Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

Let’s walk through how to select an Auth0 pricing plan.


<AmpContent>
<amp-youtube
    data-videoid="3hBeyJWKrsE"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/3hBeyJWKrsE' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>


Auth0 offers customizable [pricing](http://auth0.com/pricing) plans, which means you can select a plan based off of the features that you really care about. Let’s walk through how to select the right plan and how to upgrade your plan:

1. Head to [auth0.com/pricing](https://auth0.com/pricing)
2. Select your use case: B2B or B2C
3. For details, scroll down to “Compare Plans”

As a reminder, we've upgraded our Free plan which now offers Unlimited* Social and Okta Connections, 1 Custom Domain, and up to 25,000 MAUs. [Here are all of the changes to the Free plan](https://auth0.com/auth0-vs-auth0), as of Sep 24, 2024. Please note that the Free plan is limited to 1 tenant.

## Selecting a Use Case

Let’s dive into the use cases. If you’re not sure about whether your product falls into the B2B or B2C plans, think of your end-users:

* Apps built for individual consumers would be considered B2C (like your favorite social media app)
* Apps built for things like cross-team collaboration or HR management - where the users are part of a team or organization - would be considered B2B (like your team’s project management app)

Auth0’s B2B plans include features on top of the B2C plans, so if your application caters to both individual consumers and businesses, you would select B2B.

![Selecting a Use Case](https://images.ctfassets.net/23aumh6u8s0i/4g5QLbJs1gcx37ZcssngQK/6678518d7acba80d0aed59936e554c3a/01_plans.png)

## Evaluating Features

Under "Compare Plans", you can see a feature comparison table and click on the various drop-downs to view the comprehensive list of features. Review which features you are currently using or plan to use. You can hover over or click on the features to learn more about them.

## Checking Feature Usage

To check which features you’re currently using, you can refer to the [Quota Utilization](https://support.auth0.com/reports/quota) page on [Auth0 Support Center](http://support.auth0.com/reports/quota) and select a tenant.

![Checking Feature Usage 1](https://images.ctfassets.net/23aumh6u8s0i/32PNFKAe8dpNk8JC8rm2Eb/05407f4fe6902cfce2d2303ca64e6804/02_plans.png)

![Checking Feature Usage 2](https://images.ctfassets.net/23aumh6u8s0i/F1G7QGQ1bdQrxl7jVOlEW/6e9b3bd487db5599ee0fa07ae125edd6/03_plans.png)

## Upgrading to a Paid Plan

You can start with any plan and upgrade when your usage increases. To select a plan, head over to your Settings in the [Auth0 Dashboard](https://manage.auth0.com/dashboard) and open the Subscriptions tab. There you can add your payment details and select your plan of choice.

Depending on your case and needs, you can make additional adjustments to certain plans:

- B2C Professional: number of M2M tokens

B2B Professional: number of M2M tokens and number of Enterprise ConnectionsDepending on your case and needs, you can make additional adjustments to certain plans:

- B2C Professional: number of M2M tokens
- B2B Professional: number of M2M tokens and number of Enterprise Connections


When you upgrade your account to a paid plan, you will be moved to the [Auth0 Teams](https://auth0.com/docs/get-started/auth0-teams) configuration, in which multiple tenants are nested under one subscription. If you see tenants are missing from your subscription, you can [link them by following these steps](https://auth0.com/docs/get-started/auth0-teams/tenant-management#link-tenants).

If you decide to upgrade to the Enterprise plan or want to chat with someone before making a decision, you can reach out to our Sales team.

![Connections](https://images.ctfassets.net/23aumh6u8s0i/3xDiH737J9MTCLRsRNWQx9/67015aae85d1a88c3739548c81efd6d9/04_plans.png)

Comparing Different Plans from Auth0

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

We’ve leveled up our Free, Essential, and Professional plans.

Auth0’s vision is to free any consumer or SaaS application user to safely use any technology. This means giving developers the products that make building, deploying, and scaling applications easy. In the last few years, we’ve added more capabilities that allow developers to battle malicious attacks and attackers. 

Today, we’re excited to announce the expansion of the [Auth0 free tier and pricing plans](https://auth0.com/pricing). This makes it even easier for developers to defend against increasingly sophisticated attacks on their customers’ identities and build the next generation of applications securely and reliably.

**TL;DR:**

* Our free plan now includes:

    * 25,000 MAUs so you can scale.
    * Unlimited[^1] Okta Connections & Unlimited[^1] Social Connections so users can easily access your app. 
    * A [custom domain](https://auth0.com/docs/customize/custom-domains) so you can fully brand your authentication.
    * [And more](#Here-s-All-the-Changes-on-Our-New-Free-Plan)...
<br><br>
* Our paid plans now include:

    * 10 [Organizations](https://auth0.com/docs/manage-users/organizations) on B2C Plans and Unlimited[^1] on B2B Plans so you can better manage your customers and partners.
    * Increased MFA offerings so you can mitigate the growing threat of AI-based attacks.
    * The ability to get up to 15 Enterprise Connections in B2B Pro via add-ons, so you get more seamless integration across apps.
    * [And more](#We-ve-Also-Got-You-Covered-as-You-Grow-Your-Applications-and-Customers)...

## Here’s All the Changes on Our New Free Plan

On the new Free Plan, we’ve increased the number of MAUs from 7,500 to 25,000. In addition, you now have unlimited[^1] social and Okta connections. You are also now able to add Organizations and Passwordless authentication to your apps, alongside configuring your own domain. With these updates, you can now scale your app to a larger audience with higher MAUs, enhance your brand identity with your own custom domain, and implement even more social features for your users, all while enabling your users' data to remain secure.

![Here’s All the Changes on Our New Free Plan](https://images.ctfassets.net/23aumh6u8s0i/1OpEw7tXFInO8kmgfqLwFh/16d9c3d29fbfb0278072c57c95f10bb5/01_free_plan.jpg)

## We’ve Also Got You Covered as You Grow Your Applications and Customers

Our new Essentials and Professional Plans have also expanded to help you scale and embed security in your app. Organizations are now included in every plan. Unlimited[^1] Okta connections are now included in all B2C and B2B plans. B2B Pro plans include 5 Enterprise Connections, plus you can add up to a total of 15. Both B2B and B2C Essential plans include custom signup/login. We’ve also increased MFA offerings: both Essentials plans now include Pro MFA, and our Pro plans now include [Enterprise MFA](https://auth0.com/docs/secure/multi-factor-authentication). These updates enable you to have robust security, easily integrate applications with the Okta Workforce Identity Cloud, and better manage your users.

Below are the changes to our paid plans:

![B2C Essential](https://images.ctfassets.net/23aumh6u8s0i/15nIH8v8tJu0fxAi9oa6Du/50151607f231ff7d9392cc5e11488bc2/02_b2c_essentials.jpg)

![B2C Essential](https://images.ctfassets.net/23aumh6u8s0i/4fG78P0kTpiiOiZQRdJ1KN/6871f5467f2845c5bfa85ee4208a997e/03_b2c_essentials_2.jpg)

## Bringing It All Back to You

We hope that these changes make it easier to build, deploy, and scale your app at your pace with the tools you need. If you’re an early-stage company, check your eligibility for our [Auth0 for Startups program](https://auth0.com/startups). We are also proud to offer [preferential pricing for nonprofits](https://auth0.com/nonprofits)—making the leading Identity service even more accessible.

Happy building.

Auth0 now; thank yourself later.

## FAQ:

* **When will the new self-service plans be available?**    
    * All plan updates listed here are available as of September 24th, 2024! Start your free trial [here](https://auth0.com/signup) today.

* **Where can I learn more about this?**    
    * Please visit our [pricing page](https://auth0.com/pricing) to learn more about our plan offerings. Our updated Terms of Service can be found [here](https://www.okta.com/auth0-pss-self-service/).

* **As an existing customer, how do I get access to the new features?**    
    * If you're on a free plan, your entitlements will be automatically applied. If you're on an Enterprise contract, please reach out to your Auth0 account team and they will walk you through your changes.

* **What if I have multiple tenants on separate plans?**    
    * Tenants will need to be grouped via [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard).

* **What kind of support is available with these plans?**<br>
Don't worry, we've got your back in the same places you've come to expect.
    * Free plan: please reach out for support on the [Auth0 Community](https://community.auth0.com/).
    * Paid plans: please submit a ticket via the [Auth0 Support Center](https://support.auth0.com/).

* **Why do I need to add my credit card details when adding a custom domain on the free plan?**
    * While a credit card is not required to use the free plan, you will have to add one in order to add a custom domain, purely for validation purposes to prove you are human. If you do enter your credit card information to add a custom domain, rest assured you will never be charged.

* **I’m an existing customer, but not on a B2C or B2B plan. How can I take advantage of the new plans?**
    * You will need to change to a new plan under subscriptions settings in your dashboard, whether you choose to move to the Free Plan or one of our Paid Plans.  

[^1]: _subject to system limitations_

Level Up: Auth0 Plans Just Got an Upgrade

After your startup plan expires, here’s what to keep in mind and what to do next.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>This blog post is intended for graduates of our Auth0 for Startups program. If you’re interested in learning more about this program or want to apply, check your eligibility <a href="https://auth0.com/startups">here </a>.</b><br> 
</div>

We’re excited to see you graduate from the Startup plan! Let’s walk through everything you need to know as you transition onto a new plan.

## Two Months before Your Plan Expires

You’ll receive an email from the Auth0 for Startups team including your “startup plan's expiration date” and next steps (which we’ll get into shortly).

## Before Your Plan Expires

Before your plan expires, you should select which plan you want to switch to. You can base this decision on your current usage found on the [Quota Utilization](https://support.auth0.com/reports/quota) page. To check all of the pricing options, head to the [Pricing Page](https://auth0.com/pricing).

![Before Your Plan Expires](https://images.ctfassets.net/23aumh6u8s0i/18kybUkM3nW903QCpdWbN6/4143e7d1f5c4c6ffd78d33bce58de46d/01_startup.png)

## When Your Plan Expires

On the day that your plan expires, you will be automatically transferred over to the [Free plan](https://auth0.com/pricing). **This transition should not disrupt your current setup or your customer’s login experience, but please review the FAQs below if you have any questions.** You will receive a notification of your plan expiration, at which point you can move onto the selected plan.

On or after 10AM Pacific time you'll be able to upgrade to the Auth0 plan of your choice via the [Manage Subscriptions](https://auth0.com/docs/troubleshoot/customer-support/manage-subscriptions) page. We strongly recommend that you upgrade within 48 hours to ensure a smooth transition.

If you decide to stay on the Free plan, just keep in mind that it might not include all of the features you’re currently using. Please review the [FAQs](#FAQs) below for more details.

## After Your Plan Expires

After your plan expires, you can activate your selected plan within your [Auth0 Dashboard](https://manage.auth0.com/dashboard) Settings in the Subscriptions tab. If you have multiple tenants, [follow these instructions to link your tenants to your plan](https://auth0.com/docs/get-started/auth0-teams/tenant-management#link-tenants).

![After Your Plan Expires](https://images.ctfassets.net/23aumh6u8s0i/318FjDzCm5pgPX0IV3Bcz/69a86f0c67bb5b5df8039c82ced19126/02_startup.png)

We’re here to support you so let us know if you have any questions! Or to learn more about the pricing plans, reach out to our Sales team [here](https://auth0.com/contact-us).

## FAQs

**Can I move onto a paid self-service plan before my startup plan’s expiration?**

We ask that you wait until 10AM Pacific time on your startup plan’s expiration date before moving onto a paid self-service plan, as our team has to move you off the startup plan before you can make changes yourself. 

**Which plan should I choose?**

* We’ve put together [this guide](https://auth0.com/blog/comparing-different-plans-from-auth0-by-okta/) for comparing Auth0’s various plan options.
* If you are using more than 1,000 M2M tokens each month, we recommend upgrading to a paid plan with a higher quota before hitting the 1,000 M2M token limit that is systematically limited on the Free plan. Not sure what your current M2M usage is? [Here are instructions](https://auth0.com/docs/troubleshoot/customer-support/manage-subscriptions/monitor-subscription-usage) on how to access this information.

**Why can’t I change the type of my plan on the Subscription Management page?**

If your subscription type is listed as “Enterprise Agreement” on the Subscription Management page, you’ll need to wait until we move you off the startup plan before being able to select a new plan. 

**How will transitioning off the startup plan affect my Auth0 tenant?**

* The transition from the startup plan to the Free plan should not cause any disruption in service for your users. However, there are a few changes worth noting:
* If you’re using features that aren’t included with the free plan (e.g., Pro MFA) or exceeding the quotas offered with the free plan (e.g., Monthly Active Users), your tenant will be considered over quota. To resolve this, upgrade to a paid plan that best suits your use case and business needs;
* The Free plan adds a small watermark with the Auth0 badge on the bottom of your login page, which will be removed as soon as you move to a paid plan;
* The Free plan will prevent you from modifying certain features that were available on the startup plan (e.g., Custom Domains, Session Lifetime Limits), but those features will continue functioning on the Free plan, and you will be able to modify them again as soon as you move to a paid plan that includes them.

What to Expect When Your Auth0 Startup Plan Expires?

auth0_by_okta_hero copy

Auth0 Team

Offering expanded access and optionality for self-service plans and features

**TLDR**: 
Self-service customers have access to Auth0 capabilities that previously required a call with sales. Effective immediately: (1) customers can now upgrade to our B2B Professional Plan directly through the dashboard, (2) the Enterprise Connection limit in the B2B Pro plan has been increased from 3 to 5, and (3) Pro plans customers can now add a single Enterprise MFA factor (called 'Enterprise MFA Lite') via self-service.

In November 2023, we introduced [updated self-service plans and pricing](https://auth0.com/blog/upcoming-pricing-changes-for-the-customer-identity-cloud/) to scale with our customers. As a continuation of this work and based on your feedback, we now offer self-service customers easier access to plans and capabilities that previously required a discussion with sales.

### Here’s what’s new, effective May 2024:

* You can now choose our [B2B Professional Plan](https://auth0.com/pricing) using your dashboard! The B2B Pro Plan includes: 
    * 5,000 M2M Authentications (more available as add-ons)
    * M2M Add-on
    * External Database
    * Cross App SSO
    * 5 Enterprise Connections (increased from 3)
    * 100 organizations
    * And other features included in the B2B Essentials plan.

    _To upgrade: [Dashboard > Settings (Subscription Tab)](https://manage.auth0.com/#/tenant/billing/subscription) > Select Plan & Quota > Click Upgrade or you can continue to purchase this plan through our Sales team._

* **5 Enterprise Connections** for the B2B Professional Plan's Enterprise Connection limits have increased from 3 connections to 5 connections via self-service. This will allow more of our SaaS customers to scale more effectively. As a reminder, there is no limit on [Okta Enterprise Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta) for customers on all of our B2B plans.
* **Enterprise MFA Lite** is now available through self-service for both B2C and B2B Professional. This capability was only available via a contract with Sales, but it can now be added via the dashboard.
    * Enterprise MFA Lite allows you to add either SMS, push, or voice notifications to Professional plans for an additional fee. Fees vary by the amount of MAUs; find more information on [Dashboard > Settings (Subscription Tab.)](https://manage.auth0.com/#/tenant/billing/subscription)
    * This includes the support of push, [SMS, and voice notifications](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa), (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. 

### MFA Offerings Explained

MFA ([Multi-Factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/)) provides a method to verify a user's identity by requiring them to provide more than one piece of identifying information. For example, **something you know**: a password, PIN, or security question, **something you have**: a smartphone, security token, or smart card, or **something you are**: your fingerprint, face scan, or voice pattern.

Some of our MFA offerings include: 

* **Pro MFA** &mdash; included in B2C Professional, B2B Essentials, B2B Professional, and Enterprise plans 
* **Enterprise MFA Lite Add-on** &mdash; an add-on for B2B and B2C Professional plans and Enterprise plans
* **Enterprise MFA** &mdash; included in our Enterprise Plans 

![Pro Plan Improvements for Self-Service Customers - May 2024](https://images.ctfassets.net/23aumh6u8s0i/sTrHbEBf42kTVlbfp6mRt/2459de4604259c2031a9808dd2111efa/MFA_Table.png)

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b> Please note that upgrading to B2B Professional and adding Enterprise MFA Lite to B2B and B2C Professional plans will incur additional fees. Visit our <a href="https://auth0.com/pricing">pricing page</a> for more information.</b><br> 
</div>

### Which MFA factor(s) are best for my product?

Choosing the right [MFA factor](https://auth0.com/docs/secure/multi-factor-authentication#mfa-factors) is all about striking a balance between security and user experience. Consider the sensitivity of the accounts you're protecting, the technical comfort level of your users, and the accessibility of the MFA factor across different devices. 

![Not All MFA is Created Equal](https://images.ctfassets.net/23aumh6u8s0i/5TgjqFrUJwTDkldGCqov7o/6d80ca9d9c0d29faebea01578a02e0b6/Not_All_MFA_is_Created_Equal.png "Not All MFA is Created Equal")
<p align="center"><i>From blog post: <a href="https://auth0.com/blog/not-all-mfa-is-created-equal/">Not All MFA is Created Equal</a></i></p>

<p align="left"</p>
To help evaluate our MFA offerings, visit this [blog post](https://auth0.com/blog/not-all-mfa-is-created-equal/) to learn about your options and for more details on factor types and authentication assurance levels, check out [this datasheet](https://www.okta.com/resources/datasheet-factor-assurance/).

### Have more questions about your plan or our MFA offerings?

We’re here to help! If you’re on a paid plan, our [Support team](https://support.auth0.com/) can help, and if you’re on a free plan, you can post in our [Community forum](https://community.auth0.com/). Thanks for being a valued customer. We hope this allows for more flexibility and optionality during your auth journey. Happy authenticating!

Pro Plan Improvements for Self-Service Customers - May 2024

michael-swanson

I live in Austin, TX with my wife, Anneke, and our two kiddos, Ilya (5) and Everett (2). I am a native Texan but lived in multiple places across the southern US as a kid. I have family in Houston TX and Midland TX that we visit on a regular basis. Prior to joining Okta, I worked with early stage startups as a hands-on Product Manager, team lead, and product designer, while also writing (mostly frontend) code. 
<br>

When I am not working you can usually find me chasing my kids around, reading sci-fi or fantasy novels, or playing needlessly complex strategy board games with friends. I am also a huge Star Wars fan and am always down to talk about the latest Star Wars movies, TV, and/or books. Additionally, Anneke and I love to travel and have been all over the world together. Much of our travel focuses on getting out of the Texas heat, tasting and learning about wine, and sampling the amazing food we find along the way!


