness. They simply weren’t suspicious. He would successfully re-use these tactics again and again, before the FBI brought his criminal career to an abrupt end in 1995.

Twenty-five years earlier, a group of Anti-Vietnam War activists used a similar approach when breaking into a Delaware draft office. The group had already penetrated several military offices, as they sought to frustrate the recruitment of new soldiers into the highly unpopular war. They were seasoned burglars.

This Delaware office, however, proved a challenge. It was protected by an advanced, heavy duty door. Their usual tools — crowbars and lock picks — were useless here. And so, they had to think outside the box.

During the daytime, the office’s door was unlocked. A member of the group crept in and left a note behind. It read: “Please don’t lock this door tonight.”

It was simple. Obvious, even. And it worked. The group later returned under the cover of darkness. They approached the door and twisted its handle. It opened with a satisfying click. They gathered the documents they came for and left. In 2014, after the statute of limitations expired, the group would tell their tale to veteran Washington Post journalist Betty Medsger.

No doubt, the draft office was staffed by seasoned military servicemen. They understood risk, and no doubt knew of the widespread opposition to the Vietnam war. And yet, this experience was overridden by their desire to be helpful, and to comply with the request of a colleague or superior. They trusted the note’s provenance, and didn’t think to consider that it may have been left by an adversary.

## Why Social Engineering Works

The term “social engineering” sounds deceptively modern. In reality, it could be used to describe the kind of subterfuge used by criminals and military leaders throughout history.

You can draw parallels between the approaches detailed in Chris Hadnagy’s book [Human Hacking](https://www.amazon.com/Human-Hacking-Friends-Influence-People/dp/0063001780), which focuses on their application in legitimate offensive security procedures, and those used by convicted fraudster Frank Abagnale, as described in his book [Catch Me If You Can](https://www.amazon.com/s?k=catch+me+if+you+can+book&gclid=Cj0KCQjwwNWKBhDAARIsAJ8HkhcNRSvRdVegZPvCiI176SCZvOnGn3rDQGLMGOoA039SYYck0AfzRFAaAtWEEALw_wcB&hvadid=409998390125&hvdev=c&hvlocphy=9033339&hvnetw=g&hvqmt=e&hvrand=1184131583828329460&hvtargid=kwd-421448854&hydadcr=24630_11410023&tag=googhydr-20&ref=pd_sl_7yubf00gv6_e). The basic concepts are the same, with the only real point of differentiation being how they’re used.

Complicating matters, it’s now possible to perform social engineering attacks at scale. Through phishing (as well as its evil siblings, Smishing, or SMS phishing, and Vishing, or phishing via voice), a bad actor can reach millions in a matter of moments.

In 2020, the FBI received 231,000 reports of phishing attacks — or double that previous year’s figure. The real figure is almost certainly significantly higher, with most attempts unreported to the bureau. It affects non-profit organizations, businesses, and individuals, albeit to varying levels, and the costs can measure in the millions.

Earlier this year, US authorities sentenced the ringleader of a Business Email Compromise (BEC) scam to ten years in prison. The man, Obinwanne Okeke, stole $11m from companies in the construction industry by issuing fake invoices with the funds directed to foreign bank accounts.

Looking further back, in May 2000, Filipino malware developer Onel De Guzman caused an estimated $5.5bn to $8.7bn in damages, after he released a self-propagating worm masquerading as a love letter. The ILOVEYOU worm sought to steal dial-up internet credentials, and inadvertently took down the mail services of the UK parliament, Microsoft, and the US Department of defense.

> Here’s the good news: You can take steps to mitigate the risk social engineering poses to your organization.

Technical measures, as recommended by the US Computer Emergency Response Team (US-CERT), include the use of multi-factor authentication (MFA), email filtering, and firewalls. It helps to stay abreast of recent developments, and the Anti-Phishing Working Group provides helpful information about new threat actors and trends.

Training also plays an important role. It’s possible your colleagues are unaware that social engineering exists. Teach them about the tactics used and the importance of verifying the identities and details of those they interact with, along with your organization’s phishing reporting procedures. If you don’t have one, make a point to create one, even if it’s something as simple as a dedicated inbox, where employees can forward suspicious communications.

Finally, creating a culture of transparency and collaboration is important. Your colleagues should feel able to report security issues without fear or judgment.

"Our innate human traits make us vulnerable to social engineering attacks, and always will. The best and most scalable defense is to create a strong security culture, both within organizations and across society at large. When we empower people to detect and respond to these attacks, we build a more secure Internet for all," said Annybell Villarroel, Security Awareness and Culture Manager. To find out how Auth0 can meet your organization’s identity needs, click here.

