Pradheepa Pullanieswaran

Pradheepa Pullanieswaran is a Developer Advocate at Okta, with a real love for backend and open-source technologies. She has worked in enterprise and web technologies for over a decade and now on the journey of helping developers to better secure their application. She is also an active member of Women Who Code and mentors women to step into the software industry. She loves to read and spends time with her family in her spare time.

Staff Developer Advocate

Web Authentication API (WebAuthn) is a W3C and FIDO specification that allows registration and authentication of users using public key cryptography instead of a password.

## Introduction

WebAuthn (Web Authentication) is an API specification by W3C that facilitates a secure way for users to log in to online services and websites using various authentication methods, such as biometrics (e.g., fingerprint or facial recognition) and hardware-based authenticators (e.g., USB or NFC tokens). 

## Key Features of WebAuthn

### Phishing resistant

WebAuthn uses [public key cryptography](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/); the user's private key never leaves their device. Since WebAuthn relies on cryptographic keys, it is resistant to phishing attacks. Assuming that a bad actor tricks the user into entering their credentials on a phishing site, the attacker cannot use those credentials because they are scoped to a specific domain. In short, a credential created for `webauthn.me` cannot be used by a fake website, `webauth.me`. According to [Verizon DBIR 2023](https://www.verizon.com/business/resources/reports/2023-data-breach-investigations-report-dbir.pdf), Phishing is one of the major attacks on a web-based application, as shown in the following image. Using WebAuthn, the web applications could have easily averted these attacks. 
 
#### Action varieties in Social Engineering incidents

![Action varieties in Social Engineering incidents](https://images.ctfassets.net/23aumh6u8s0i/EAHiNaQrRaclMm2OnR1TA/cc50a06eef6af456d6a02f74731d4f6e/Phishing_DBIR.png)
 
### High-Security standards 

WebAuthn leverages industry-standard cryptographic algorithms and protocols to ensure the highest level of security. It utilizes the [authenticators](https://auth0.com/blog/not-all-mfa-is-created-equal/#Factors--Authenticators--and-Assurance) to confirm the user's identity and create highly secure public-private key credentials. There are two types of authenticators: roaming authenticators, like hardware security keys, and platform authenticators, like your laptop or device, that support biometrics, such as fingerprint recognition, facial recognition, and voice recognition, depending on the capabilities of the user's device.

### Seamless user experience

With WebAuthn, users can authenticate with a single gesture or action, providing a convenient and frictionless login experience. While delivering a seamless and convenient authentication experience for users, it also enhances security.

## WebAuthn Roles

**Relying Party** - This is the website or online service the user wants to access. The relying party initiates the WebAuthn authentication process and verifies the user's identity.

**WebAuthn Client Device** - The user's device (e.g., smartphone, computer) that supports WebAuthn and communicates with the relying party. It is capable of hosting the private keypair in secret storage that a user can access through biometrics or PIN.

**User** - The individual attempting to access a relying party's website or services.

**Authenticator** - There are two types of authenticators, i.e., Platform Authenticators and Roaming Authenticators. 
 
Platform Authenticators refer to a specific type of authenticator built into the user's device or platform, such as a smartphone, laptop, or desktop computer. For example, a smartphone's fingerprint sensor or a laptop's built-in biometric recognition system can act as a platform authenticator. 
 
Roaming Authenticators are authenticators not tied to any particular platform but can be used to authenticate across multiple devices. They are also sometimes referred to as cross-platform or external authenticators. e.g., hardware security keys like the YubiKey.

<include src="WebAuthnMeCTA" group="A"/>

## How WebAuthn Works

WebAuthn's mode of authentication consists of a Registration Flow and an Authentication Flow. With WebAuthn, there are no longer shared credentials between the user and the relying party. A public-private key pair is generated with the help of the authenticators and is used instead of the password. Let us look into the user journey of the registration and authentication flows.

### Registration flow

#### A User visits a website

The process begins when a user visits a website or a web application that supports WebAuthn for authentication and requests the website to create a new account.

#### Initiating registration

The website, often called the relying party, begins the registration process. It generates a unique and cryptographically random challenge and communicates to the user's browser that it wants to register a new public-private key pair for the user.

#### The User chooses an authenticator to generate a public-private key pair

The user selects their preferred authenticator, a platform authenticator (built into their device, e.g., fingerprint sensor), or an external authenticator (e.g., a hardware security key). The chosen authenticator generates a new public-private key pair for the user and signs the challenge generated by the relying party with those keys. 

#### The Authenticator sends back the user credentials

The private key is securely stored within the authenticator, while the public key is sent back to the website along with the signed challenge and an optional private key ID.