Senior Product Manager

Michael Swanson

Customers and trial customers on Enterprise and Professional plans can now customize signup and login flows to address unique needs.

Each company has unique user registration and login requirements, for example, needing to capture a first and last name during signup or requiring users to agree to terms and conditions before they can create an account. 

In order to meet specific business needs and use cases, companies often have to build and maintain different experiences – hosted pages and sites – within their account registration and login flow(s). Unfortunately, this approach slows down the time to market by introducing separate code bases that require localization and maintenance while also creating an inconsistent customer experience.

To solve this problem, we have introduced custom prompts for signing up and logging in to Universal Login. This capability is now open for early access (EA) and available to our customers and trial customers on Enterprise and Professional plans. 

## Addressing Unique Use Cases

With custom prompts for signup and login, our customers can customize and add new fields to existing signup and login prompts; this includes client and server-side validation to ensure that required data and requirements, such as Terms of Service (TOS) acceptance, are completed and validated before completing the signup or login process. 

Leveraging Universal Login and our extensibility framework, our customers can tailor these two experiences to address data capture, security, regulatory, and customer experience requirements. Use cases included:

- Add new fields in order to collect necessary customer data (name, phone number, email, preferences, consent, etc.) 
- Add new form elements for presenting and capturing TOS/privacy policy and opt-in before sign up
- Add custom content such as URLs, images, marketing information
- Localize custom text in different languages

## Getting Started

During open early access, this feature will be automatically available to all of our Professional and Enterprise customers and trial accounts. To get started, please check out our documentation [here](https://auth0.com/docs/customize/universal-login-pages/customize-signup-and-login-prompts). If you have any questions, please reach out to your Account Executive.  

Before closing, I want to give a shout-out to our customers who provided feedback during the limited EA. We had over 75 customers join and received invaluable feedback. This underscores the importance of this capability, which we’ll continue to evolve and shape based on customer feedback, so please let us know how it goes.  


_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._


Customizations for Sign up and Login Now in Open Early Access

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager - Developer Experience & Analytics

Introducing updated self-service plans and pricing that scale with your company

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>UPDATE:</strong><br> 
  This information was modified on December 11th, 2023. The new plans and feature offerings are now universally available for everyone.<br> 
</div>

We're excited to share with you our updated and revamped plan offerings for Auth0, which powers Okta Customer Identity Cloud.

Effective November 1st, 2023 we launched changes to our plan offerings and pricing structure. Changes listed below:

* **Our free plan now supports up to 7,500 MAUs vs the previous 7,000.**
    * More than 65,000 active tenants enjoy this plan today.
    * Our always-free plan continues to offer social login, DB connection for securely storing identity information, branded login, extensibility and security capabilities (brute force and suspicious IP throttling), and support for 5 regions (US, UK, EU, JP, AUS). 
    * We also recently added [passkeys support](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) to the free plan.
* Our pricing structure has been updated to more predictably scale as you grow:
    * B2C Essentials pricing now starts at $35/Mo for 500 Monthly Active Users (MAUs)
    * B2B Essentials pricing now starts at $150/Mo for 500 MAUs
    * You can now purchase 20,000 MAUs on B2C Essentials with your credit card.
* [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard), a new feature that aggregates usage across all tenants for seamless oversight that includes updated tenant limits with the ability to consolidate tenants.
* The below capabilities that can be added to your plan through our “[Let’s Chat](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales)” form. You will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024:
    * New multi-factor authentication (MFA) add-ons, expanding access to MFA capabilities that were previously only available to enterprise customers.
    * Increased enterprise connection limits on the B2B Professional Plan.
    * We have increased our maximum MAU tier limit on our self-service plans.

> It’s important to note that we are not making changes to any existing plans as a result of this update. However, if you make changes to your subscription, the new plan and pricing structure will be applied.

## Pricing & Payment Updates

We last updated our Essentials and Professional plan pricing in May of 2021. With the above changes the following pricing updates became effective on November 1st, 2023. **Keep in mind, this only applies to new sign ups and any subscription changes.**

* B2C Essentials pricing will now start at $35/Mo for 500 MAU, up from $23/mo for 1,000 MAU. 
* B2B Essentials prices will now start at $150/Mo up from $130/Mo for 500 MAU
* B2C Professional prices will stay the same, starting at $240/Mo for 1,000 MAU
* B2B Professional will now only be available by invoice, via our sales team, rather than credit card. 

The price adjustment on B2C Essentials creates increased transparency and price predictability as your MAUs scale on our platform, reducing the risk of customers who grow from B2C Essentials into higher plans being shocked by a price change. While the scaling rate of B2C Essentials is increasing, we’re committed to enabling customers to stay on their chosen plan for longer by making it possible to remain on a self-service plan when surpassing the previous MAU limit of 10,000.

In addition to the above plans, check out the [Auth0 for Startups program](https://auth0.com/startups), our [Auth0 for Non-Profits](https://auth0.com/nonprofits) offers, as well as our always-free plan.

### Payment options

With the above changes, we are committed and will continue to support customers that want to pay us monthly through their credit cards on plan tiers that previously supported this functionality. We will now also allow customers with a yearly spend over $10,000 to contact our sales team to purchase an annual contract paid via invoice. 

Keep in mind, any new tenants created will be subject to the new pricing structure outlined above.

![Payment options](https://images.ctfassets.net/23aumh6u8s0i/7trs7tiGY0Ea5rQ2GmU0D3/952fb21eac9f2306c58d1a3e1bb4a14a/pricing-02.jpg)

`*` Can only be purchased by contacting our Sales team directly or via the ["Contact Sales"](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) form. Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.<br> 
`**` Previously, each tenant was a separate subscription, so only one tenant of any type was allowed per plan.

## Introducing Auth0 Teams:

We understand at times it’s difficult to manage resource access, keep track of and juggle multiple tenants. Auth0 Teams aggregates usage across all tenants for seamless oversight. The addition of this feature will enable the management of administrators and multiple tenants from a single, centralized location.

### Increased tenant limits

Tenant limits are being increased as part of this update.

These new limits will be displayed on both our [pricing page](https://auth0.com/pricing) and in your tenant’s [subscription settings](https://manage.auth0.com/#/tenant/billing/subscription). 

![Increased tenant limits](https://images.ctfassets.net/23aumh6u8s0i/6c62XnCJPnWmP72v55PIlY/f33f1ad5bf8c52375a25c92f74bd73db/pricing-01.jpg)

**With the launch of Auth0 Teams, you can now link existing tenants together under one account. It’s important to note that:**

* The owner of a team and/or the admin on the tenant are the only individuals that can group tenants.
* Tenants cannot be unlinked without the assistance of Auth0 Customer Support. If you linked a tenant and need to unlink it, please contact Support by submitting a ticket in the [Auth0 Support Center.](https://support.auth0.com/)

> Keep in mind, if you choose to stay on your current plan, you will be allowed a single tenant.

### How is this different than current Auth0 offerings?

As a part of this pricing change, customers will have the opportunity to link multiple tenants to the same subscription. Usage will be aggregated across tenants and will be billed at the subscription level. This allows customers with development and staging tenants to have access to the same features within said tenants, without having to purchase additional subscriptions. Along with these changes, we’re also introducing official tenant limits that align with the positioning of our various offerings. 

### Steps on how to migrate to Auth0 Teams

Information about this process can be [found here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams). If you want to migrate to Auth0 Teams, you must upgrade your plan in your tenant’s[ subscription settings](https://manage.auth0.com/#/tenant/billing/subscription) to have Teams automatically enabled for you.

## Additional Feature Offerings:

### Enterprise MFA Add-ons:

Multi-factor authentication ([MFA](https://auth0.com/docs/secure/multi-factor-authentication)) can block 99.9% of account hacking attacks. So, without being too obvious, implementing MFA within your Identity solution is pretty important. It’s imperative to prevent credential based attacks, and we want to make this easier for our customers to have access to this security feature. And so we’re introducing** Enterprise MFA Lite.**

Auth0 now allows you to use additional MFA capabilities that were previously only available to enterprise customers. Enterprise MFA Lite allows you to add any MFA factor to [Professional Plans](https://auth0.com/pricing) for an additional fee. This includes the support of [SMS](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) and push & voice notifications (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. However, this enhancement will give broader access to additional MFA protocols to support a wider range of use cases. 

### Enterprise Connection Limits:

**[Enterprise Connection](https://auth0.com/docs/authenticate/enterprise-connections)** limits are increasing from three connections to five connections on the B2B Professional Plan. This will allow for more of our SaaS customers to scale better. As a reminder, there is no limit on Okta Enterprise Connections for customers on all of our B2B plans. 

### Monthly Active Users (MAU) Tiers:

We are introducing [Essential](https://auth0.com/pricing) and [Professional](https://auth0.com/pricing) MAU tiers above the previous 7,000 and 10,000 MAU limits on B2B and B2C Plans, respectively. This change will allow you to better evaluate cost as you anticipate scaling on the Auth0 platform. 

Again, if you would like to take advantage of these options, please contact our team by completing this [form](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales). Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.

If you have further questions, please reach out to the [Auth0 Community](https://community.auth0.com/) (free plans) or submit a ticket in the[ Auth0 Support Center](https://support.auth0.com/) (paid plans).

## FAQs

* **Will the free plan still be available after November 1st, 2023?**
    * Yes, the free plan will continue to be available.
* **What’s the benefit of grouping tenants?**
    * All of your tenants can be managed in one place.
    * Entitlements, usage, etc. will be viewed together.
    * Increased security.
* **What is an Auth0 Team?**
    * Provides a single point of visibility and control over your Auth0 resources by providing centralized governance, compliance, and secure collaboration at scale. More information about Auth0 Teams can be found [here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard). 
* **What if my tenants are already grouped?**
    * Nothing changes unless you make changes to your subscription.
    * If you make changes to your current plan, you will need to regroup your tenants since the plan structure differs.
* **What if I have multiple plans?**
    * Tenants will need to be grouped via [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard).
* **What if my company is a development agency (dev shop)?**
    * Contact [Support](https://support.auth0.com/) to request an exemption. 
* **Can I stay on my current plan?**
    * Yes, assuming you are using one tenant and are within your usage limits you can stay on your current plan.
    * We will provide you with at least 90-days notice if we decide to move existing customers that are within their usage limits to the new plan structure.
* **Where can I find the new Terms of Service?**
    * Our updated Terms of Service can be found [here.](https://www.okta.com/auth0-pss-self-service/)
* **I’m on an enterprise plan and I have a self service tenant(s) as well. Do I have to move those to my enterprise plan?**
    * Yes, and it will be more beneficial for you to manage all tenants under a single account that has enterprise capabilities.
* **Can I pay by invoice now rather than credit card?**
    * Yes, for plans above $10,000/year you can sign a contract and pay by invoice rather than by credit card. To take advantage of this, please [contact us](https://auth0.com/contact-us).
* **What happens if I have more than 7 admins?**
    * New plans released on November 1st will only get up to 7 admins.
* **Can I get more than 10K MAUs on a self service plan?**
    * Yes, we now include MAU tiers beyond 10K MAU
* **Which MFA factors can be used with the Enterprise MFA add-on on professional plans?**

* **✅ Included**
    * SMS Notifications
    * Push Notifications
    * Voice Notifications
* **❌ Not Included**
    * WebAuthn with security keys
    * WebAuthn with device biometrics
    * Email Notifications

Pricing Changes for Auth0

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

New feature provides real-time monitoring of potential identity security events and threat response efficacy

Okta Customer Identity Cloud (powered by Auth0) today announced the general availability of Security Center, a new feature that helps enterprise customers optimize their identity security posture by leveraging insights from Okta Customer Identity Cloud to provide a single view of authentication events, potential security incidents, and threat response efficacy. It includes real-time data on companies’ current state of attack protection, out-of-the-box threat monitoring on major identity attack vectors, and application-level visibility into authentication traffic.

Determining whether an organization’s identity security posture is too restrictive or too lax is not trivial. Customers currently need to parse through logs 3rd party tools or build their own, which requires expert-level experience to effectively identify attacks and be ready to respond to them. Security Center provides an improved way to visualize this type of data directly from the Okta Customer Identity Cloud. 

Security Center leverages Okta Customer Identity Cloud security insights to provide CISOs, Security Operations Professionals, and Identity teams a faster way to detect and respond to identity threats. It provides a streamlined view of authentication events, potential incidents, and threat response efficacy, allowing them to optimize their security posture without having to risk their bottom line after going through the learning curve themselves.

![Attack Protection](https://images.ctfassets.net/cdy7uua7fh8z/2hyZMfdrGwVZxKtuV4ZOR3/f1795066d12eb02550da8f4eb0f00fd5/Threat_Behavior.png)

“Accurate detection alone doesn’t ensure threat response is appropriate to the level of risk, given other business objectives like customer acquisition, retention, and growth,” said Jameeka Aaron, Chief Information Security Officer, Customer Identity at Okta. “As attacks against identity flows get more sophisticated and evolve to bypass detection, security teams often have to go through a learning curve on their own production environments, which can mean delayed detection of attacks and consequent business losses. Security Center leverages our focused expertise in identity security and packages it in a way that security operations professionals can understand and take action.”

Account takeover attacks targeting everything from sensitive healthcare data to loyalty points are one of the most common and costly cyber threats. Verizon’s 2022 Data Breach Investigations Report (DBIR) found that 80% of corporate breaches involve compromised identity solutions*. Security Center takes the work out of building your own tooling to identify and be able to respond to identity threats in a timely manner. Customers can understand their identity security landscape with summary visualization of major attack types, authentication events, and threat monitoring.

Security Center also allows companies to measure user experience impacts of Attack Protection features. Consumer-facing apps must balance security with user experience by minimizing friction while maintaining appropriate protection against identity attacks. Security Center shows app owners in near-real time UX effects of defense tactics, allowing them to adjust security and friction as appropriate to their situation. Companies can fine-tune their attack protection strategy by seeing in near real-time how defense tactics like MFA, rate limiting, and CAPTCHA affect their applications.

Security Center is available for all Enterprise customers. Learn more about implementing Security Center [here](https://auth0.com/docs/secure/security-center).

### About Okta

Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secure access, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digital transformation thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building a world where Identity belongs to you. Learn more at [okta.com](https://www.okta.com/).


Okta Customer Identity Cloud Adds Security Center to Enterprise Plan

Peter-Wheeler-author

Peter leads marketing, community, and customer engagements at Auth0.org. 
With a visceral passion for effective and sustainable Corporate Social Responsibility, Peter develops non-performative programs and engagements for social impact organizations globally. He believes all organizations deserve the opportunity to use technology as a force for good and provide solutions and support to help heroes save the world. Peter prides himself on being a polymath, entrepreneur, innovator, founder, proud failpreneur, strategic marketer, process improver, and sales enabler driving positive impact. Say hi on <a href="https://www.linkedin.com/in/jpeterwheeler/">LinkedIn</a>.



Senior Marketing Manager, Social Impact

Peter Wheeler

Continuing our Pledge to create SAFEr Social Impact Organizations

As a former business owner, nonprofit board member, developer, and volunteer; I know of one consistent, daunting, universal expenditure all modern organizations face - their tech stack. While some items, such as hardware, have a front-loaded cost that can be justified and managed through a lifetime; taking an uncertain “digital leap” for philanthropic entities can be challenging. Even when it's known and agreed that improvements to legacy systems and tools are needed, or that building something completely custom from the ground up to meet the demands of a digital-first economy is in order, there is always trepidation when it comes to modernization and understandably so.

All these issues are even more challenging for charitable, nonprofit organizations and social enterprises, collectively “SIOs,” or Social Impact Organizations. These organizations are critical to our society but sufficient unrestricted funds, tech expertise and time to upgrade their systems and processes are especially precious commodities.

## Digital Is Primal

As evidenced by the existence of social sector industry associations like [nten](http://nten.org) and [tagtech](http://tagtech.org) that seek to enhance technology capacity building, Social Impact Organizations (SIOs) have recognized the need to modernize their operations. A message we frequently hear from many sources is that younger generations are contributing to a better world as part of their core lifestyle, and SIOs need to “meet their audience where they are at.” What we have learned from these groups and analysts is that 80% of SIOs are smaller organizations that need sustainable, scalable growth - but that growth is dependent on utilizing and creating affordable digital solutions. Knowing this, we feel expanding our product offer to SIOs for all of our products, not just Enterprise plans but now including Self Service plans for small to medium-sized organizations we can support SIOs regardless of organizational size, internal tech expertise or IT budget levels.

Stakeholders expect a secure, quality digital experience from SIOs just as they would from commercial enterprises. We’re committed to creating an offer which helps SIOs satisfy that expectation with minimal cost, installation effort, and ongoing maintenance. We help SIOs secure their stakeholder identities and access so they can focus on what matters: delivering innovative, high-impact services to people most in need in our communities. There is no higher calling for them or for us.

## Understanding Your Need as an SIO

Nonprofits and for-profit social enterprises looking to upgrade the experience of their donors, staff, volunteers, and mission-beneficiaries without compromising on security and compliance, should look at the modern, platform-agnostic Customer Identity & Access Management solutions that Auth0 has to offer.

In fact, our products and services were built with the unique needs of nonprofit and social enterprise organizations in mind. Much like our Healthcare and Public Sector clients, we know yours is an industry with stringent trust requirements, and like these other verticals, we know that the ability to rapidly iterate, respond, and evolve has been a constant challenge plaguing everyone in a digital-first economy.

By reducing the hours and specialty skills required to create “a great login experience” (which we better know as identity, access, authentication, and security), application development becomes attainable and affordable for any size organization.

## We Want Everyone to Be SAFEr

SAFEr, where do we derive that from? Secure Access For Everyone, _but not just anyone_.

Auth0 has always offered a free plan to help everyone easily deploy modern identity and security in their websites and applications.

You do not need to have a sophisticated developer on staff to rapidly and simply begin utilizing Auth0.

We provide resources, documentation, SDKs, and plugins that support developers and non-developers alike deploy better security no matter if it’s a small website or an enterprise application. **Everyone**. **SAFEr**. This applies to SIOs, too.