How Social Engineering Has (And Hasn’t) Evolved Over Time

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

How to safeguard yourself and your company against phishing attacks on identity

Do you remember the last time you fell or almost fell for a phishing email? I do.

I received an email on my phone, apparently from an Amazon.com email address, that said, “Unlock your Amazon account.” Although this was unexpected, it was feasible because I had made a purchase on Amazon recently and had changed settings that could have locked the account.

Concerned, I opened the email.

The design matched Amazon’s style, there were no typos, and my phone’s email app interface showed me just the sender’s name rather than their email. I inspected the link the email asked me to click and noticed it was fake.

It was one of the best phishing emails I’ve received recently. It managed to make me feel concerned while reading it. That’s the key.

Phishing is both simple to implement and effective. It’s a relatively low-effort attack that can have a high reward. According to Verizon’s [2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/dbir/), attackers used phishing in 22% of the investigated breaches. The quality of the attacks varies from the obviously fake to sophisticated spearphishing campaigns that are fully customized.

The most effective phishing emails are typically those that tap into strong emotions that drive action. In _Thinking, Fast and Slow_, Daniel Kahneman, Nobel Laureate in Economics, proposed that humans have two modes of thought: “System 1,” which is fast, instinctive, emotional, and “System 2,” which is slower, more deliberative, and more logical. Humans feel before we think. We are emotional beings. That’s why phishing attacks that appeal to our emotions (anxiety, fear) are more effective. 

## Phishing Attack Goals 

Phishing attacks tend to have three main goals:

### Credential theft

Credential theft typically involves a link that sends the user to a fake look-alike website that requests credentials to login.

If the account is not properly secured with methods like [multi-factor authentication (MFA)](https://auth0.com/docs/mfa), the credentials obtained could result in an account takeover. The compromised account could then be used to access internal systems, which could cause a data breach that could have compliance-related consequences under data privacy laws such as the [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA).

### Business email compromise

This kind of attack involves impersonating an executive to trick someone into transferring funds or buying gift cards. This could have a high financial cost to the organization if it succeeds.

### Malware delivery

Malware delivery usually involves downloading an infected document or app that can cause a high-impact disruption, like what happened with the [2017 WannaCry ransomware attack](https://www.malwarebytes.com/ransomware/).

## Preventative Measures

The following measures can help you protect yourself, your employees, and your users from phishing attacks:

### Security awareness

Empowering users to detect and report phishing attacks helps protect the organization no matter the type of phishing. It also helps the security team react faster, thanks to their reports. We’re providing a free user awareness guide to help you raise awareness internally, and we’ve released some of our internal phishing training in our YouTube channel voiced by someone you would not expect. 😉

### Multi-factor authentication (MFA)

MFA protects your employees from an account takeover in the event of credential theft. Implementing and rolling it out is very easy with Auth0.

### Endpoint protection

Antivirus solutions can protect your employees in the event of malware. There are plenty of options for the enterprise, so choosing one that fits your organization and culture will boost your defenses with minimal disruption.

### Verification processes for payments and invoices

Establish an internal verification process that requires multiple people to approve a payment or expense before wiring the money, and define specific methods to do so (e.g., no gift cards).

On top of all of this, it’s key that users have an easy way to report these attacks to your IT or security team, such as a dedicated corporate email address, and that the team can efficiently respond to these reports.

## A Constant, Evolving Threat

Phishing is an ever-evolving threat that’s constantly present for most companies across all industries, as well as most end-users. Whether it’s generic bait or a message adapted to the circumstances of the moment, phishing can happen at any time to any company or any user. Rather than being overwhelmed by the challenge, training employees, creating and sharing clear processes, and enabling measures like enforced MFA can be the difference between a bad data breach and creating a resilient organization with the ability to adapt in an evolving threat landscape.

To learn more about how to protect your valuable data from attack, explore [Auth0 Resources](https://auth0.com/resources/).

<include src="asides/AboutAuth0" />

Protecting Against Phishing Attacks

Join us for Avocado Lab talks, advice on setting up your own bug bounty program, and learn a bit about what we're doing to improve our cybersecurity stance

Building and maintaining a security culture where employees make secure decisions, trust and collaborate effectively with the security team, and feel empowered rather than afraid is key to being a trusted brand that makes the internet safer. Each October, National Cybersecurity Awareness month gives us an opportunity to celebrate that effort.

At Auth0, we focus tremendous efforts on both our organizational culture and our security culture, since Security is at the core of what we do, and trust is one of our key principles. Throughout the year, we provide training tailored to each of our audiences, run multiple engagement programs, as well as context-specific awareness campaigns. So we can't miss the opportunity of celebrating October National Cybersecurity Awareness Month both internally and externally.