#### The Website stores the user credential

The website stores the user's public key and the private key ID (if sent) and associates it with the user's account for future authentication; 

![WebAuthn Registration Flow](https://images.ctfassets.net/23aumh6u8s0i/6tOAUn8BVSqRrvnoe9fekn/d4614b12e493faeefc6d3cfaf36f3245/WebAuthn_Registration_Flow.png) 

The registration process is completed, and no more shared secrets are exchanged over the network between the user and the server, eventually reducing the risk of stolen credentials.

### Authentication flow

Once the user's registration is complete, the returning user can verify the credentials and log in to the application. Following are the steps that take place in the authentication flow for the user.

#### User returns to the website 
When users return to the website to access the protected resources, the web application prompts the user to authenticate. The user provides the username to the server.

#### Website generates an authentication challenge
The website generates a new challenge and sends it to the user's browser.

#### User requests authenticator to sign the challenge
The user selects the authenticator they used during registration, or the authenticator may be automatically detected and requested to sign the challenge. 

#### Authenticator signs the challenge
The authenticator signs the challenge using the private key stored during the registration flow. The authenticator sends the signed response and the public key back to the website.

#### User verification
The website receives the signed response and the user's public key. It verifies the response by checking the signature against the stored public key. If the verification is successful, the website grants the user access to the requested resources.

![Authentication Flow](https://images.ctfassets.net/23aumh6u8s0i/5gbfSpwf2b3EOAP4gP1elm/ae3db34de58eca086f963d06303c54cb/WebAuthn_Authentication_Flow.png)

The user is authenticated securely without a password and with less friction to the user.

## How to Implement the WebAuthn API

Two methods in the WebAuthn API mediate between the user and the server to create the public-private key pair.

1. `navigator.credentials.create`
2. `navigator.credentials.get`

### Using the "navigator.credentials.create" method

The `navigator.credentials.create` method is used to initiate registering a new credential for a user. This method allows users to create a new credential, such as a public-private key pair, which can be used for secure authentication in the future. Here's how you can use `navigator.credentials.create`.

#### Prepare credential creation options
You need to define the options for the credential creation request. These options specify various credential creation parameters, such as the relying party ID (your website's domain), user information, and allowed authenticator types (e.g., platform authenticator or external security key).

Here's an example of how to create credential creation options:

```
const publicKey = {
 challenge: new Uint8Array(/* Generate a random challenge */),
 rp: {
 name: 'Webauthn Me', // Relying party name
 id: 'webauthn.me', // Relying on party ID
 },
 user: {
 id: new Uint8Array(/* Generate a unique user ID */),
 name: 'jane.doe@example.com',
 displayName: 'Jane Doe',
 },
 pubKeyCredParams: [
 { type: 'public-key', alg: -7 }, // ES256 algorithm
 ],
 timeout: 60000, // 1-minute timeout
 attestation: 'direct', // Attestation type
};

```

The following section describes each variable in detail.

- `challenge`: A challenge is a random value generated by the server and included in the registration request that helps to prevent replay attacks. The challenge serves as a nonce (number used once), ensuring that each registration request is fresh and not subject to replay. It prevents attackers from intercepting and reusing a valid registration message to gain unauthorized access. The server should validate the response promptly and reject it if the challenge has expired or does not match.
- `rp`: The relying party is the entity that relies on WebAuthn for authentication. For example, it is the domain of the website that implements WebAuthn to enable secure user authentication. Validating the relying party information helps prevent phishing attacks.
- `user`: Information about the user who wants to register.
- `pubKeyCredParams`: It is an array that specifies the acceptable public key algorithms and parameters for the generated credential. The array consists of two properties,
 1. `type`: A string indicating the cryptographic algorithm to be used. Common values include "public-key" for ECDSA (Elliptic Curve Digital Signature Algorithm) or "rsa" for RSA (Rivest–Shamir–Adleman)
 2. `alg`: An integer representing the specific algorithm within the given type. For example,`-7`representing ES256 for ECDSA with SHA-256.
- `timeout`: The time limit for the credential creation process.
- `attestation`: The attestation parameter specifies how the authenticator (e.g., security key, biometric device) should attest to the authenticity of the public key credential it generates during the registration process. The attestation parameter can take different values, each representing a different attestation type. Common values include:
 1. `none`: No attestation is requested. The authenticator generates a credential without any assertion of its authenticity. This is suitable for scenarios where the relying party already has a secure means of verifying the authenticator.
 2. `direct`: The authenticator provides an attestation statement, but the format and content depend on the authenticator type. This is also known as "self-attestation."
 3. `indirect`: The authenticator forwards an attestation statement obtained from a third-party service, typically the manufacturer or a trusted party.