## Enterprise Cost Savings

In addition to our free plan, unique cost savings are available on all Enterprise and Self Service plans for Social Impact customers. We established a resilient organization and funding structure, [Auth0.org](http://auth0.org), to make sure this discount is sustainable and attainable for the long-term.

For [Auth0 Enterprise Plans](https://auth0.com/pricing) eligible[^1] nonprofits receive a:

- 25% [discount](https://auth0.com/social-impact/pricing) on 1 year contract plans
- 30% [discount](https://auth0.com/social-impact/pricing) on 2 year contract plans
- 35% [discount](https://auth0.com/social-impact/pricing) on 3 year contract plans

Complimentary Design & Discovery sessions for Enterprise Plans are available.

## The Big Announcement - Our Newest Offer - Self Service!

Social Impact Organizations can rapidly become SAFEr Social Impact Organizations with a whopping 50% [cost-savings](https://auth0.com/social-impact/pricing) on our new [Essentials and Professional Self-Service Plans](http://auth0.com/pricing).

And with our free trial, no payment is required to start building today.

Not sure which plan may be right for you? Check out our compare plans feature on our [pricing page](https://auth0.com/pricing) or, [contact us](https://auth0.com/contact-us?place=subscription%20column&type=button&text=contact%20us&target=contact-us).

[^1]: Final approval for an organization to receive either cost-savings discount will be made at Auth0’s sole discretion. To see if your organization is eligible, please review our [eligibility guide](https://auth0.com/resources/whitepapers/social-impact-discount-eligibility-guide) and validate through our third party validation partner.

Introducing Cost Savings for Nonprofits on All Auth0 Plans

We are committed to delivering a Tier 0 service for our customers

Over the last few months, there has been an increase in service degradation and outages that has shaken our customer’s confidence in Auth0. Our number one mission is to provide you with the highest level of service and reliability at all times, for the full spectrum of customers from free users to enterprise. The production environments in US-1 and EU have been impacted the most frequently and, in extreme cases, has caused downtime for some of our customers. As the Auth0 CPO, I sincerely apologize for the pain this caused you and your customers. We take ownership for the failures and recognize how disappointed you are.

We know that identity plays a critical role in your company, and it is our responsibility to make our service reliable. It is also our responsibility to provide guidance to our customers on appropriate architecture patterns. When we experience failures or degradation of our service, we correct them as swiftly as possible. Today, I wanted to share the active measures we are taking to protect against similar issues from occurring in the future.

## First, What Caused the Outages?

Before we explore all of the actions we have taken, it’s good to understand the patterns we have observed in these environments:

### Noisy neighbors in our large multi-tenant environments create throughput bottlenecks

The noisy neighbor phenomenon is a well-known issue in multi-tenant environments. In our case, one co-tenant may experience a spike in traffic which can lead them to monopolize resources available and thus reduce the throughput (requests-per-second) on the environment for the other co-tenants.

Most of our customers in the US-1 and EU environments have enjoyed many years of uninterrupted service. These environments have grown significantly and are now the longest-running and largest, which exacerbates the noisy neighbor impact.

We have not strictly enforced restrictions to the frequency of customer API calls (rate limits) and at times allowed for a 10X increase in requests-per-second (RPS) for certain tenants in a single environment. Typically, our architecture would allow us to absorb these spikes as it is the case in most of our environments, but given the volume and size of the customers in US-1 and EU, these concurrent requests restrict throughput for other tenants. We do not fault our customers for their peak traffic needs and it is on us to put in place the right protections and guardrails around each tenant. Unfortunately, we are not able to actively load shed today (i.e. automatically move tenants to other environments such as US-3, because we don’t currently have the migration tooling nor can we do it without any downtime). There are some customer scenarios where a planned migration by a customer is possible, but it requires time and effort on your part. I will cover migration scenarios and timing in the ‘Looking beyond the next 60 days’ section below.

### Region Mean Time To Recovery (MTTR) outside of our 15-min target

The other item we are solving is meeting our 15 minutes target for region failover. This is caused by dependencies on an underlying managed service that doesn’t support automated failover within our target timeframe. Our teams are in the final stages of completing the switch, a managed service that allows us to automatically failover within 15-minutes, in Q1 2022.

We can successfully failover Availability Zones (AZ) today within our 1-minute target window as validated by quarterly testing.

## What Actions Have We Taken Already?

### Slowing down and invoking our change freeze earlier

Effective Sept. 30, 2021, we’ve significantly reduced the number and frequency of changes that we’re introducing into production for the remainder of the year. This is to introduce increased testing and soak time in pre-production environments. Heading into the holiday season, our protocols may change slightly, however, we anticipate continuing a conservative posture to maintain the stability of our production environments. We are mostly allowing changes that are related to our resiliency initiatives or security patches. Being an authentication platform, security-related changes are non-negotiable, as is our mission to protect you and your customers.

### New staging environment

As of early October, we have a staging environment that has the same load as US-1, so that we can simulate test cases reproducing production traffic at large scale. The volume and high load-related issues described above can now be more easily detected.

### Additional resources and re-prioritization of our roadmap

We have added team members and reprioritized resilience projects in order to complete these improvements in time for the holiday season. I am personally doing a daily stand-up with our Engineering leadership team to ensure there is an elevated review process and all blockers are actively being addressed. In addition, all new product and feature initiatives have been deferred until the new year.

### Resilience and holiday readiness efforts

After our outage on April 20th, a dedicated team of 40 engineers completed a 10-week task force to reduce the load on our environments that resulted in:

*   Reduced cache load by removing unused feature flags and added in-memory caching of multiple per-environment feature flags.
*   Removed 2 collections from our database that reduced total database writes by 10%.
*   Reduced reads to the collection with the most reads within the database by 12%.
*   Added limits to refresh tokens queries from the Management API.
*   Added missing indexes for new collections in the database.

Some of the improvements identified were multi-quarter projects that are still underway and are expected to be completed this November. These projects will:

*   Reduce the read/write workload by 10%.
*   Reduce 40% of inserts/deletes from our database.
*   Reduce 30% of inserts/deletes from our database in US-1 enviroment. This requires a deprecation of opaque access tokens and will take 6 months to complete.

In October, we started the following remediation projects to further reduce the probability of these failures:

*   Refactoring our connections schema to remove high cardinality issues.
*   Addressing noisy neighbor issues in our extensibility stack (also known as Webtask).
*   Implementing an additional caching layer for reading requests.
*   Proactively and significantly over-provisioning our stack in an effort to get ready for holiday traffic.
*   Enforcing global active rate management per tenant at the edge.

The projects listed above are also scheduled to be live and in production by November 10. We know that all of the initiatives above will reduce the load on our environments and should significantly reduce the noisy neighbor issue I referenced above.

We are also initiating code change freeze windows over the holidays:

🟧 **Orange Change Freeze** 10/12 - 11/11 <br>

🟥 **Red Change Freeze** 11/12 - 11/29 <br>

🟧 **Orange Change Freeze** 11/30 - 12/16 <br>

🟥 **Red Change Freeze** 12/17 - 01/03 <br>

🟧 **Orange Change Freeze:** During this window, all production deployments are halted, and only work related to stability for Mission Critical Services, security patches or urgent releases on other components may be deployed. Changes must meet testing and approval criteria. <br>

🟥 **Red Change Freeze**: During this window, all production deployments are halted. Exceptions allowed only to resolve critical customer issues or security patches. Changes must meet testing and approval criteria. <br>

## Looking Beyond the Next 60 Days

### New environments and migration capabilities

We are now actively working on creating new environments in our US and EU regions. Our target is to progressively introduce 4 new environments in the US and up to 3 new environments in the EU in CY Q1 2022. The new environments allow us to dynamically allocate load as part of our demand response strategies and significantly reduce the blast radius of disruptions and outages. Our team is also actively scoping and designing an automated tenant migration process. We expect to have an automated tenant migration tool that will enable us to work with you and migrate you over to one of our newer environments beginning late CY Q1 2022.

### New platform rollout across clouds and regions

We began working on a modern platform last year that is poised to roll out across the regions and clouds that we operate in. This month we began the gradual rollout of this new platform and made it available on Microsoft's Azure cloud. This new platform architecture has been purposefully designed from the ground up to deliver a scalable, reliable, and resilient service that meets the current and future needs of our customers. We are targeting to make this available on AWS starting CY 1H 2022.

Finally, we truly appreciate your trust in Auth0 and will do everything that we can to keep that trust. I will post another public update in early CY Q1 2022 to share the results of all of our work in future blog updates including the progress of the improvement initiatives listed above.

_Please note: any unreleased products, features, or functionality referenced in this disclosure may not be currently available and may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._

Improving Our Platform Resiliency and Upcoming Holiday Plans

Bhawna Singh joined Auth0 as SVP of Engineering. Why she plans to focus on mentoring innovation.

Relying on Ask.com for quick answers or researching your next role at Glassdoor? You’re likely leaning on innovations [Bhawna Singh](https://auth0.com/blog/bhawna-singh-joins-auth0-leadership-team-as-senior-vice-president-of-engineering) helped make possible. With over twenty years of helping companies through tech transformations, scaling challenges, and participating in multiple acquisitions, Bhawna brings an understanding of how to deliver growth that serves end users and develops talent on the way to building revenue.

That experience is coming to Auth0 at a critical moment. While we’re seeking to strongly align our product and engineering teams, we’re also working through our recent acquisition by Okta — and we want to do that while sustaining our growth trajectory.

We sat down with Bhawna to learn more about how she grows talent through innovation, what brought her to Auth0, and why she’ll be applying the power of diversity of thought to the global identity market.

### Why join Auth0? 

Three things intrigued me. 

First, you, Eugenio [Pace], Matias [Woloski], were upfront and transparent about challenges. More importantly, though, Auth0’s mission and roadmap was compelling. 

Second, I really enjoy the people interaction that comes from working with a global team. But Auth0’s engineering talent spread across many countries presents an interesting time zone challenge.

Third, the technological challenges presented with Auth0’s high growth. Auth0 needs to work across 21 deployment regions to securely and reliably support billions of logins a month while continuously calling the team and technology to meet growth demands. This is an area where I can help and learn at the same time. Bottom line? I see the high growth and complexity of challenges ahead as an opportunity to make a larger impact.

### Now that you’re here, what are your short-term goals?

In the short term, hiring is my top priority. Even before Okta’s acquisition, Auth0 had big hiring goals. I am currently partnering with multiple teams and leaders on our hiring and onboarding strategy. At Auth0, we are solving hard problems around authentication, security, scale, and a product that needs to be highly available, along with continuous innovation in the identity space. So making sure new engineers understand that when they come to Auth0, they’re going to get to solve hard problems with leadership support (which means mentorship, team building, and securing proper funding) and strong cross-org alignment, specifically with product and process teams.

### Longer-term?

Mid-term, I’m looking to build Auth0’s engineering vision and roadmap to align our technology investments and product innovation plans. This will also play into our longer-term Okta + Auth0 vision. As a team, we are constantly innovating and making big bets. It is important that we build external awareness of key initiatives (watch for more engineering-specific content) to help continue attracting top talent and satisfying evolving customer needs.

### If I’m a new or current engineer at Auth0, what kind of leadership can I expect from you?

Table stakes for me are genuine empathy. But if I am going to ask you to rally behind me, there are really four core qualities that I look for in leaders, whether I am looking in the mirror or at leadership across an org.

1. **High-accountability.** Everyone is going to make mistakes. I hold myself highly accountable for what happens in my org. This helps build team integrity, trust, and collective ethics. The point is never to be mistake-free but to make sure we take the time to learn from our mistakes.
2. **Listening-based communication.** For a lot of people, listening is passive. For me, active listening means checking that you’ve effectively communicated what needs to be communicated and making sure it was received correctly. Information and feedback need to flow both ways, which is also key to building a transparent organization.
3. **Planning long-term.** As we look at our organization and tech stack, we need to invest in our long-term vision and strategy along with making short-term bets and wins. Aligning engineering with our vision and long-term goals means investing in people, investing in our technology, and strengthening innovation. 
4. **Investing in leaders.** The mentors I wanted and needed weren’t right there at the start of my career. If I could go back and change something in my own career, it would be to mentor sooner. Investing in developing team leadership through mentoring, coaching, or providing access to additional training and contacts can make a huge difference in the amount of creativity and innovation that comes out of an org. But more importantly, it helps keep the entire industry growing and innovating. I ensure that I am coaching my leaders to grow, and together we are building an organization inspired by learning and problem-solving. I also make every effort in connecting with underrepresented groups regularly and evaluate how effectively I help them to achieve their goals. If you’re on my team and would appreciate mentorship, I will either mentor you directly or connect you with someone within my network.

### What did it take to break into executive roles? Especially if you’re a woman or underrepresented person in tech, what five steps should you take to break in?

1. **Say yes to stretch assignments.** Mentors or coaches are usually telling you what’s happening, but if an opportunity comes your way, it means someone has vouched for you. Of course, you need to evaluate whether or not this assignment is right for you at this point in your life, but if you can, say “yes”. 
2. **Seek mentors — and trust them to identify your gaps.** We all have self-doubts, but I sometimes see women calling out “gaps” that I don’t really see as their weakness. Finding a mentor who can confirm your true gaps and strengths is critical. Then it’s important to do that homework to actively address the things you need to do in order to reach that goal.
3. **Get comfortable with taking risks and failing.** As an executive, the situations that come your way usually do not have a playbook. Being comfortable with taking risks, failing, and learning from the experience is the only path forward.  
4. **Network.** Look for peers (in addition to mentors) that you can lean on and ask for best practices. This is easier for some than others. Here are concrete steps that work: 
* **Talk to your manager and express interest in mentorship.** Your manager can lean in and help and/or provide recommendations and intros to other mentors.
* **Reach out to your People/Human Resources partner for mentorship.** They can connect you with internal mentors, in addition to external opportunities.
* **Identify your goals.** Work on self-awareness. Avoid an open-ended discussion. Identify two to three areas you’d like to work on. This will make it easier for your network to help you take action that matters. 

### Our security team talks about relying on “diversity of thought” to help secure our product and ensure a stronger security culture that protects our customers and the internet. How does diverse thinking help fuel an effective engineering team?

Security is part of engineering, and the teams collaborate closely to identify solutions grounded in the [Secure by Design approach](https://auth0.com/blog/why-auth0-is-shifting-left-on-security/). Diverse backgrounds bring diverse thoughts with multiple perspectives to get us to the right solution for all our customers. Auth0 was not created for just one company in the US or one company in another country. Our customer space requires a large global setup. One perspective just won’t work.

**Tell me about why you joined [Neythri Futures Fund](https://www.linkedin.com/company/neythri-futures-fund/) (NFF) as a founding Limited Partner.** 

The core reason we all came together to found the NFF was to fuel diversity at the top. We focus specifically on funding companies founded by women and underrepresented groups because we weren’t seeing women investors in this space. If you want to fuel diversity, you have to fund it.

**What makes a good ally?** 

We all feel we should know the answer here, but this is an evolving area. I am a continual learner in this space, so this means making sure I am listening and aware that I am going to make mistakes. Not intentionally, of course, but coming from a place of being comfortable with learning and listening hopefully makes it easier for others to point out my mistakes so I can learn from them. Immediately trying to fix everything is not the answer. The constant learning can’t stop with me. I need to pass it on to my team, leadership, and my network. We need to share what we learn to build collective awareness in this area.

### After being through more than five acquisitions, what kind of leadership does it take to move companies through mergers and acquisitions towards success for both employees and customers?

* **Aligning mission and core values.** How does the acquiree fit in/influence the mission?
* **Bringing people along through communication.** An acquisition is change management at a grand scale. Being clear about challenges and opportunities, especially for growth acquisitions, helps people bring the collaborative vision into reality.
* **Put together a plan for how you will bring people together — and actively communicate that plan.**
* **Understand that this is a complex process.** Know that there are areas that might not work out, while there are people who thrive on complex challenges. Actively choose to let those people lead and bring in those who are looking to work collaboratively. Frankly, I’m excited to be able to help Okta and Auth0 at this time.

## Learn more about identity and opportunities at Auth0

* If you’d like to learn more about how Auth0 can help speed your product to market, reach [out to our team](https://auth0.com/contact-us).
* If you’re interested in helping us solve complex problems, you’ll find [current listings here](https://auth0.com/careers/).

Auth0 Welcomes Bhawna Singh to the Team

jonathan-keen

I head up the legal function for Auth0 in the EMEA region (Europe, Middle East & Africa). I advise the business on commercial, IP, technology and data protection related legal matters - helping to ensure Auth0's interests are protected and that we remain ahead of the curve in a very dynamic legal and regulatory environment.

Associate General Counsel

Jonathan Keen

Making sense of regulatory uncertainty in Brexit impact planning



Auth0 understands the regulatory uncertainty and operational challenges that the United Kingdom (UK) 's exit from the European Union (EU) may be causing for our customers. The intention of this guidance note is to inform and reassure so that Auth0 is one less supplier that you need to worry about in your Brexit impact planning. 

### Q: What does the EU-UK Brexit deal mean for transfers of personal data?

**A:** Further to the recent announcement of the EU-UK Trade and Cooperation Agreement (the "Brexit Deal"), it's business as usual in terms of Auth0's post-Brexit data flows, which means the positions described in the blog post of 20 November 2020 (below) remain accurate. 

The Brexit Deal allows for the continued free flow of personal data between the EU and the UK for six months or until an EU adequacy decision comes into effect. During this period, it is recommended that UK organizations still put in place appropriate safeguards with EU organizations that transfer personal data to them, which will include the EU Standard Contractual Clauses (SCCs). 

Auth0 customers without a Data Processing Addendum (DPA) in place are able to countersign Auth0's standard DPA, which incorporates the SCCs. A pre-signed version of the DPA is available here: [www.auth0.com/legal](http://www.auth0.com/legal).   

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>REMINDER:</strong><br> 
  As described in more detail in the main blog post below, the primary location in which Auth0 will conduct its core processing of your customer data is chosen by the customer when they create an Auth0 tenant. For our UK and EU customers, this is almost always the AWS EU region, which is made up of a primary data center in Frankfurt (Germany) with failover to a second data center in Dublin (Republic of Ireland). This means if a customer selects the EU region, then all data processing activity by Auth0 will take place within the EU aside from a few limited exceptions (Management Dashboard & Customer Support, as covered in more detail below).<br> 
</div>

### Q: Hasn't the UK already left the EU? 

**A:** The UK officially left the EU on 31 January 2020 but then entered into a transition period, during which the UK would remain aligned with all existing EU law. In short, during the transition, nothing has really changed, and EU laws must still be followed. This transition period ends on **31 December 2020**, unless it is extended to allow negotiations between the UK and the EU to continue. 