This year Auth0 is hosting several events for the community:

* [Avocado Labs](https://avocadolabs.dev/) Online Talks: 
 * [Look! There's a threat model in my DevOps](http://avocadolabs.dev/events/avocado-labs-episode-13/). Alyssa Miller, Application Security Advocate - Snyk
 * [Trust: From Zero to Hero](http://avocadolabs.dev/events/avocado-labs-episode-12/), Annybell Villarroel, Security Culture Manager - Auth0
* Social media content highlighting those who keep us safe, those who create the tools and features we need, those who make it safer for us.
* Content on the Death of the Corporate Network from Senior Director of Engineering Duncan Godfrey, securing Node.JS Senior Manager, Product Security Marcin Hoppe, advice from CSO Joan Pepin on setting up your own bug bounty program, and a guide to treating identity as the perimeter from Cybersecurity Researcher Kim Berry. 

For our employees, we will have internal challenges and experts from our Security team as well as industry-leading guests will provide talks focused on a wide range of topics:

* **OWASP Top 10:** Jim Manico (@manicode), Founder & Secure Coding Instructor at Manicode Security, will come to give us a remote training session on OWASP Top 10
* **Hacker mindset and Burp Suite Training:** Katie Paxton-Fear (@insiderPhD), Ph.D. Student, Occasional Bug Bounty hunter & Educational CyberSecurity YouTuber, will teach us how to think like a hacker and how to use Burp Suite.
* **Internal Bug Hunt Challenge:** to encourage employees to safely find vulnerabilities in Auth0. High or Critical severity findings get added to our internal Hall of Fame, receive swag prizes, and get company wide recognition.
* **Security Demo Day:** this session walks employees through a vulnerability found in the platform and showcases discovery, exploitation, and remediation.
* **Phishing Challenge:** we run phishing campaigns on a regular basis. Now, we are reversing the roles, and employees will have the chance to phish our Security Culture Manager, who will also explain to them how to do it safely.
* **InfoSec Career Panel:** the path to infosec is varied within our team; in these sessions, we will talk about personal experiences, learning paths, skills requirements, and we will have a Q&A session.

At the end of the month, all employees that complete a series of goals will participate in a raffle for prizes.

At Auth0, we are passionate about providing secure access to everyone but not just anyone, and we believe that empowering our employees to have a strong security mindset in their personal and professional lives is key to achieve this goal.

We invite you to come to celebrate with us through our external events. Happy National Security Awareness Month! 

<include src="asides/AboutAuth0" />

National Cybersecurity Awareness Month (NCSAM) at Auth0

Our security best practices checklist will help you, and the kids you know, stay safe online.



Today, it’s hard to think about a part of our lives that’s not connected to the internet in one way or another. Work, relationships, entertainment, growth, finances, health, home appliances, cars. They all can have an **online component**.

But the online world is a hard thing to perceive. We can’t quite touch it. We can only experience it through a screen, headphones, or a microphone. So the associated risks and consequences sometimes may not seem as real and bad as a hurricane, an armed theft, or as cutting a finger while cooking. But *are they*? 

Yes, they are!

But it also depends on you, and your “threat model”, which is just a fancy (and possibly intimidating) word to sum up the answers to these six questions:

* What are my assets? 
* Who are my adversaries?
* What can my adversary do?
* How likely is it that I will have to protect my assets?
* How bad are the consequences if I fail?
* What can I do to defend myself against my adversaries?

The questions also sound a bit intimidating, but it’s just about listing what you value, who can hurt you, how, what are the odds of being affected, what the consequences could be and what are your defenses. It works for online and offline risk.

Since so much of our lives are online today, we all have **valuable assets on the web**. Our online identity, our private identifiable information (name, birthdate, home address, phone number, email accounts), our social media, credit card numbers, pictures, work data. We all have information to protect, and we all have a responsibility to protect it too, [_including children_](https://auth0.com/blog/auth0-cybersafe-camp/).

![Auth0 family security](https://images.ctfassets.net/23aumh6u8s0i/4VW4wTpm0aesOHQS6GZJiu/071af53dace08a20a87351ce43a5554d/auth0-personal-security)

And since there have been so many [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) up until now, we all have adversaries. All the data that has been breached is up for sale for a cheap price on the dark web, and it could be used against us in different ways. Depending on who we are and what we do, we may be an interesting target as well. 

In general, the consequences of an attack can be tremendously hurtful. Identity theft, ransom, data or financial loss, cyberstalking, and even physical damage. 

Now, we can all get ready and protect ourselves, and that is what **October National Cybersecurity Awareness Month** is about. A yearly effort aimed at helping you stay safe online. 