### Q: What does this mean for my customer data being processed by Auth0? 

**A:** UK and EU privacy laws only apply to **personal identifiable data** or "**personal data**." The UK currently bases its own data privacy laws on the EU's General Data Protection Regulation (GDPR), but little is known about its post-Brexit plans for data privacy. 

For GDPR purposes, our customers are data controllers, and Auth0 is the data processor, which means the customer is responsible for managing their own personal data flows and ensuring they have valid transfer mechanisms in place for all international transfers of such data. 
 
### Q: So, where does Auth0 process its data? 

A: It depends on which AWS region our customers have chosen to host their Auth0 tenants. 

The primary location in which Auth0 will conduct its core processing of your customer data is chosen by the customer in their Auth0 Sales Orders and when they create an Auth0 tenant. For our UK and EU customers, this is almost always the AWS EU region, which is made up of a primary data center in Frankfurt (Germany) with a failover to a second data center in Dublin (Republic of Ireland). This means that aside from a few limited exceptions (covered below), if a customer selects the EU region, then all data processing activity by Auth0 will take place within the EU. 

_**Limited Exceptions**. As disclosed in our contracts with our customers and described in more detail below, Auth0 conducts some limited processing of personal data outside the EU. Please note that for both examples, the transfers will be: (i) within the customer's control; and (ii) covered by Auth0's intra-group Standard Contractual Clauses (Model Clauses)._ 
 
**Management dashboard:** For public cloud customers, Auth0 may temporarily process tenant data in the US for display on the Auth0 Management Dashboard. Dashboard web servers are located in the US. This data is not automatically transferred but is only served up when a tenant dashboard administrator requests it for viewing. When this occurs, the data itself is ephemeral, is not permanently stored on our systems, is encrypted during transit, and is only used to display information on the dashboard to the requesting administrator. 

This data can include any information that can be viewed through the Auth0 Management Dashboard, which typically includes the user's e-mail address or other UID and basic metadata about that user, such as creation date, last login time, user agent, and the identity provider used.

_**The dashboard exception does not apply to the Private Cloud.**_ For customers on Auth0's private cloud deployment, all dashboard processing occurs within the AWS region the customer has selected for its tenant for private cloud customers, e.g., if the customer selects the EU region, then dashboard processing will remain in the EU.

**Support tickets and logs:** If a customer includes personal data in a support ticket, then this may be viewed by Auth0 support personnel outside the EU. In order to resolve the ticket, Auth0 personnel may review activity logs to help understand the underlying error. Personal data in those logs typically consists of a user ID (e.g., e-mail) and IP addresses.

### Q: What does Brexit mean for our existing European customers? 

**A:** In terms of international data transfers and data processing locations, it's business as usual. If you are an Auth0 customer based in the EU and have selected the AWS EU (Frankfurt, with failover to Dublin) as your deployment region, then no personal data will be exported to the UK via Auth0 in the provision of Auth0's core services. 

_Support Service Qualifier_. If an Auth0 customer based in the EU chooses to insert personal data into a support ticket (as described above) or share personal data with an Auth0 support operative based in the UK, then a transfer of personal data from the EU to the UK will occur. Please note, however, that such a transfer will be: (i) within the customers' control; and (ii) protected by Auth0's intra-group Standard Contractual Clauses (Model Clauses). 

### Q: What does this mean for our UK customers? 

**A:** The situation remains fluid in terms of the status the EU will afford the UK (and vice versa) with respect to transfers of personal data. If the EU recognizes that the UK has a suitably robust data privacy regime and makes an **adequacy decision** in its favor (as it has done with Japan and Argentina), then transfers of personal data from the EU to the UK will be permitted, and data will be able to flow freely between the two regions. 

_**UK to EU transfers of personal data**_

Currently, the UK's data privacy regulator - the ICO - has confirmed that it will recognize the EU as a region with adequate protections in place for exporting the personal data of UK nationals, i.e., UK to EU transfers of personal data are permitted. 

This may change if the EU does not reciprocate and grant an adequacy decision in the UK's favor. Given the UK's post-Brexit data privacy regime is currently unknown, no one can say with any certainty what alternative transfer measures the UK may require for the export of UK personal data. It's reasonable to imagine such a transfer mechanism might be similar to the EU's Standard Contractual Clauses (Model Clauses). 

### Q: What can Auth0's UK customers do to mitigate against personal data flow uncertainty?

**A:** If you are an Auth0 customer without a DPA in place with Auth0, you may want to consider countersigning Auth0's current DPA - which attaches the GDPR Standard Contractual Clauses / Model Clauses covering the transfer of personal data to a third party country. Auth0 has published a pre-signed Data Protection Addendum (DPA) at [www.auth0.com/legal](https://auth0.com/legal). 

UK customers may wish to countersign the DPA as follows: 

1. If a customer has **end-users** that are **EU citizens**, in order to ensure a transfer mechanism is in place for the potential **EU to US transfers of personal data** under the dashboard and support ticket exceptions described above;

2. If a customer has **UK end-users only**, in order to put a preemptive post-transition period transfer mechanism in place for the UK to EU transfers of personal data. Such measures may not be necessary if the UK continues to recognize the EU as an approved country for personal data exports. Please note that we do not know what form, if any, the UK's standard contractual clauses will take for exports of UK personal data to third parties. There is no guarantee that the Standard Contractual Clauses attached to our DPA will be sufficient to cover such transfers. Regardless, we will be following developments and will make updated Standard Contractual Clauses or their equivalents available as the situation becomes more certain.

### Q: What if UK data sovereignty is an absolute requirement? 

If you are a UK Auth0 customer with UK only end-users, and it is essential that minimal personal data leave the UK, then Auth0's [Private Cloud](https://auth0.com/docs/private-cloud) deployment option may provide a solution. 

With one of Auth0's Private Cloud deployments, all customer personal data is ring-fenced on the AWS data center that the customer chooses to create its Auth0 tenants. So if a customer chooses the AWS London (UK) region as its desired location to host its Auth0 Private Cloud deployment, then there will be no transfers of customer personal data as part of the core Auth0 services from the UK to either the EU or the US. Please note that even on Auth0 Private Cloud, there may still be some extra-UK transfer of personal data should an Auth0 customer choose to include personal data in a support ticket (as described in the exceptions listed above) or otherwise share such data with an Auth0 customer support operative as part of our support services, e.g., by sharing your screen.

For more information with respect to Auth0 Private Cloud, please see the following link: [https://auth0.com/docs/private-cloud](https://auth0.com/docs/private-cloud). 

### Q: Aside from data privacy, will Brexit have any other impacts on Auth0's wider operations? 

**A:** Not that we envisage. 

Auth0 has a rapidly growing presence of commercial and technical staff on the ground throughout the EU member states who will continue to service our European customers. Our UK customers will continue to be looked after by our UK personnel. Operationally we are well prepared for any outcome of the UK and EU's Brexit negotiations, including a so-called "No Deal" Brexit. Auth0 services for both our UK and EU customers will not be impacted. 

### We're keeping our ears to the ground. 

Auth0 will continue to monitor Brexit developments closely, particularly in relation to data privacy arrangements. We will provide updates as and when and significant developments are announced. 

<include src="asides/AboutAuth0" />


Auth0 Customers: Your Brexit Questions Answered

angela-devlin

Program manager focused on all things self service at Auth0. I am passionate about making Auth0 the very best user experience for all of our customers. In my free time, I’m with my husband and two daughters at the park, hanging out with my adorable old cat or heads down working on my MBA.

Program Manager, Self Service

Angela Devlin

How using Auth0 can solve your startup's authorization and identity needs.



As an Identity Platform, we believe it is especially critical for young startups to determine their identity solution and implement it right from the start, to avoid complications and extra work down the road. Auth0 has always been dedicated to innovation by offering simple authorization and identity solutions to developers, so you can focus on what matters most to you. We are also dedicated to equality and want to level the playing field by making our services easily accessible to minority founders and companies that may run into specific challenges during their first steps as a business. To help you with your awesome new ideas, **we are now offering our startup plan free for a year** to anyone that meets the following criteria:

* Your startup must be under two years old.
* Your startup must be venture-backed and with less than $2M of funding.
* Your startup must have less than $1M in revenue.

Auth0 can help you by handling your business critical identity processes, providing a seamless and safe login experience. Auth0 is also compliant with end user data requirements, GDPR, HIPPA, and more; we can help you stay compliant as your business and identity needs grow. 

_"We are a privacy-first company. Knowing that Auth0 is GDPR compliant was a big factor in our decision to expand our partnership. It goes without saying; we feel very secure."_ Itay Flikier, Engineering Team Leader at Otonomo.

Auth0 is an industry leader in simplicity, control, and extensibility. We know how much time you need to spend on your core business, especially in the early stages, and want to take care of your identity needs, so you can focus on what is most important. We also know that as a new startup, you will be concerned with saving money. While our customers see significant cost and time savings using Auth0, the startup program will be provided to you for free for a full year, so you don't have to worry about that either.

_"If we didn't have Auth0, we'd probably need seven or eight developers focused on [identity]. Our teams now can spend much more time working on the improvements that our customers actually see and care about. Not having to spend time on means that we get to spend time on everything else."_ Chris Hood, CT, and Co-Founder at GO1.

Auth0 safeguards billions of transactions each month, let us help you with yours.

Sign up at [https://auth0.com/startups/](https://auth0.com/startups/)


Auth0 Startup Plan Now Free for Everyone

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey

Hackers are preying on confusion, so businesses need a clear plan.



Between social distancing, an uncertain economic outlook, and the Coronavirus itself, business leaders have enough on their plates without having to worry about cyberattacks. Unfortunately, cybercriminals aren’t taking a vacation; they’re using the Coronavirus pandemic as an opportunity to prey upon organizations around the globe, with potentially disastrous results.

Around the world, security experts are reporting an alarming uptick in Coronavirus-related scams and attacks on our most vital infrastructure.

It’s easy to feel powerless in the face of this epidemic, but when it comes to cybersecurity, executives can actually do a great deal to limit the damage. Put measures in place now to protect your business’ data from attack, and you’ll come out the other side of the pandemic better equipped to deal with cybersecurity threats. Let’s start by identifying those threats.

## Cyberattacks Surge During Coronavirus

It was tempting to hope that hackers might give the world a break during a global health crisis. In fact, security company [Check Point](https://blog.checkpoint.com/2020/04/20/coronavirus-update-as-economic-stimulus-payments-start-to-flow-cyber-attackers-want-to-get-their-share-too/) has reported a sixfold increase in the average daily number of attacks in recent weeks. Of Coronavirus-related attacks, they report that 94% are phishing scams. This statistic is echoed by [Google](https://www.darkreading.com/threat-intelligence/stimulus-payments-are-popular-leverage-for-cyberattacks/d/d-id/1337601), which said it rejected close to 18 million virus-related phishing emails per day in one week in April.

These phishing scams can take a myriad of forms, but criminals posing as government agencies are particularly common. They may offer false guidance, claim to have a list of new Coronavirus cases, or offer people help [getting their stimulus checks](https://www.darkreading.com/threat-intelligence/stimulus-payments-are-popular-leverage-for-cyberattacks/d/d-id/1337601) or other financial assistance. Regardless of the ploy, the goals are the same: trick the reader into clicking on a link, downloading an attachment that exposes them to malware, or entering in private information, which hackers can then use to hijack their identity.

![COVID-19](https://images.ctfassets.net/23aumh6u8s0i/7smqXxxmZ8XdqSMgrGqQ22/4bd9e3fb3ab22cda8376270da6e058ec/goverment-uk)

Many phishing attacks also pose as internal business emails, taking advantage of the confusion resulting from people working from home. Even individuals who would normally be more cautious about clicking on a suspicious link may have their judgment compromised due to pandemic-related stress. People hoping for miracle cures or financial relief are far more likely to click on suspicious links than they would be otherwise.

Tragically, one of the hardest-hit sectors during the Coronavirus has been healthcare, which has been victim to a spate of ransomware attacks. As [Michael Salát of Avast](https://blog.avast.com/how-hospitals-can-protect-themselves-from-ransomware-avast?utm_campaign=socialposts_us&utm_source=twitter&utm_medium=social) has written, “hospitals are not necessarily more susceptible to ransomware attacks,” but since any system downtime could literally cost lives, “they are more likely than other organizations to pay the ransom.” Both the [Department of Homeland Security](https://www.us-cert.gov/ncas/alerts/aa20-099a) and [INTERPOL](https://www.interpol.int/en/News-and-Events/News/2020/Cybercriminals-targeting-critical-healthcare-institutions-with-ransomware) have issued warnings about cyberattacks in healthcare and urged hospitals to educate their employees on email safety, external backups for critical data, and strong, unique passwords.

{% include tweet_quote.html quote_text="As @avast’s threat intelligence director @michal_salat has noted, “hospitals are not necessarily more susceptible to ransomware attacks” — but attacks can cost lives — and they’ve tragically seen an increase during COVID.
" %}

The importance of these steps was highlighted by the experience of an Illinois hospital, which had to pay hackers $300,000 in ransom to get back access to their system after being locked out for three days. As a [hospital administrator said](https://www.pewtrusts.org/en/research-and-analysis/blogs/stateline/2020/04/13/hospital-hackers-seize-upon-coronavirus-pandemic), “The only good thing was that just a few months before, we had put our electronic medical records and our email on the cloud, so they were not affected.”

## How to Protect Against Coronavirus-Era Cyberattacks Today

The Coronavirus pandemic is an ideal situation for hackers since they thrive on confusion, ignorance, and misinformation. To thwart them, businesses need to counter with communication, education, and knowledge.

Step one is to counter misinformation and confusion by **educating your employees** on cybersecurity best practices.

These include:

* Use a unique password for every application to guard against phishing and [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) attacks. Ideally, all your employees should be using a company-approved password manager to ensure they aren’t re-using passwords.
* Be on guard against common phishing techniques, such as emails purporting to be from company representatives but with an unfamiliar or misspelled email address.
* Regularly update all software, especially anti-virus software, on any device (including mobile devices) on which you conduct company business.

It’s up to you how you educate your employees, but given how vital this information is and [how overwhelmed your team is likely to be](https://uptickapp.com/blog/what-managers-owe-our-teams-during-coronavirus), you should consider something more in-depth than a simple email. Conducting video training with specific examples of phishing attempts will make a bigger impact and let you respond to any questions your team has.

If possible, you should **mandate that all work is done on company-issued devices** since employees are less likely to be as vigilant about security updates and downloads on their personal devices. If that’s not an option, you should still **ensure that any remote tools you’re using are secure** and you’re not compromising data security in the name of convenience. (That’s particularly true for the healthcare sector, in which [telemedicine is opening up exciting possibilities](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) but also sparking concerns over patient privacy.)

As always, one of the best defenses against unauthorized intrusions into your system is to **implement a sophisticated Identity and Access Management (IAM solution)** using [multi-factor authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/). MFA works by requesting an additional form of credentials beyond a username/password combination, such as a one-time code or biometric. That way, even if an employee unwittingly shares their password in a phishing scam or is the victim of a credential stuffing attack, a hacker can’t use that information to waltz into your system.

[Auth0 Signals](https://auth0.com/blog/new-ways-to-combat-automated-attacks-auth0-signals/) is a new service designed to help facilitate this by offering a real-time assessment of a login attempt’s threat level and when to request additional credentials.

<script src="https://fast.wistia.com/embed/medias/h5fqhdgsep.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:74.37% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_h5fqhdgsep videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>

## Build Digital Resiliency to Guard Against Tomorrow’s Attacks

In choosing how to protect your company’s data, it’s important to think beyond short-term survival strategies and find solutions that are designed to last for more than a few months. After all, many experts predict a [second wave](https://www.washingtonpost.com/health/2020/04/21/coronavirus-secondwave-cdcdirector/) of the pandemic that could mean a return to social distancing and remote work. And Coronavirus aside, cybersecurity threats to business are on the rise, so it’s important to be proactive rather than merely reactive.

**Conduct risk assessments** of your company’s technology, especially every tool your employees may need to work from home. [Norton advises remote teams](https://us.norton.com/internetsecurity-emerging-threats-working-from-home-due-to-coronavirus.html) to “control the urge to improvise” by switching to unsecure applications when their work-approved tools fail. Yet the best way companies can protect against so-called [Shadow IT](https://www.webopedia.com/TERM/S/shadow-it.html) is to make sure that every piece of software that your team will need to remotely collaborate works as it should.

{% include tweet_quote.html quote_text="Build digital resiliency — it’s important to think beyond short-term survival strategies for protecting your company’s data and find solutions that are designed to last for more than a few months. 
" %}

As Auth0’s CSO Joan Pepin has written, you should also draw up a [pandemic plan](https://auth0.com/blog/how-to-create-an-actionable-pandemic-plan/) to prepare for future crises. That way, in the event of an emergency, all parties know their roles, and your business won’t descend into the kind of confusion that makes it easy prey for hackers. Making this plan will also deliver immediate benefits since you’ll spot potential weak points in your company’s documentation, technology, and overall structure.

## Be Careful, Not Fearful

In times of crisis, when resources (and patience) are stretched thin, it can be challenging to think about long-term solutions. But the Coronavirus is highlighting why it’s so vital to have a culture of security in place to keep a crisis from becoming a catastrophe. That culture should include regular audits, employee training, and third-party partners you trust to keep your systems updated. It’s the difference between building a lean-to shelter to get through a storm and building a sturdy house that will keep out all the storms to come.

If you’d like to learn more about how a sophisticated IAM platform can protect against cyberattacks without slowing your business down, please [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=reach%20out%20to%20the%20team%20at%20auth0).

<include src="asides/AboutAuth0" />


Coronavirus and Cybersecurity: How Your Business Can Stay Safe

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. <br /><br />Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. <br /><br />She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Insights from giving our business continuity plan a COVID-19-induced update



What are the critical things your company needs to keep its doors open? 

Many companies have a Business Continuity Plan (BCP) in place that covers loss of facilities during things like floods and earthquakes, but it's primarily the really big companies (or those who provide critical services for health care) who’ve done more than download a pandemic plan template off the internet and call it good.

[Only 62% of 500 U.S. companies surveyed](https://www.techrepublic.com/article/business-continuity-plans-and-tech-are-lacking-during-the-coronavirus-pandemic/) by SaaS-based accounts payable vendor _AvidXchange_ at the beginning of March had business continuity plans – nearly half of those said they covered contingencies for only two to three weeks – and 10% have no plan at all. At Auth0, we’ve had a BCP in place for years, but [COVID-19](https://auth0.com/blog/business-continuity-at-auth0-our-response-to-covid-19/) prompted an immediate review. The process proved both necessary and revealing. And because we believe it can help other companies, we’re sharing our approach here.

## Ask Yourselves How Do You ‘Degrade Gracefully’?

The first time I heard of a Pandemic Plan was during the [Bird Flu Outbreak](https://en.wikipedia.org/wiki/Avian_influenza) in 1997, while working for the main security company. A large pharmaceutical company was a major vendor, so they required a plan. Unlike our current situation with COVID-19, the plan remained largely theoretical. That’s not the case now. Even if you have a theoretical pandemic response plan, now is the time to make it real. What are you actually going to do?

In computer science, if hardware or a network has been partially destroyed or rendered inoperative, there’s a limited function necessary to keep it going. That process of how the machine or system shuts down is called “graceful degradation.” So, in a pandemic where your people could be out due to illness or permanently gone, you can apply the same question to your business: How do you degrade gracefully? 

This is not what anyone wants to think about. What if half my staff is sick or permanently gone? But it is much easier to think about it now than when you’re in the middle of it rather than when it’s too late to remediate. Think about it now and you will be doing your future self a big favor. Your future self will be so thankful that your past self documented all these things and you don’t have to think about it while you’re worried about your team. You can just follow the plan that you’ve made.

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/6eWOAZSW8CT2gSGUHYWjix/af815dc9c1ab6e6e4b4036099e423c9b/plan_sep1)

## How to Create a Pandemic Business Continuity Plan
You’re going to start by assessing the most critical functions that need to continue to happen for you to remain in business. Or the way I’ve been thinking about it: what is the absolutely last thing that gets shut off? Then you’re going to work backward. What are the things that are required to make sure that thing keeps working? What are the dependencies?

In our case, maintaining service for our existing customers is our most critical function. (Yes, it’s going to be important to add new customers, but if we’re just talking about the absolute most critical function, that’s it.)

In order to keep our service running for existing customers, we need to continue to pay AWS and the employees who are directly responsible for keeping it running. So for us, that would be the very last thing to go before the end of the world when we put all the chairs on the table, lock the doors, and head for the hills. 

If you’re a consulting company, you’d end up in a different critical place. You need to keep shipping deliverables to your clients. The ability to email or transfer files would be a critical function. The key is to go to the end of the world, find the most critical business process, and then work back. 

At Auth0, we worked ourselves backward to an absolute worst-case scenario where our staff numbers became more and more constrained, taking us from our global staff of 660 to just 10% remaining and created a plan where we could continue serving our customers. You should review your specific needs to understand your minimum number of employees for critical functions.

### Defining ‘Mission-Critical’ Functions
This process isn’t going to be easy for everyone, but it is an opportunity to think about the bigger picture. This is an opportunity to think about what’s best for the whole company and your customers. Try and set any ego aside. It’s not an insult if your department is not a business-critical function. Just because something isn’t “mission-critical” doesn’t mean it’s something the company will stop doing even in a pandemic. 

As CSO, I know that my team's ability to monitor and respond to security incidents is by definition a mission-critical role even in a pandemic. But, I also know that if we're really down to 10% of staff across the company, I'm going to take whatever resources I have to help keep our core service running for our customers. That's how the BCP helps me, my team, and my peers prioritize. In a sense, even as CSO, I know my place in this chain.

Since creating a BCP plan can bring a lot of different priorities and perspectives into conflict across the company, our entire executive leadership team worked closely to define a set of business-critical priorities for their teams to work from when fleshing out the remainder of the BCP update. 

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/N21EflGpHem6FVAnIRzNa/9596f571f0021f037ab387287aac831a/plan_sep2)

Because human beings have egos and there may be disagreement about what your most essential business processes are, this is an exercise that the most senior level of leadership should do and agree on. It should not be up to the C-level to put the plan together, but it is their responsibility to have a unified voice because these are business-critical functions. We broke our functions into four categories:

* **Mission-Critical:** Loss of these functions would result in wide-spread loss of reputation, damage to the business, as well as potential damage to the general public.
* **Business Essential:** Loss of these functions would make it difficult, but not impossible to continue the business. Things like generating revenue, customers, following compliance regulations, and maintaining our external help desk fall under this category for Auth0.
* **Business Core:** Loss of these functions would have an indirect revenue impact. In the COVID-era that includes not attending conferences, which impacts both leads and indirectly, customer satisfaction.
* **Business Supporting:** These functions impact employees, not employee productivity. Auth0 examples include employee reviews, our internal help desk, and business support functions.

As things fail, how do we work from the bottom of the list to protect our mission-critical functions? 

If half of your people could be out at any given time and only two people know how to do a given thing that’s critical, that’s not enough.

Here are three questions to ask:

* What are the tools necessary for each business function?
* Who are the people who know-how and are authorized to perform that function?
* Is the process documented with screengrabs so that a smart person could figure out how to make it happen?

### The Hard-Drive Tolerance Approach to Cross-Training
There isn’t great guidance on how many people are needed for cross-training. If all your finance people are in Seattle and everyone in Seattle gets sick, well, that’s not going to work. So I based our approach on hard drive tolerance.

For a hard drive to be considered fault-tolerant, typically the data is backed up in five copies in different places. That’s what we’re doing with people — five people who understand how to perform the process and have access to simple documentation but aren’t all in the same place. As a globally-distributed company, multiple locations are an easily achieved standard for us. If you’re not able to rely on geographic distance, you might want to cross-train additional staff.

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/6pUwP72d4UnvgotPIDO5YP/954716e2549c226b4994e733066131fe/plan_sep3)

## Update 2x a Year, More in Crisis
We took five working days to review our plan and put this streamlined approach in place. Compared to other pandemic plans I’ve seen, ours is super-actionable — the kind of thing that leaders can actually lean on to help them make decisions.

Essentially it’s:

* A stack rank of priorities by team
* Documented instructions
* A Confluence page with who does what, down to five levels of people and their status
* And the instructions to print it out and store it

We are going to keep an eye on our plan and update it quite regularly through the evolution of this pandemic, likely on a monthly basis. Once we’re through the pandemic, we’ll dial that back to twice a year.

## Your Plan Will Make You Stronger
Your plan doesn’t have to take weeks. As I mentioned, we got our review done in five working days. Even if you’re starting with no plan at all, the effort is worth it for what you’ll gain. You’ll discover things you didn’t realize about your business like:

* Departments you didn’t realize were critical.
* Areas where you are under-staffed.
* Processes that need to be documented.
* People who need to be cross-trained.


Your teams will gain:

* A clearer understanding of how they function AND how they relate to the company’s overall mission.
* Likely every department will have an “aha” moment by going through this process.
* Clear direction on communication AND actions.
* Relief that they won’t have to make it up as they go along.

Like the 40 pounds of pasta I have in my garage, if this all blows over, it will get eaten, it’s not going to go to waste. And going through this process will make you a stronger team even when this situation disappears.

<include src="asides/AboutAuth0" />


How to Create an Actionable Pandemic Plan

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn avatar

ec1c9350c3d2306e7c42b9307bea93de?s=480&r=pg&d=https%3A%2F%2Fcdn

I like working at Auth0 because I’m interested in how to scale a startup and training the next generation of identity experts.

Strategic Operations and Technical Field Enablement Director

Yvonne Wilson

Learn how to plan for failures and changes in your identity project.

How To Have a Successful IDM Project (Part 2)

glenn-block

Former Auth0 Employee

Glenn Block

Our plan for sunsetting the Extend service



![Sunset at the beach](https://images.ctfassets.net/23aumh6u8s0i/2MvZ14xcBwOzNtDg459tgt/054d722b06e908b36c940e43bc83d475/sunset)

As product leaders, there are many difficult product decisions you have to make. Two of the hardest are whether or not to create a product, and whether or not to retire a product. Roughly two years ago we made the first decision, which resulted in us bringing Extend to market. It’s been a great two years since! Unfortunately, we had to make the second decision in the past few weeks, and we have decided to sunset Extend as a public offering.

We will continue to use and develop the Extend technology to power extensibility within the Auth0 identity platform and will be doubling down on that effort. **We will be officially shutting down all Extend servers by the end of November 2019.**

## Why is Extend no longer being offered?

Auth0 is experiencing hyper-growth and has been for some time. As we’ve been riding that wave, we’ve realized how critical it is for us to remain focused. Recently we determined that Extend, though a promising business with happy customers, is distracting us from this imperative. A better place for us to focus our energy on is bringing the Extend experience throughout Auth0 identity to directly benefit our core customer base. Retiring Extend was not an easy decision, but one that we all believe was right for the company.

## Our Sunset Plan

As companies have made big bets on Extend, we are not just pulling the plug. We care about our customers and want to make sure they are in a good place.

- Enterprise customers &mdash; We’re working with each of our Enterprise customers to ensure they have a reasonable amount of time to transition off of our platform.

- Starter plan &mdash; Each Starter plan customer will have 3 months to migrate off.

- Extend Freemium &mdash; Freemium customers will have 1 month to migrate off.

As part of the change, we’ll be making some updates to our website including messaging about retiring Extend, as well as disabling various things such as our contact forms, Zero CRM demo, etc. We will keep the site, docs, and blog, alive until we have shut down all Extend instances.

> For any questions, please email us at extend@auth0.com.


## What about Webtask.io?

We are no longer accepting new user signups on [webtask.io](https://webtask.io/). If you are interested in learning more about extensibility of the Auth0 identity platform, please visit [Auth0 Extensibility](https://auth0.com/docs/extend-integrate).

## Thank You for Being Customers of Extend

It is unfortunate that Extend is going away. We have had an amazing journey and are so thankful to the customers who have believed in us. Without your confidence we never would have made it this far. We truly believe in the vision of Extend and were thrilled to see the value you were finding with it.

_Thank you for believing in us and for taking this journey with us_. Extend may be going away, but we firmly believe a similar solution will emerge in some other form. It is the future of SaaS customization and integration.

<include src="asides/AboutAuth0" />


We Are Sunsetting Extend

Learn how to create a realistic project plan to have a good Identity Management project deployment.


Pick up almost any book on project oversight and you’ll quickly see a pattern to advise about how to have a successful project. Certainly, all the usual advice, such as the items below, apply to identity-related projects.

- Ensure the project has clearly defined objective and scope
- Identify and obtain input from representative stakeholders
- Define clear ownership and roles for all parts of the project
- Create a realistic project plan based on stakeholder input
- Track progress regularly to quickly identify causes of any delays

That is excellent advice, but in order to create a realistic project plan, you have to know what typically needs to be done for a particular type of deployment. What if your project team does not have that knowledge? A frequent cause of project issues and delays is simply not accounting for certain requirements. Many an Identity Management project has been delayed by overlooking requirements at the beginning.

Have no fear &mdash; this post will outline several of the most common oversights and pitfalls for identity projects and how to avoid them. These can be grouped into roughly three categories:

- Identify requirements for the entire identity management lifecycle, not just logging in
- Plan for identity failure and change, so you are ready for such events
- Address security and compliance requirements

If you consider the above at the beginning of your project, you’ll have fewer surprises along the way to derail your project.

![Illustration of how to have a succesful Identity Management Project](https://images.ctfassets.net/23aumh6u8s0i/5jn0njMm1bewSR23umVL05/7493c9c60e54aca5b61737fca77d3075/idm-project-dismantle-02)

## Guidelines to Identify IDM Project Requirements

The first thing to check is that your requirements specification takes into account the entire identity management lifecycle. I often tell people that they’ll spend more time on implementing how to log out than how to log in, so they should define how logging out should work early in the project and allow plenty of time in a project plan for testing and implementation. Beyond logging in and logging out, there are several other requirements which may lead to unpleasant surprises and delays if forgotten at the beginning. The following list may help you surface requirements early on:

### How Will User Accounts Be Created?

Will users need to sign up or do they already exist somewhere else and need to be migrated? If users need to sign up, where will that occur, and will all information be collected at once or is [_progressive profiling_](https://auth0.com/docs/user-profile/progressive-profiling) needed? If users need to be migrated, consider that passwords are usually hashed and not transferable from one system to another as-is, necessitating a [_trickle-migration_](https://auth0.com/docs/users/migrations/automatic) approach or [_password reset._](https://auth0.com/docs/connections/database/password-change)

### Will User Profiles Need to Be Synchronized?

Will user profile information need to be synchronized between a system of record (authoritative source) and other points, such as application user stores? It simplifies operations if synchronization can be avoided but legacy systems may require this.

### Username Uniqueness

Identify the attribute used to identify users when logging in as well as across all applications and ensure that the username identifier will be unique for all users. You'll need to especially consider any mergers and acquisition activity that could occur. This will help identify if any mapping of identifiers might be needed across systems.

### How Will Users Log In?

Okay, no one forgets this one, but the devil’s in the details. Be sure to think about what forms of authentication are appropriate for your use case: username and password? [_Passwordless_](https://auth0.com/passwordless) forms of authentication? If your application deals with sensitive data or transactions, is [_multi-factor authentication_](https://auth0.com/docs/multifactor-authentication/) appropriate?

> Auth0 Passwordless is a drop-in authentication system based on Email or SMS, that improves security and user experience. Check it out at [auth0.com/passwordless](https://auth0.com/passwordless).

![Screen showing different passwordless authentication methods with Magic Link selected](https://images.ctfassets.net/23aumh6u8s0i/4y4Kb6Sx3JEwxEGaxTR5xU/49137e92bae8c15bfe3c48b1a35eeacb/magic-link)

### What Devices Will Be Used?

Authentication flows do not work identically across mobile and desktop types of devices. Sadly, in this day and age, this is still a thing. Security configurations, such as browser configuration for trusted sites or mobile device management software can impact the use of cookies, fingerprinting and such &mdash; all of which can impact authentication flows. Be sure to identify the devices that users will use and test across all of them early on in the development cycle.

### Is Single Sign-On Needed?

If you offer multiple applications to users, should users be able to log in once and then access other applications without signing in again? If yes, be sure to consider whether all the applications in a [_single sign-on_](https://auth0.com/docs/sso/current) circle use the same authentication mechanism and user repository. If there are multiple user repositories, will authentication against any of them suffice for access to all the applications or are the requirements more granular?

> Auth0 supports [universal login](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) on customer apps. In contrast to embedded login, this offers increased security and a shorter setup time.

![Auth0 Universal Login offerings](https://images.ctfassets.net/23aumh6u8s0i/21BR2xIUfU721nga9W1FqO/184597f0a961d89938bb9923b08e6a73/centralized-embedded-diagram)

### Should Multi-Factor Authentication (MFA) Be Used and If So, When?

MFA offers a higher level of authentication for better protection of sensitive assets. Be sure to consider if it will be used upon initial authentication or only when the user accesses more sensitive content/transactions. There are many forms of MFA available, so be sure to experiment with several and select a form that is suitable for your user population. Be sure to test the usability of the initial registration, as well as any reset processes needed if users change devices, phone numbers or any other aspect of the MFA flow. Cumbersome processes can cause user frustration and support headaches.

> [Learn everything about Multifactor Authentication (MFA)](https://auth0.com/learn/get-started-with-mfa/) and how you can start using it right now in your application.

![Eanbling Multi-factor Authentication (MFA) from Auth0](https://images.ctfassets.net/23aumh6u8s0i/5aPgE6GMpGdmaThY8OOHth/a615c93e951b8b648431d86101b81033/enabling-mfa.png)

### What Should Happen When the User Decides to Log Out?

Handling clicks on the [_Logout_](https://auth0.com/docs/logout) button may be trickier than it seems, so pay attention to it early in the design. At a minimum, any session maintained by the application should be terminated. If an application delegates authentication to an external identity provider/authorization server, there may be additional sessions to terminate. Terminating those additional sessions, however, may pull the proverbial rug out from the user’s activity in other applications. Be sure to understand all the sessions that are created when a user authenticates as well as any other applications that depend on the same sessions, before finalizing desired logout behavior.

### How Will Browser Configuration Influence Sessions?

Be sure to understand the impact of browser configuration on sessions. Some browsers have configuration options to reconstitute previous sessions after the browser has been shut down and restarted. Do not rely on browser shutdown to terminate user’s login sessions. In troubleshooting user issues, support teams will need to be aware of such browser configuration options and how to instruct users to start a clean new session when troubleshooting. In addition, be sure to ask if your application will be accessed from shared devices and if so, consider how to protect users that forget to log out.

### Session Timeouts

When users log in, for how long should their session remain valid? If they forget to log out, should their session be terminated after some period of time? You may want to have an idle timeout that occurs when a user has been inactive for some period of time, as well as a maximum timeout that occurs regardless of user activity. Don’t forget to consider the appropriate timeouts for MFA sessions and whether users should be allowed to bypass MFA from known or frequently used devices. Similarly, you should specify whether users should go through the MFA flow every time they log in or will be allowed to only do it periodically, such as every 30 days.

> Learn more about how [_session timeouts_](https://auth0.com/docs/dashboard/dashboard-tenant-settings#session-timeout) are managed with Auth0.

![Login session management at Auth0](https://images.ctfassets.net/23aumh6u8s0i/6zsFj7vQJuZliTFfCNImrl/135fa606ee2c7cc3c9d78b9120551e9f/auth0-dashboard-session-timeout)

### Deprovisioning: What Happens When It’s Over?

Parting is such sweet sorrow… or not. You should consider whether there will be a need to terminate or suspend a user’s account. You should consider audit needs which may dictate that accounts be suspended, but not deleted so that if fraud is detected at a later time, you have sufficient information to tie a user ID in a log file back to a real person. You should also take into account your data retention policy - you do have one, right?

Last but not least, you should ensure specifications in this area align with any relevant [_privacy regulations, such as the GDPR_](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance#conditions-for-consent), that apply to your target user population. Be sure to research and comply with any “right to be forgotten” clauses in privacy legislation for relevant jurisdictions.