At Auth0 we care very deeply about cybersecurity, and we want to help make the internet safer. Not only by [_increasing the security of your business_](https://auth0.com/blog/how-auth0-makes-your-apps-more-secure/) through our platform, by helping you enable password policies, anomaly detection, and MFA quickly, and by protecting the credentials of your users which helps prevent data breaches. But also by spreading awareness about cybersecurity, and partnering up with the [_US government_](https://www.dhs.gov/national-cyber-security-awareness-month), the [_EU_](https://cybersecuritymonth.eu/), and [_Australia_](https://www.staysmartonline.gov.au/get-involved/stay-smart-online-week) during October National Cybersecurity Awareness Month.

So we have prepared an **easy checklist** to help you, and the kids you know, stay safe online. Download the [Personal Cybersecurity Checklist](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist)!

We believe in making cybersecurity accessible for everyone, so we’ve translated it to **9 languages** with the help of Auziros from all over the world. 

Follow us on [_Twitter_](https://twitter.com/auth0), where we’ll be sharing 31 days of tips and best practices, and also come talk to us in [_our online meetup_](https://www.meetup.com/Auth0-Online-Meetup/), [_Seattle_](https://www.meetup.com/Seattle-Identity-and-Security-Meetup/), [_London_](https://www.meetup.com/London-Identity-and-Security-Meetup/), and [_Hamburg_](https://cybersecmonth-hamburg.de/). 

Cybersecurity is everyone’s responsibility. We all have to Own It. Secure It. Protect it, so we can stay safe online.


Personal Information Security Checklist for Family and Friends

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Join us for global events promoting cybersecurity awareness and education

**BELLEVUE, Wash. -- October 1, 2019 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced a series of global events and meetups in support of [National Cybersecurity Awareness Month (NCSAM)](https://www.dhs.gov/national-cyber-security-awareness-month). During October, Auth0 joins government and industry organizations around the world in educating the public about cybersecurity best practices and how to stay safe online.

Originally created by the U.S. Department of Homeland Security and National Cyber Security Alliance, NCSAM has grown into a global initiative supported by the [EU](https://cybersecuritymonth.eu/) and [Australia](https://www.staysmartonline.gov.au/get-involved/stay-smart-online-week). This year's campaign — Own IT. Secure IT. Protect IT. — encourages personal accountability and proactive behavior to enhance cybersecurity at home and in the workplace; and focuses on issues like citizen privacy, consumer devices, and eCommerce security.

NCSAM named Auth0 a [2019 Champion Organization](https://staysafeonline.org/ncsam/champions/view-all/) dedicated to promoting a safer, more secure and more trusted internet. Auth0 activities in support of this year's campaign include:

## Online meetups. Read more and register at [Auth0 Online Meetups](https://www.meetup.com/Auth0-Online-Meetup/).

- **October NCSAM Kickoff & Hacking JWTs** with Annybell Villarroel, security awareness manager at Auth0 and Joel Lord, developer advocate at Red Hat for the OpenShift Platform

- **Gotta Catch'em All - Bug Bounty!** with Chloe Messadhi, VP of strategy at Point3 Security

- **Prioritizing Trust while Creating Applications** with Jennifer Davis, cloud advocate at Microsoft

- **Security in 2019** with Eugenio Pace, CEO and co-founder and Joan Pepin, CISO and VP of operations at Auth0

- **The State of Crypto in Node.js** with Ujjwal Sharma, apprentice compiler engineer at Igalia and core team member at Node.js

## In-person events. Read more and register below.

- **Women Who Code Workshop** with Eva Sarafianou, product security engineer at Auth0. Tuesday, Oct. 15 at Auth0's Bellevue Office [Learn more and register](https://www.meetup.com/Women-Who-Code-Seattle/events/265429291/).

- **Cybersecurity Awareness Meetup 2019** in [Hamburg](https://www.meetup.com/Hamburg-Cybersecurity-Awareness-Month-2019/events/264612206/), [London](https://www.meetup.com/London-Identity-and-Security-Meetup/), and [Seattle](https://www.meetup.com/Seattle-Identity-and-Security-Meetup/).

## Free Downloadable Content

- **Personal Cybersecurity Checklist** Learn how you and your loved ones can [stay safe online](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist).

- **Credential Stuffing Attacks Whitepaper** Learn about [credential stuffing attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) and how to combat them.


To get involved with National Cybersecurity Awareness Month, visit the [NICCS NCSAM website](https://niccs.us-cert.gov/national-cybersecurity-awareness-month-2019) and follow the updates on Twitter #BeCyberSmart.

<include src="asides/AboutAuth0" />

### Media Contacts:

Meghan Gardner 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com) 

Mark Fowler 
Racepoint Global for Auth0, EMEA 
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com) 
+44 (0) 77 1124 4113

"ncsam"