### Password Reset

Nothing lasts forever, and passwords are no exception. Be sure to design flows for users to reset passwords, both when they remember the old password and when they do not. You should also specify the requirements for password complexity and whether passwords should expire, requiring rotation, and if so, how often. There is now a debate about whether password expiration and rotation is helpful or not, so you should read up on that and consider the[_ latest recommendations on that front_](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/). Forgotten password reset flows are a common attack vector for hackers, so be sure to include these flows in your security testing.

> Additional reading: [Easy Ways to Build a Better P@$5w0rd](https://www.nist.gov/blogs/taking-measure/easy-ways-build-better-p5w0rd).

![NIST Password Tips](https://images.ctfassets.net/23aumh6u8s0i/OMVAJJhH11CKwrtI7qNvI/e1df75bbc6682600d48c6bed683f8eaf/password_tips)

[_Source_](https://www.nist.gov/sites/default/files/styles/960_x_960_limit/public/images/2017/10/04/password_tips.jpg?itok=uhqF7cwb)

### Blocked Users

It’s a fact of life that, well… life happens. Be sure to consider whether there will be situations where users need to be suspended for a period of time. This could be due to delinquent bills or something as innocuous as someone being on temporary medical leave. Consider the situations that might arise and how to flag users impacted by such situations as well as the process to [_unblock_](https://auth0.com/docs/user-profile#block-and-unblock-a-user) them when the situation has ended.

### Anomaly Detection

To protect your application you may want to automatically [_detect anomalous situations_](https://auth0.com/docs/anomaly-detection) such as:

- A particular user having a large number of failed logins.
- A user logging in from two widely separated geographic locations within a short amount of time.
- Users whose credentials have been compromised and published on the internet in databases of hacked passwords, such as Troy Hunt’s [_haveibeenpwned_](https://haveibeenpwned.com/).

> Auth0 provides three built-in shields that [detect anomalies](https://auth0.com/docs/anomaly-detection) among users in an app's system.

![Anomaly detection example - offered by Auth0](https://images.ctfassets.net/23aumh6u8s0i/61niknHzbOQhzVr96l3lvX/3eea80eace03aa11338ca81e2f102982/anomaly-detection-overview)

### Privacy/Compliance Requirements

Be sure to dig into privacy and compliance requirements up front as they can be time-consuming to fully understand and can impact core processes such as user signup, use of user profile information, and data retention practices as well as logging and backups. There may be several processes you’ll need to implement to respond to user queries such as what information you hold about a user and processing a user’s request to be forgotten. Requirements differ somewhat by user location, so you’ll need to consider the jurisdictions that apply based on where your users are located.

### Audit Logs

You will want to define your requirements for [_logging_](https://auth0.com/docs/logs) and ensure that you will be capturing the information needed for security and audit needs as well as any marketing analytics or charge-back purposes. Consider how long you need to keep logs, weighing audit, security and privacy needs. Logs are most useful when they are actually checked, so you’ll also want to consider how to [_export and analyze logs_](https://auth0.com/docs/extensions#export-auth0-logs-to-an-external-service) data with any of the powerful logs analytics tools that exist today.

### Consider How Identity Information Might Change Over Time

Don’t forget to consider how identity information might change over time. Will usernames need to change for any reason such as legal name changes? Might a user’s status change, such as in the case of a temporary worker becoming a permanent employee and if so, will the process result in overlaps of state where the user has two profiles in existence at once?

## Recap

Auth0 has written some guides for typical customer scenarios that may help you flesh out additional requirements:

- [_B2C scenario_](https://auth0.com/docs/architecture-scenarios/b2c)
- [_B2E scenario_](https://auth0.com/docs/architecture-scenarios/b2e)

The above list of points should give you a running start for what requirements to specify for an Identity Management project focused on authentication and authorization for your applications. By identifying and planning ahead for critical requirements, you’ll reduce the number of project delays caused by critical requirements surfacing part-way through the project. You can further reduce risk by identifying the requirements that will be hardest to meet or involve the most unknowns, and scheduling work on those areas early in the project plan.

![Illustration of how to have a succesful Identity Management Project](https://images.ctfassets.net/23aumh6u8s0i/3xcfKK8nNxOokMAfLlleRt/0bd242d10db9f3195af953a66fa63612/idm-project-dismantle-01)

In part 2, we will cover some things that can change over time or go wrong with the identity aspects of a project. [Read How To Have a Successful IDM Project (Part 2)](https://auth0.com/blog/how-to-have-a-successful-idm-project-part-2/)

<include src="asides/AboutAuth0" />


How To Have a Successful IDM Project

Auth0 CISO Joan Pepin explains how making security easier makes things safer for users, but requires more planning from engineers to render security seamless.



**TL;DR:** Security vs. Convenience: To truly keep info safe you need to pull off both — here’s the why and the how.

---

In the security industry, everybody used to believe that to be secure, something couldn’t be convenient. Security and convenience functioned only in opposition. Making access hard was the best way to keep info safe.

But then we ran up against the human factor.

Since the first password breach — only a year after passwords were invented — we’ve been looking for ways to make passwords safer. First, we made them harder. Which means we added increasing levels of complexity to the the string of characters that served as an access key and made things even worse by demanding that passwords be changed at regular intervals.
This gave birth to the password on a Post-It Note that gets put up right beside the monitor.

For people who don’t want Post-Its everywhere, Amazon now sells a password diary. My review, which pointed out the security risks of this product, was voted “unhelpful” by 300 people. Apparently, many silent others disagreed with me. Amazon now carries multiple versions of the password diary, each of them with positive reviews in the hundreds.

<include src="TweetQuote" quoteText="@Auth0 Ciso Joan Pepin explains how making security easier makes it safer. @CloudCISO_Joan"/>

## The Argument for Easy

The proliferation of password diaries on Amazon is an understandable (if unwise) response to a technology landscape that is getting more diverse and more complicated daily. Consumers are demanding more customization and employees want the same kind of experience that they have on their consumer devices. We now have non-technical people accustomed to accessing very technical services throughout the course of their day — and they don’t want to remember five or more different passwords to get everything done.

Security teams can create systems and protocols — that’s a large part of what I do as Auth0’s CISO — but none of this keeps anything safe if people won’t use the systems as intended. So, if we know they are going to go around the procedures and protocols, why not make it easier for them to comply?

## NIST Simplifies Password Guidelines

After watching people try to respond to tortuously complex password requirements, NIST (the National Institute of Standards and Technology) revised [guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) last summer. As a non-regulatory division of the U.S. Dept. of Commerce, NIST only has power over standards for federal sites in the United States, but it exerts deep influence on corporate standards everywhere. Companies often use NIST as a basis for their own policies.

So NIST’s new take to digital identity offered a host of guidelines, including the recommendation to only change your password if you believe you’ve been compromised.

Ironically, asking people to create longer passwords that might be easier to remember and changing them infrequently increases security.

Making it easier, makes it safer.

Except that NIST also recommends multifactor authentication, which can appear inconvenient, if not hard.

## Multifactor’s Already Convenient (Really)

You need a strong gate between the rest of the world and your set of authenticated users. As I mentioned earlier, you need that gate to be convenient or your users will figure out a way around your protection.

On the outside, NIST’s recommendations for multifactor authentication looks like they’re reverting to the need for security to offer a challenge, but really, what is multifactor authentication?

Multifactor verification just requires that users demonstrate at least two of the “something you know” (like a password), “something you have” (like a phone), and “something you are” (like a fingerprint) drastically decreases the probability of a successful attack.

![If you’ve ever used an ATM, you’ve used multifactor authentication.](https://images.ctfassets.net/23aumh6u8s0i/3BDVo7QFcEHkagMSGqojTw/66a82eac8f085308b4eed786fe0ae995/atm)
<p>_If you’ve ever used an ATM, you’ve used multifactor authentication._</p>

Multifactor authentication has been around since the 1980s, when ATMs came into use. “Something you know” is your PIN number and the “something you have” is your ATM or debit card. That stereotypical grandmother that people like to mention in their examples has been using multifactor authentication since before some of us were born.

## Easier Requires More Engineering Effort

Security industry experts weren’t entirely wrong when we first worried about the danger of ease. Easy can be risky if enough thought hasn’t gone into the user experience.

An engineer has to do a lot of thinking to make things easy. Possible use cases, potential tech, interactions, and threat vectors like hacking, accidental use, and misconfiguration all require thorough consideration and planning.

Baby and pet cams are a prime example.

After setting one up over your WiFi your customers check in on their kid (or dog) from work through their laptop or phone.

Seems like a great feature, right?

Except now you’ve given end user the ability to access a live feed of a child over the internet. You need to think about how you’re going to secure that feature because if you just put a web server on the camera, Google will index it because Google indexes web servers. If someone knows how to do the search string, they can get all the babies in a single search.
Making this safe requires deliberate thought from an engineer.

Consumers and employees are starting to expect a seamless user experience tailored to their personal preferences, geographic location, and devices — all of which adds complexity engineering a flexible solution.

### Ease Satisfies End Users Need for a Positive Experience — and Security

As I mentioned during the Auth0 Security Meetup, I’m seeing a trend towards accountability from organizations and governments, but the driver of all that accountability is actually the end user.

Regulations like [GDPR](https://auth0.com/gdpr) give individuals the power to protect their personal data, while building in the expectation of swift breach notification.

Personal data protections are also under consideration in other countries.

While lawmakers may not always understand cybersecurity best practices, they do understand constituent expectations. A huge portion of a constituent’s life happens online — and they expect to be safe.

In situations where they aren’t protected, I expect consumers will start holding companies accountable. If governments fail to protect them, they will vote with their wallets.

<include src="TweetQuote" quoteText="Security industry experts weren’t entirely wrong when we first worried about the danger of ease. Easy can be risky if enough thought hasn’t gone into the user experience. @CloudCISO_Joan"/>

## Getting Expert Help with How

When you’re creating a new app, your main focus is largely on what your customers are going to do with it. How they get access can be an afterthought or something that can be viewed as easy, because setting up a database and making it talk to a login box can be done quickly.

It’s much harder to keep all that data safe.

One of the smartest things an engineer can do is to turn to someone who fends off hacks on a daily basis. Not a cryptography expert? Great. You’ve realized you shouldn’t waste your time on encryption.

Companies like GM have leveraged the skills of experts in transmission and tires and other products to create their now profitable cars. That same strategy can be effective in a digital situation. Apply your considerable skills to your product’s core and let expert third-parties (like Auth0) handle the authentication and authorization to help you create a safe and seamless end user experience.

<include src="asides/AboutAuth0" />


Security vs. Convenience

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

When your data isn't organized, you lose your competitive advantage as an organization


Imagine your customer support (CS) team receives an angry complaint from a particular user, R. Michaels. R. Michaels was charged for your company’s service although he was sure he canceled it. He says he's going to file a chargeback with the credit card company, at additional cost to your firm — and complain on Twitter.

Meanwhile, your growth team is preparing an email to a segment of its most active and engaged users, of which one is “Ronald Michaels.” The email has the cheeky subject line, “How's our favorite customer doing this morning!?”

Unfortunately, the email meant for Ronald Michaels—thanks to a data integration error—goes instead to R. Michaels (angry CS case).

Since your CS team still hasn't gotten back to R. Michaels, this sets him off even more and leaves your CS team frustrated that they've been put into an even worse position with the customer. R. Michaels goes ahead and publishefs his scathing online review of your team's incompetence.

<include src="TweetQuote" quoteText="With proper data management and integration, you don't need to worry about mixed messages."/>

With proper data management and integration, you don't need to worry about such mixed messages. But the true benefits of strong data integration go far beyond avoiding embarrassing situations—used right, a strong data integration plan can be the foundation of better customer engagement and higher revenues for your business.

## What is Data Integration?

Data integration is the process of combining information from separate databases into a usable form for sharper analysis. When you have a strong data integration plan, you can get a [true 360 view](https://auth0.com/blog/360-view-of-customer-by-managing-identity/) on your customers without having to pay an expensive outside agency or rebuild all of your infrastructure from scratch. That's not all, however—a strong data integration plan can also help you get users engaged with your product faster.

Imagine you're a young fintech company rolling out a big new feature update on your advisory platform. You're particularly interested in how your female millennial customers use it, so you email every user enrolled on your platform as a woman, A/B testing your emails to see which combination of value proposition and headline get the most click-throughs. Once that test is done, you analyze the user response, segmenting by social channel and user activity types:

* Did your Facebook fans or Twitter followers use your new features more often?
* Were users who are more active on your help forum more likely to share the news of the new features with their friends, or less?
* What about users who submit more or less help tickets?

Every team at your company uses this data to understand something about your user base:

* Finance: which user cohorts are the most valuable to pursue in the future?
* Growth: which kinds of future experiments could be most powerful?
* Marketing: which future promotional campaigns could be most effective?
* Customer Service: how to create better documentation for new users.

A full picture of a single user includes data from her Facebook likes, Twitter mentions, Instagram posts, along with other pieces of her life the Web has captured, including college or university major, graduation date, shopping history, and more.

It also includes every action they take on your app, and when; how long
they've been using it; and/or how long they've been churned for. It includes every email they've received, and whether they've opened them or clicked through or not.

Each of these pieces of data lives in a different format—once you can bring them all together, however, you unlock a world of huge possibilities.

## Why Data Integration Is Critical

As both examples illustrate, a data integration strategy is key to deeply understanding your user base, along with avoiding miscommunication and other costly errors. With the right tools in place, a myriad of new opportunities will open for your organization.

<include src="TweetQuote" quoteText="A data integration strategy is key to deeply understanding your user base, along with avoiding miscommunication and other costly errors."/>

You can:

### Personalize your experience

A data integration plan, working alongside a tool, such as social login, can have enormous benefits. While many see social login as just a simpler method for logging in, the real power of this approach lies in the data, which social login pulls at each step of the process to tailor the experience to the individual user.

<p>
<img alt="Personalize your experience" src="https://images.ctfassets.net/23aumh6u8s0i/5Acu0OjZF9a18zijtnbRyP/1fe70cf82e9dc972b351fd9c7b37dcfb/messenger-and-chat-bot" style="width: 500px; display:block; margin: auto;" />
</p>  

A well-functioning social login process can help improve customer conversion rates, rapidly move users to activation, and drive down any churn to help re-engage and retain existing users. The ability to expand and enhance the quality of your user base is critical to sustainable growth and building your brand.

### Smooth any onboarding friction

Users don't feel like making yet another account with yet another password. You need sign-up that reduces friction and helps people get directly to your product.

<p>
<img alt="Smooth any onboarding friction" src="https://images.ctfassets.net/23aumh6u8s0i/6RHgVvj7xNihIN2yzgyNyj/4034e9407c8a9e65647554530ba47eba/what-is-social-login" style="width: 200px; display:block; margin: auto;" />
</p>  

Social login has the ability to boost your conversion by up to [20%](https://www.quora.com/What-impact-does-social-login-have-on-conversion-rates). With [Auth0](https://auth0.com/docs/identityproviders), you can pull data from someone's social profile directly into their user profile. This bypasses people filling in arduous questions about their location and birthday, for example. A strong set of data integration tools is essential to create this transition.

### Increase internal data security

Data integration ensures that the information your organization collects is accessible in digestible forms to the right people. Yet do thousands of company employees need access to a select batch of sensitive files? If your identity and access management (IAM) processes are poorly controlled, can you prove that your company data is not at risk?

<p>
<img alt="Increase internal data security" src="https://images.ctfassets.net/23aumh6u8s0i/4fDg1ZbuaJA2akaGBwOhYL/4cb0af9e46c3a489a1365aaf7302e0d9/data-security-in-the-information-age" style="width: 700px; display:block; margin: auto;" />
</p>  

The right data integration strategy will be built on IAM tools, such as those belonging to [Auth0](https://auth0.com/learn/cloud-identity-access-management/). With these, you can authenticate, authorize, and track users of your data at all times, and set [rules](https://auth0.com/docs/rules/current) to comply with your usage policies. For example, you can create rules that define specific times, locations, and devices your users may log in.

## Tools For Data Integration

The data integration process requires standardizing multiple forms of information. This often breaks down into:

* Extracting the data: pulling it from its source system and converting it into a single, consolidated data warehouse format.
* Transforming it. This can involve cleaning (e.g., mapping NULL to 0), filtering, splitting columns, and/or applying business rules to calculate new dimensions.
* Loading transformed data into a  repository for analysis.

The below are a sample of popular tools for integration (although by no means an exhaustive list).

### Segment

[Segment](https://segment.com/) is a single platform, which quickly collects, stores, and routes user data to hundreds of tools with a simple click. It can be critical for all segments, which rely on this data, including analytics, marketing automation, email, user testing, error reporting, and support.

![Segment Flow](https://images.ctfassets.net/23aumh6u8s0i/2AtqnBruaeY7xroq5ykjYS/360ed268431bff8649e305d6b79079c8/segment-auth0-flow)

With Segment, engineers can eliminate time spent installing and maintaining analytics tools, marketers are able to quickly test campaigns, and BI teams have the capacity to export raw data into their internal systems and databases.

### mParticle

As with Segment, [mParticle](https://www.mparticle.com/) collects data from a range of inputs, such as the Web, mobile apps, and feeds from external SaaS providers, and forwards it to output services for audience targeting and push notifications, attributions, storage, and further analytics.

![mParticle](https://images.ctfassets.net/23aumh6u8s0i/2lchvs0bqj1qGtBeR3ZolS/b9c7ca905271e35eeb708f1e6045c28d/mparticle)

mParticle focuses on two types of inputs: events (how users interact with an app) and audiences (a focus on a specific segment of app users, such as women who have invested more than $10,000 on your app). mParticle’s creation of Connections between these inputs and outputs facilitates the enrichment and transformation of data prior to being put to use.

### Clearbit

[Clearbit](https://clearbit.com/) has provided its services to a range of tech companies, such as Asana, Braintree, Slack, Stripe, Zendesk, and more. It offers its customers nearly a dozen APIs to mine publicly available data sources  for information on individuals and companies.

![Clearbit](https://images.ctfassets.net/23aumh6u8s0i/1dSy9DGvaBJRy8D1nKjQ4b/c48562ed0d1768d221a412e73da33da9/clearbit)

Clearbit allows developers to incorporate this data from a variety of sources into their organization’s apps and build customized tools. In addition, marketing teams are able to easily integrate these points into a fuller picture of their target audiences.

## To Secure and Hone Your Analysis, Employ An Excellent Data Integration Plan

Data management and integration can both help ensure regulatory compliance if you hold sensitive user data and support your teams in developing sharper insights. In turn, this can allow more targeted marketing and other forms of direct engagement with your community, leading to stronger sales and better overall growth.


3 Reasons Your Data Integration Plan is Important

By failing to plan for data breaches, you leave yourself vulnerable to inevitable attacks



While a total of 974 publicly disclosed data breaches may make 2016 sound like a hallmark year for data breaches, it gets worse when you realize how many organizations may not even know they were hacked.

Reporting is in some ways a lagging indicator. For example, it took Yahoo!, until December 2016 to report that 1.5 billion user accounts had been hacked—and that breach occurred all the way back in back in 2013.

The biggest mistake most companies make? Storing passwords without hashing and salting them. By not taking care of this very simple security precaution, companies leave themselves, and their users, vulnerable to attack.

1. Yahoo!: 1.5 billion accounts (2013 & 2014)
2. Friend Finder Network: 412 million accounts (2016)
3. MySpace: 360 million accounts (2016)
4. LinkedIn: 165 million accounts (2012)
5. Heartland Payment Systems: 130 million accounts (2008)
6. Target: 110  million accounts (2013)
7. Sony Online Entertainment: 102 million accounts  (2011)
8. Rambler: 98 million accounts (2014)
9. Dropbox: 68 million accounts (2012)

What's most concerning is that the trend does not appear to be abating or slowing over time. On the contrary, it appears that breaches are growing worse over time as user data is consolidated in increasingly large web repositories,  attackers become more sophisticated, and as large corporations remain slow to implement better security.

## How Breaches Happen

Storing passwords in a form other than plain-text adds an extra level of security to user data. Hashing is necessary, but for lost data to be rendered useless, passwords also need to be salted.

![Password salting and hashing](https://images.ctfassets.net/23aumh6u8s0i/5xlJHP6tv1UqMM1g6jMAKw/8a405dfd1872bbb1b3aefe6bb5f14965/password-salting)

Adding a salt string to passwords ensures a unique hash is stored. This added security is incredibly straightforward to implement, but it's alarming to think that more companies aren't using it.

For Rambler, the so-called Yahoo! of Russia, user passwords weren't even hashed—they were stored in plain-text. This major cyber security faux pas left them susceptible to attacks. The fallout was even bigger than originally thought, because millions of users used the same password on multiple sites, making it easy for hackers to breach those as well.

To its credit, the Friend Finder network employed the use of SHA1 hashing to protect user passwords. But it fell short of adequate protection by failing to salt the passwords. This oversight made it ridiculously easy for hackers to reverse engineer passwords to gain access.

Just how prevalent is this kind of mishandling of user data?

Of the 165 million passwords stolen from LinkedIn in 2012, **71%** of them were hashed but not salted. Any motivated hacker looking to turn a quick profit simply had to load the hashed passwords into an app to reverse them and sell them.

![SHA-1 conversion and lookup](https://images.ctfassets.net/23aumh6u8s0i/5Negi1B32Q8W89RqoeDQIY/1dc889f39941babed8f0d5d4658c19db/sha-1-reverse-lookup)

In the case of Yahoo!, after their first hack in 2013, they began hashing and salting their passwords using the Bcrypt method. However, not all stolen passwords were protected in the 2014 hack. It is possible that their failure to disclose the first hack meant users didn't change their passwords to take advantage of the additional security measures. Therefore, they weren't covered by the new encryption.

### Breach Stats

Since 2013, over [5 trillion user records have been stolen](http://breachlevelindex.com/). With the number of breaches growing, the reality is that they are inevitable. Until all companies take precautions to shore up their vulnerabilities, breaches will continue to haunt them and their users.

![Data breaches statistics](https://images.ctfassets.net/23aumh6u8s0i/6hyIBFKhBBU2oIxmaI4nnJ/d80283fa71c3e36945d5a9a18d7e9e35/data-breach-statistics)

Of these breaches, only **4%** of stolen information was secured by strong encryption, making them useless to hackers. Companies that take the added step of salting their passwords make them much harder to crack. Every password has a unique string added to it making password dictionaries like lookup and rainbow tables useless. Passwords and their corresponding known hashing no longer apply.

For the remaining **96%** of data, once stolen, hackers do not need an inordinate amount of time to unencrypt the passwords. For sites like LinkedIn that hashed user passwords but failed to salt them, each password can be exposed in a matter of seconds.

Companies have a huge responsibility to protect the sensitive data their users entrust them with, but users also play a role in re-enforcing cyber security.

As we've seen from combing through the anonymized data released from these leaks, it is clear users need to prioritize the use of stronger passwords.

## The Top 10 Most Commonly Used Passwords of 2016

Strong passwords, in combination with strong encryption, would make it extremely difficult for breaches to have the same negative impact they currently do.

Let's take a look at the [10 most common passwords](http://www.makeuseof.com/tag/keeper-worst-passwords-2016/) users tend to default to, as compiled by the makers of [Keeper Security](https://keepersecurity.com/), and how quickly each one of them could be brute-forced by an attacker, as determined by [How Secure Is My Password?](https://howsecureismypassword.net/):

1. 123456: Instantly
2. 123456789: Instantly
3. Qwerty: Instantly
4. 12345678: Instantly
5. 111111: Instantly
6. 1234567890: Instantly
7. 1234567: Instantly
8. password: Instantly
9. 123123: Instantly
10. 987654321: Instantly

As you can see, the top 10 most common passwords that people tend to use are pretty much the worst.

However, combinations of numbers and the word “password” aren't the only lousy passwords out there. You might think you're safe with your [FIRST_NAME][BIRTH_YEAR][SPECIAL_CHARACTER] password, such as:

* Johnson78!
* Alfred50%

and so on—but you're not. Yes, that was the easiest thing to type in when you were prompted for a better password, and officially it would take a computer about [six years](https://howsecureismypassword.net/) to crack this kind of password. But brute-forcing isn't the only method attackers have up their sleeves. If a hacker can infer it about you, or research you on social media to figure it out, don't put it in your password (no names or birth years!)

In the end, it's best in the long-term to avoid coming up with new passwords [at all](https://diogomonica.com/2014/10/11/password-security-why-the-horse-battery-staple-is-not-correct/).

## Total Impact of Breaches

More than anything, breaches cause short-term damage to company reputations. In the case of Dropbox, Yahoo! and LinkedIn, their brands were further damaged when they failed to immediately notify users of breaches. This lack of simple courtesy resulted in a dip in public perceptions of them.

![Dropbox data breach](https://images.ctfassets.net/23aumh6u8s0i/3XwCNcDI8TJBOLDiXMgmEp/e9ca103031d76aafee1092d2be603408/dropbox-data-breach)

For affected companies, the time and money lost trying to understand and fix breaches are astronomical. Sony estimated their cost to rectify the situation at **$171 million**. They also had to deal with **65** class-action lawsuits.

As for users affected by retail breaches such as Target's, an estimated [**$15 billion was stolen**](http://www.iii.org/fact-statistic/identity-theft-and-cybercrime) in 2015 alone. Users also have to spend time reclaiming their account after its been hacked. This can include updating their email settings, checking their devices for malware and checking if other accounts have been jeopardized. All of this takes time and energy and affects how they perceive the breached company.

## How to Protect Yourself

How do you protect against a breach?

First off, forget about teaching your users to create better passwords. People know what strong passwords look like in theory, but they do not care to remember a bunch of unique ones across different websites.

The most effective way to protect against breaches is to mandate the use of multi-factor authentication, at the very least when you have users logging in from unfamiliar IP addresses or other unusual circumstances.

At Auth0, we log approximately 16,000 login attempts using compromised passwords each month. These attacks target users not using [modern authentication](https://auth0.com/user-management) options like social connections or [passwordless authentication](https://auth0.com/passwordless). By putting the needs of our users first, we can use tools like our [Breached Password Detection](https://auth0.com/breached-passwords) feature to detect that users are typically exposed to six fraudulent login attempts each month.

For the safety of your users, use this approach and enable [password breach detection](https://auth0.com/breached-passwords). Make sure you have a [data breach response plan](https://auth0.com/blog/data-breach-response-planning-for-startups/)—it could be the difference between a cataclysmic breach and a disaster averted.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.


Data Breaches by the Numbers

We take a look at budget planning for startups and find out why making authentication part of the budget is more important now than ever



<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Forrester Research conducted a comprehensive analysis of our identity platform and determined that using Auth0 can yield a 548% ROI and $9.9M in savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.</strong>
</div>

---

2017 is coming and with it so do many tough decisions for startups and small businesses alike. Budget planning is perhaps the hardest of them. In this short article we will take a look at what is important for tech startups, how to aim for success in the coming year, and why you should consider authentication an important part of your budget. Read on!

<include src="TweetQuote" quoteText="Budget planning is tough, and authentication should be a part of it"/>

-----

## Introduction
December, the perfect time to review the failures and successes of last year. Startups fail and succeed based on their vision, so sitting back and reflecting on the things that went wrong is key to eventually becoming a successful, self sustaining company. An important part of this job is finding where exactly it is wise to use (or invest) the precious money from your investors. And in the world of ever cheaper, commoditized, software engineers, it is tempting to say "let's roll this feature in-house". This *might* be a great call. Think of Amazon: they developed a whole class of internal appliances and services. They invested millions on the necessary infrastructure, and, now, in retrospective we can say it *was* the right call. 

But what would have happened had Amazon made that same decision, to invest millions upon millions on the development of their own infrastructure and software, today? Would Amazon Web Services have been a success? Would their investment have payed off eventually? It is hard to say, but it probably would have costed them more. 

So finding the right idea on which to invest, or develop, is not just about the idea, but about the right time to do so. It is safe to say there are great alternatives for many things today. Buy, or develop them in-house? This is probably the single most difficult call software startups have to make today. An error in this area can make or break a startup or small business.

## Playing It Safe
There's no success without some risk, so identifying areas where your company *can* fail is of the utmost importance. Not only will this way of thinking show you great growth or investment opportunities, but it will also make it very clear which wars are worth fighting. For Amazon, yeah, developing world-class, globally distributed, datacenters was a war worth fighting. They had the vision, the opportunity, the time, and, fundamentally, a war chest big enough to survive failure in case they could not monetize their investment later on.

A different example: take a look at state-of-the-art chip companies. Keeping up with the pace of development and manufacturing requirements for the products that are coming out to the market is so crushingly exhausting, from an economic point of view, that it makes absolutely no sense to invest in manufacturing facilities unless you can keep the facilities at 100% full capacity. This results in interesting scenarios where competitors in the market are associates in manufacturing competing products!

Intel, probably the most advanced CPU manufacturer in the world, is the only CPU company that also owns their own manufacturing facilities (called "fabs" in the semiconductor industry). AMD used to own their own fabs, but it was so difficult to justify the expense of keeping manufacturing in-house, that they had to sell them. ARM, Nvidia and Apple do not own any fabs either.

We can spot a certain trend when it comes to technology companies: it is usually the first-to-market company that can reap most of the benefits of a big investment. This may sound too far removed with regards to startups, but think of it this way: most of the time, a startup is operating so close to running out of money, that, unless that startup is developing a first-to-market product, it is usually not worth investing in keeping that something in-house.

In the old days, every company kept their own mail server. Now you would be foolish to use something other than one of the corporate email providers such as Gmail or Outlook. They do what you could do much better and at a fraction of the cost.

> There are specific cases where a company might decide to invest in keeping a critical piece of infrastructure in-house. For example, a government institution might consider keeping an in-house email server a requirement to avoid denial-of-service attacks in case of conflict with the country that hosts Google or Microsoft's servers. Most of the time, this is not the case, however.

## Why You Should Not Develop Authentication In-House
Authentication is essential to all technology startups. Unfortunately, it is a complex subject. Not only a simple username/password is simply not enough (and inconvenient), but sensitive stuff can be accessed if your authentication system is compromised. In a sense, authentication and authorization are probably one of the most sensitive areas for technology startups. It appears deceivingly simple from the outside, but becomes a thorny subject as you start to learn its intricacies. Is your authentication system secured by two-factor authentication? Is an SMS fallback available? Are your users using passwords which have already been leaked from other sources? Are social logins implemented to bring more users to your platform? Can your system handle hundreds of thousands of users? Are your enterprise accounts supported and linked with your newer services? These are all tough questions for every startup. But with Auth0 things need not be this way.

![Social logins at a click](https://images.ctfassets.net/23aumh6u8s0i/DfHgQGni2SKeY28WfhIIi/c67598c34a3c56509307ec1e9705b7b3/social)

<a href="">Sign up for a free Auth0</a> account and learn why more and more companies are using an external authentication solution. You can get up and running in a matter of minutes, with support for features such as:

- [A visual dashboard for managing all settings](https://auth0.com/docs/user-profile)
- [Top tier security and availability](https://auth0.com/security)
- [Username/password authentication](https://auth0.com/docs/connections/database)
- [Social logins](https://auth0.com/docs/identityproviders)
- [Enterprise federation](https://auth0.com/docs/identityproviders#enterprise)
- [Passwordless logins](https://auth0.com/passwordless)
- [Multifactor authentication](https://auth0.com/docs/multifactor-authentication)
- [Single-sign-on](https://auth0.com/docs/sso)
- [Breached password detection](https://auth0.com/breached-passwords)
- [Programmable rules](https://auth0.com/docs/rules)
- [Easy integration for mobile and web apps](https://auth0.com/lock)

![Auth0 Lock](https://images.ctfassets.net/23aumh6u8s0i/1a5r3OSTVwrGQFEPk6ebvc/6450875cba0ca0e0dba8d99daee6f78c/lock)

Let us handle authentication for you so you can truly focus on what matters: delivering your product.

For example, consider the case of enterprise federation. The enterprise sales cycle is already too long. Meetings, contracts, and due diligence slow the sales cycle. Having to build authentication and enterprise federation proof of concepts for various enterprise connections delays the process further. Not being able to support enterprise federation the way a customer requires can cost you the sale. Having enterprise federation should be a "check-the-box" item rather than a feature to be scrutinized.

![Auth0 enterprise connections](https://images.ctfassets.net/23aumh6u8s0i/41AIv6yVWo8KryBCGn3oSe/1b466ea17aa01edb270cf4893d27982b/enterprise)

Auth0 features a comprehensive enterprise toolkit that supports features like federation through all major identity providers, single sign on (SSO), auditing, analytics, and enhanced security features like multifactor authentication and anomaly detection. Many of these features can be enabled and configured with the flip of a switch and a few lines of code.

Having a modern authentication platform does not result in increased revenue alone. Freeing up your developers to focus on building the unique features of your business, on the other hand, does. 

## Other Stuff To Keep In Mind
Unfortunately, budget planning is not all about what you can do in-house or buy from external providers. It also has to do with strategy. Here are some things we have found can make a whole world of difference:

- **Marketing**: we have found marketing is not all about showing your product or letting other people know your product or service exists. It is also about creating an audience. Rather than develop a product and then try to get people to but it, plan a marketing budget that includes elements that are useful to the audience your product caters for. In other words, consider reducing the money spent (or keeping it stable) in promoting a product, and increasing the money spent on building a community around your company.

- **Keep your employees happy**: this might seem obvious, but how many times have we seen a key developer leave early on becase he or she just wasn't happy with their job? Startups must value their top employees. It it the people that fundamentally trust the company and invest more than just their working hours in it that can make or break a product. Startups don't have the time or money to cope with employee turnaround. But don't be naive: keeping employees happy is not all about compensation. Consider keeping a part of the budget dedicated to out-of-office activities that employees can enjoy. Consider buying them equipment that they can take home. Consider running polls and asking them what would improve their mood at the office. Of course, this should never cause compensations to be affected.

- **Use data to make choices**: this can be applied to any department in your organization. Whenever you make a choice, make sure you have some way of collecting quantifiable data that can later be analyzed and turned into cold, hard facts about whether that choice was right. Consider including a dedicated data team for this purposes in the budget. Give them access to as many choices as possible and listen to their results.

- **Create a planning team**: using data has to do with learning about the results of a previous choice. A planning team, on the other hand, tries to analyze things before making a choice. For instance, have a dedicated team come up with budget and time-to-market figures for the development of in-house solutions before committing to doing them. Compare that with the external alternatives. In fact, do this for the authentication aspect of your company, you will be surprised.

## Conclusion
Budget planning is always a tough time for big and small companies. However, startups depend on making the right calls to survive until they can deliver a product. Keeping sharp focus on your product lets you use your resources and time in a much more efficient way. There is no point in developing in-house solutions to solved problems unless forced to do so. Successful companies understand this from the get-go and invest appropriately in the right external services and products. Authentication is, today, one of those services: tough to get right from the ground-up, and with great choices in the market. Invest wisely and reap the benefits. The sky is the limit!


2017 Budget Planning for Technology Startups: Authentication is Key

7752008352217db815996ab04aec46e6?s=80 avatar

7752008352217db815996ab04aec46e6?s=80

Guest Author

Matias Quaranta

Learn how to integrate Azure DocumentDB as your Auth0's custom user database and take advantage of this blazing fast cloud NoSQL database service.



---

**TL;DR:** In this article you will learn how to integrate Auth0 with the fast and scalable Azure DocumentDB as a custom database connection and use it in your Auth0 applications.

---

Auth0 offers a highly performant and secure user store to maintain your users’ profiles. It is also a common solution if you want to **store** your users’ login information in your **own database** where you keep all of your application's data; in this case, Auth0 provides you with several identity providers you can use to **integrate**. One such database is **Azure DocumentDB**, a blazing-fast **NoSQL** service for highly available and globally distributed applications.

During this article, we will guide you into **integrating Auth0 and Azure DocumentDB** so your users' profiles are stored on your cloud NoSQL database.

## Authentication integrated

Let’s start by noting the **diversity** of custom database identity providers that Auth0 supports.

This list includes MySQL, Sql Server (both on-premises and on Azure), PostgreSQL, ASP.NET Membership Providers, any Basic Auth web service and **MongoDB**. We will focus on this last one since Azure DocumentDB now supports the [MongoDB protocol](https://azure.microsoft.com/documentation/articles/documentdb-protocol-mongodb/).

![Auth0 custom providers list](https://images.ctfassets.net/23aumh6u8s0i/5YDcN2Zobu6KIQKTwo7Mz6/ceb7fe5f1f58b9d5f97f041b336469b1/providers)

>You can see the full Custom Database Identity providers' documentation in the [official docs](https://auth0.com/docs/connections/database).

The integration is achieved by **customizable [Node.js](https://nodejs.org/en/) scripts** that can be coded directly on Auth0’s configuration dashboard manually or using a wide array of templates.

To _sum up_, we will be using the MongoDB protocol supported by Auth0 identity provider to connect to our Azure DocumentDB and store/retrieve our users' information by custom Node.js scripts.

## Creating our database

As we mentioned before, Azure DocumentDB supports the [creation of databases that support the MongoDB protocol](https://azure.microsoft.com/documentation/articles/documentdb-create-mongodb-account/) (as of the writing of this article, this feature is in preview). We must access the [Azure Portal](https://portal.azure.com/) and filter for DocumentDB services to find the version with MongoDB support:

![Searching the Azure Portal](https://images.ctfassets.net/23aumh6u8s0i/46tUO7aKgIngsjtt5o9Xl2/e2f9d8067bcc32913bd769aefefd6760/portal-search)
![Creating our Azure DocumentDB service](https://images.ctfassets.net/23aumh6u8s0i/4jnaA1af9wBqZcRYBd0SWw/40b5cd80f5a9057695378347e9c21352/portal-creation)

Once created, we will be able to access our **connection string** credentials on the instance blade. We need to take note of these values because we will use them later on the integration:

![Obtaining connection string](https://images.ctfassets.net/23aumh6u8s0i/5VhrjNoe4P21IxjEZbATHN/d210f820991d41aae13cae6600f1144b/portal-connectionstring)

After creating our service, we will proceed to create a **Database** and a **Collection** to store our data. If you are not familiar with the Database and Collection concepts for NoSQL databases, a Database can hold multiple Collections and each Collection will store Documents (in JSON format). You will be [billed](https://azure.microsoft.com/pricing/details/documentdb/) for _each Collection_, so plan your distribution accordingly.

>You can review the complete concept diagram in the [official documentation](https://azure.microsoft.com/documentation/articles/documentdb-resources/).

We will create an "auth0" database:

![Creating a database](https://images.ctfassets.net/23aumh6u8s0i/4Hpv8gIPflHC4ZVq3JV937/c6cb4db948cfef16a89c956c75bfd35b/portal-db)

And a "users" collection:

![Creating a collection](https://images.ctfassets.net/23aumh6u8s0i/1tsbGjkzMWA2bd5MfmdFGF/8bff858ba192585b62912b862390809f/portal-collection)

Azure DocumentDB lets you define a [dynamic and scalable throughput](https://azure.microsoft.com/documentation/articles/documentdb-performance-levels/) you can increase later as your application demands.

## Establishing the integration

In this step, we will use the connection string information we collected in the Azure Portal to create a **custom database provider**. In your Auth0 Dashboard, you will see a _Connections > Database_ configuration section:

![Auth0's Dashboard Connections menu](https://images.ctfassets.net/23aumh6u8s0i/3idCEu1z2jGhv12IZQOtLJ/1807cdf3162958eb5c7b9326831bdd12/dashboard-menu)

Once there, you can _Create a Db Connection_:

![Create Db Connection](https://images.ctfassets.net/23aumh6u8s0i/6tTuSPvTpnDkco5veH8nfc/6c87a231fa925cc5810349da4d6117d9/dashboard-button)

You will be asked for a _name_:

![Setting up Connection name](https://images.ctfassets.net/23aumh6u8s0i/2Udn4YepEwyH7ZQOpCdTYj/3a06b87a52342b5c13e8c8dc527ed1f9/dashboard-connection)

Once created, we will go to the Custom Database tab and enable the "**Use my own database**" toggle, which will activate the lower **Database Action Scripts** section.

The Auth0 editor allows us to define global variables to reuse on all our Node.js scripts. Let's start by setting a _global_ connection string; on the Settings subsection, we create a "ConnectionString" key and paste the Connection String value we obtained from the Azure Portal with the added _database_ name. 

Your copied string looks like this:

`mongodb://<your_service_name>:<your_password>==@<your_service_name>.documents.azure.com:10250/?ssl=true`

We will add the _database name_ after the port, like this:

`mongodb://<your_service_name>:<your_password>==@<your_service_name>.documents.azure.com:10250/auth0?ssl=true`

![Setting up global variable](https://images.ctfassets.net/23aumh6u8s0i/1U1XHtXLeqod4jdZzXIuAI/4518a6c11d470ac1bab4f15153b38483/dashboard-variable)

In our Node.js scripts, we can access this value by the global variable `configuration.ConnectionString`.

Now, we will define our custom _Login_, _Create_, _Verify_, _Change Password_ and _Delete_ scripts using our predefined variable:

__Login__

```javascript
function login (email, password, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
    users.findOne({email: email}, function (err, user) {


if (err) return callback(err);

      if (!user) return callback();

      if (!bcrypt.compareSync(password, user.password)) {
        return callback();
      }
      callback(null,   {
        user_id:      user._id.toString(),
        nickname:     user.nickname,
        email:        user.email
      });

    });  
  });
}
```

__Create__

```javascript
function create (user, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');

    users.findOne({ email: user.email }, function (err, withSameMail) {

      if (err) return callback(err);
      if (withSameMail) return callback(new Error('the user already exists'));

      user.password = bcrypt.hashSync(user.password, 10);

      users.insert(user, function (err, inserted) {  
        if (err) return callback(err);
        callback(null);
      });
    });
  });
}
```

__Verify__

```javascript
function verify (email, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
    var query = { email: email, email_verified: false };

    users.update(query, { $set: { email_verified: true } }, function (err, count) {
      if (err) return callback(err);
      callback(null, count > 0);
    });
  });
}
``` 

__Change Password__

```javascript
function changePassword (email, newPassword, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');

    var hashedPassword = bcrypt.hashSync(newPassword, 10);

    users.update({ email: email }, { $set: { password: hashedPassword } }, function (err, count) {
      if (err) return callback(err);
      callback(null, count > 0);
    });
  });
}
```

__Delete__

```javascript
function remove (id, callback) {
  mongo(configuration.ConnectionString, function (db) {
    var users = db.collection('users');
      var o_id = new mongo.ObjectID(id);
      users.remove({ _id: o_id }, function (err) {
      if (err) return callback(err);
      callback(null);
    });
  });
}
```   

And we can **test** the connection by running the _Create_ script from within the interface:

![Testing the connection](https://images.ctfassets.net/23aumh6u8s0i/DbMIqtC0nxWl2bUN7zb9l/7debe09b03d5fdc9752207aa90a3f99c/dashboard-test)

If we query the content of the Azure DocumentDB collection through the Azure Portal, we will find our created user:

```json
{
    "_id": {
      "$oid": "57f2983189b7550100e909e4"
    },
    "tenant": "ealsur",
    "connection": "DocumentDB",
    "email": "ealsur@ealsur.com.ar",
    "password": "$2a$10$hiSfzkpLjQUXivV4AvdakOCsTqDAYeSAx1Dn2HfPW6XuU28i5wgpq",
    "debug": true,
    "id": "57f2983189b7550100e909e4",
    "_rid": "u11qAL9JdQATAAAAAAAAAA==",
    "_self": "dbs/u11qAA==/colls/u11qAL9JdQA=/docs/u11qAL9JdQATAAAAAAAAAA==/",
    "_etag": "\"08007436-0000-0000-0000-57f298320000\"",
    "_attachments": "attachments/",
    "_ts": 1475516462
}
```

As you can see, this is a plain JSON object that is readable through any application-consuming collection.

Finally, we can create a new **Client Application** and define that we will use our custom Azure DocumentDB database on the **Connections** configuration.

>For a detailed concept explanation, you can read the [official Applications documentation](https://auth0.com/docs/applications).

![Defining the Application connection](https://images.ctfassets.net/23aumh6u8s0i/1T6umRxNDrBYvHLJzEMZN4/eb196da1bda24bf6d9ed569709c92a2e/dashboard-setup)

This will let our Client Application access and use the DocumentDB identity provider.

## User profile customization

Since Azure DocumentDB uses JSON to store our user profiles, we can take advantage of this dynamic data format and customize our **users' profile data** during sign-up.

To achieve this, we can use [Auth0's Lock](https://auth0.com/docs/libraries/lock) and configure the [required additional signup fields](https://auth0.com/docs/libraries/lock/v10/customization#additionalsignupfields-array-). This will generate the new fields and store them on our collection as part of the user profile without any extra work.

>You can also view the complete [Custom Signup documentation](https://auth0.com/docs/libraries/lock/v10/custom-signup) for a more detailed explanation.

## Conclusion

Auth0’s custom database **flexibility** lets us use one of the most dynamic and fast NoSQL service offerings available. Azure DocumentDB has the ability to **scale** and grow as your business or application does in a seemingly easy way.


Planet-scale authentication with Auth0 and Azure DocumentDB

667b1c82b6cc2241ff176d50c65da603?s=200 avatar

667b1c82b6cc2241ff176d50c65da603?s=200

Eugene Kogan

Security is a challenge at most startups. Here's some advice on how to create a data breach response plan for the worst case scenario, a large-scale data breach.



A serious data breach can have massive negative repercussions for any organization, including the loss of customers, revenue, reputation, even intellectual property. For a startup, it can mean the end of your business. 

## Security for the Lean Startup

Unfortunately, startups are often completely unprepared to deal with a major security incident that involves a breach of sensitive data. Unlike larger, more mature organizations, startups have no choice but to be lean and spend their limited resources carefully. Startups are also worth much less than bigger companies, and all of their energy is focused on growth and proving a business model. So it’s no wonder that they tend to spend less time and money on issues like security, let alone data breach response.

On the other hand, no one wants to see their fledgling company go out of business because of a security breach. So how much time and money does it make sense for a startup to invest in preparing for a breach? I think of planning for the worst as somewhat of an insurance policy. You hope that a data breach doesn’t happen to your company. You put some effort into preventing one through reasonable security controls. But just in case something goes wrong (like if that small security incident suddenly becomes a breach of your credit card database) you want to be prepared.

Now that I’m responsible for security at Auth0, issues like this are increasingly on my mind. It’s my first time working at a startup, having spent the last 15 years working security at huge organizations like AT&T, Amazon.com, and the US Department of Defense. These folks are seriously prepared for anything, from a laptop with malware to a major natural disaster. But when you join a startup, you quickly learn how to pave the road as you’re driving it. Auth0 is a rare startup, since security has been a core part of our business from day one. But even for us, it can be hard to find enough time to plan for unlikely (yet potentially devastating) scenarios like a data breach.

## Data Breach Response Plan is sort of a Big Deal

Let’s assume your startup has enough valuable intellectual property, a growing user base, and increasing amounts of customer data. It’s likely that you’re already dealing with security incidents on a regular basis. You have a decent incident response plan that is sufficient for the common security issues that small companies face, and it’s probably not a big deal to quietly take care of these in-house.

A data breach is not a run of the mill security incident. What I’m talking about here is a major “oh crap” moment when you realize your entire user database was posted on Pastebin, along with those passwords you meant to [hash](https://crackstation.net/hashing-security.htm) with something better than SHA-1 but didn’t quite get around to doing. (It’s ok, we’re a startup, right? No! Bad startup! That’s what [Auth0](https://auth0.com) is for.)

## Planning for the Worst

So how would your company respond to such a breach? Do you know the legal requirements for notifying your customers? Should you contact law enforcement? Who do you call first and how long can you wait? Every data breach is different, so I’m not going to attempt to provide specific answers to these questions. A lot will depend on how big your business is, how many users were impacted, where they live, what kind of data was lost, and so on. 

** My goal is to help startups prepare for a data breach and to come up with a simple response plan without spending too much money. **

For a small company trying to respond to a major security incident like a data breach, the best thing to do is to ask for help. It’s just not practical or realistic to have all the necessary expertise in-house, at least not until your business can justify having a very large (and expensive) information security organization.

** I recommend having the following relationships in place _before_ you need them: **

* Cyber liability insurance
* Legal council with data breach experience
* Public relations (PR) firm with data breach experience
* Incident response (IR) and digital forensics consulting firm

Having these vendors under contract prior to an incident occurring is critical. I hope it’s obvious why you’d want cyber insurance in advance, just like you’d want car insurance before getting into an accident. But there are several good reasons for lining up the rest of your response network in advance. First is the issue of timeliness. It takes time to negotiate a contract with a new vendor, even at a startup. But when you’re responding to an incident, you don’t have any time to spare. You’re already late! Also, a lot of the best vendors will be booked up for weeks in advance, working for their current customers. If your plan is to call an IR firm and hope that they can come help you later today, you will be sorely disappointed (or shocked by how much they want to charge you).

## The Costs Involved

Speaking of cost, there are ways to help reduce the upfront expense of being prepared while simultaneously reducing the cost of an eventual response. Lawyers are expensive, and I don’t have any tips on fixing that problem just yet. So pick a good lawyer with a track record of working on major data breaches, and sign a contract to have him or her on a retainer. You should be able to do this without paying much (or anything) up front.

A public relations firm will be a major asset when it comes time to communicate with your customers. The way a company handles a data breach in the public eye can have a huge impact to how people react. You want to provide just enough details but no more, be accurate so you don’t have to issue a correction later, and take responsibility when appropriate. A PR firm with experience in dealing with data breaches will be able to help you get the right message across. That can go along way to mitigating the damage to your reputation and hopefully reducing the number of lost customers. Once you have a PR firm finalized, it may be worth paying them to draft up some boilerplate press releases for potential breach scenarios, just to save time later on.

Something to keep in mind is that even if you already have a PR firm that your startup uses for standard PR needs, they might be totally clueless when it comes to security incidents. You need to ask them the right questions to find out. If your current firm isn’t up to speed, it’s worth having a second PR firm on board just for breach response. Remember, you want to take responsibility for what happened and be honest in your communications, so don't let anyone try to talk you into denying everything or shifting blame.

## Using an Incident Reponse Firm

Do you really need an external IR firm to help you respond to a data breach? If you’re a startup, the answer is almost definitely _yes_. First of all, it’s unlikely that you have a security team with deep technical expertise in digital forensics. You need that expertise to be certain that the cause and extent of the breach has been accurately identified. And if you can’t be sure of that, then you can’t be sure the breach has been fully contained. This is especially true if the cause is an intentional intrusion by an attacker, who may be actively evading your response efforts. For a serious breach that involves law enforcement, you’ll be grateful to have security consultants with LE backgrounds helping you out.

Even with a team of experts, there is never a 100% guarantee that everything has been found and cleaned up. But you stand a much better chance of doing this correctly if you engage an experienced IR firm. Also, when it comes time to do a press release, having a well-known firm on your side will help your users feel like you’re taking the incident seriously.

When choosing an incident response firm, reputation goes a long way. The firms with better reputations attract better talent, at least on average. As always, it pays to ask around for recommendations from people you trust. The bigger firms are generally all decent, and will have several advantages over the smaller firms. First, all major firms offer a zero cost retainer option, so you can sign a contract and have them ready to go without spending any money upfront. Second, they will probably be quicker to respond than a smaller firm, simply because they have more consultants available at any given time.

Another advantage bigger firms have (not just IR, this goes for PR and legal as well) is their breadth of experience. This can be especially important if your startup has customers in foreign countries with strict privacy laws or notification requirements, or if you’re using a complex or niche technology stack. Is your product built with OpenBSD, Scala, and Spark, hosted on Oracle’s cloud? You should probably make sure the IR firm has people with experience using those technologies. Startups tend to be on the bleeding edge and most security consultants simply can’t keep up.

## You Need Insurance

Up until now I’ve mostly avoided talking about cyber insurance, partially because I hate the word “cyber.” But the reality is that every significant business should have some cyber liability coverage to help absorb the financial burden of a large-scale data breach. You will need a policy that’s tailored to your company, its projected growth, and the risks associated with your industry.

The first step to getting cyber insurance is to find a knowledgeable broker. It pains me to say this, since we techies generally don’t enjoy dealing with middlemen like brokers, but that’s really the only way to go at this point (until a startup comes along and successfully disrupts this model). Again, ask your industry peers for recommendations on a cyber insurance broker, and don’t assume your regular business insurance guy will know anything about this stuff. If you start this process with the wrong broker, you may end up with an inappropriate policy that will fail you when it comes time to file a claim.

Selecting a cyber insurance policy should actually be one of your first steps, once you have a clueful broker and a basic incident response plan in place. The reason for this is that almost all agencies will have a list of approved vendors that you’re strongly suggested to use in the event of an incident. They have pre-negotiated rates with these vendors, and they are (allegedly) vetted and deemed competent. It’s usually possible to get an exception to use a vendor that’s not on your insurance agency’s list, but that means jumping through more hoops to get them approved. If you go down this road, your broker should help you out and provide advice. So if you have a particular PR or IR firm in mind that you really want to work with, you should let your broker know before you start shopping around for a policy. I don’t recommend signing any contracts until you are sure that your cyber insurance policy will allow you to work with the vendor in question. This includes legal council and other vendor categories that I haven’t even mentioned, such as credit monitoring and notification service providers.

## The 8-Step Plan

** Here’s my recommended action plan for getting your startup in a good place, ready to respond to a large-scale data breach: **

1. Think about security, work on improving it, and have a decent incident response plan.
1. Document some potential data breach scenarios that your company might face, including the kinds of data that might be impacted, the number of users you have, where they’re located, and so on.
1. Contact a few cyber insurance brokers, ideally from trusted recommendations. Pick one who is knowledgeable and willing to work with startups.
1. Work with your broker, CFO, and security team to find a policy that meets your requirements.
1. Be aware of the agency’s approved vendor list, and ask for exceptions (if you have any in mind) before buying a policy.
1. Carefully select vendors to help you in case of a breach. That includes at least legal, PR, and IR firms.
1. Sign a contract with these vendors so that they are ready to help you respond at a moment’s notice. Go for zero cost retainers if that makes financial sense for your business.
1. Review all of the above as your startup grows and changes over the year. If your revenue explodes, you will need to increase your insurance coverage sooner rather than later.

<include src="TweetQuote" quoteText="Think about security, work on improving it, and have a decent incident response plan."/>

You can never be too prepared when it comes to security. So what are you waiting for?


"plan"