#### Call "navigator.credentials.create"
Use the `navigator.credentials.create` method to initiate the credential creation process.

```
navigator.credentials.create({ publicKey })
 .then((credential) => {
 // Handle the successful credential creation
 // Send the credential information to your server for storage
 })
 .catch((error) => {
 // Handle any errors that occurred during credential creation
 });

```
`publicKey`: It is the variable defined in the previous step. 

#### Handle the Credential Creation Response
If the user successfully creates a credential, the `navigator.credentials.create` promise will resolve with a credential object. You should send this credential object to your server for storage and associate it with the user's account.

```
// Handle the successful credential creation
// Send the credential information to your server for storage
navigator.credentials.create({ publicKey })
 .then((credential) => {
 // Response object has information about the authenticator data, 
 // public key, transport mechanisms, and more.
 const response = credential.response;

 // Access attestationObject ArrayBuffer
 const attestationObj = response.attestationObject;

 // Access client JSON
 const clientJSON = response.clientDataJSON;

 // Return authenticator data ArrayBuffer
 const authenticatorData = response.getAuthenticatorData();

 // Return public key ArrayBuffer
 const pk = response.getPublicKey();

 // Return public key algorithm identifier
 const pkAlgo = response.getPublicKeyAlgorithm();

 // Return permissible transports array
 const transports = response.getTransports();
 
 // Send the credential information to the server for storage
 return credential;
 })
 .catch((error) => {
 // Handle any errors that occurred during credential creation
 console.log('FAIL', error)
 });


```

If the credential creation fails or if there are errors, the promise will be rejected, and you can handle the errors accordingly.

Remember that the server-side storage and management of user credentials are essential for the WebAuthn authentication process. The server should securely store the user's public key and other relevant information to enable future authentication.

### Using the "navigator.credentials.get" method

The `navigator.credentials.get` method is part of the WebAuthn API and is used to initiate the process of authenticating a user based on the credentials they have previously registered. This method is typically used in conjunction with the `navigator.credentials.create` method for credential registration. Here's how you can use this method.

#### Prepare authentication options
You need to define the options for the authentication request. These options specify the criteria for the user's credentials for authentication. You can include the relying party ID (e.g., your website's domain) and specify the allowed authentication methods.

Here's an example of how to create authentication options:

```
const publicKey = {
 challenge: new Uint8Array(/* Generate a random challenge */),
 rpId: 'webauthn.me', // Relying party ID
 allowCredentials: [
 {
 type: 'public-key',
 id: /* The credential ID of the user's registered credential */,
 },
 ],
 userVerification: 'preferred', // or 'required'
};
```

The following section describes each variable in detail.

- `userVerification:` It specifies the preferred user verification method that the relying party wishes to be performed during the WebAuthn authentication process. The [userVerification parameter](https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/User_Presence_vs_User_Verification.html) can take different values, each representing a different user verification method. Common values include `required`, `preferred`, and `discouraged.`
- `allowCredentials:` It is an array that contains one or more "PublicKeyCredential" objects representing the credentials that the relying party is willing to accept during the authentication process. Each element in the allowCredentials array is an object with the following properties: 
 1. `type`: A string specifying the type of the credential. Commonly, this is set to "public-key".
 2. `id`: A byte array representing the credential ID. This corresponds to a credential that was previously created during the registration process.
- `challenge` and `rpId` are the same parameters used for the `navigator.credentials.create` method.

#### Call "navigator.credentials.get"

Use the `navigator.credentials.get` method to initiate the authentication process:

```
navigator.credentials.get({ publicKey })
 .then((assertion) => {
 // Handle the successful authentication assertion
 })
 .catch((error) => {
 // Handle any errors that occurred during authentication
 });
```

`publicKey`: It is the variable defined in the previous step.

#### Handle the authentication response
If the user successfully authenticates, the `navigator.credentials.get` promise will resolve with an authentication assertion containing information about the user's successful authentication. You can then send this assertion to your server for verification.

```
// Handle the successful authentication assertion
// Send the assertion to your server for verification
navigator.credentials.get({ publicKey })
 .then((assertion) => {
 // Handle the successful authentication assertion
 // The assertion response has information about the authenticator data, 
 // signature, and user handle
 const response = assertion.response;

 // Access authenticator data ArrayBuffer
 const authenticatorData = response.authenticatorData;

 // Access client JSON
 const clientJSON = response.clientDataJSON;

 // Access signature ArrayBuffer
 const signature = response.signature;

 // Access userHandle ArrayBuffer
 const userHandle = response.userHandle;

 return assertion;
 }).catch((error) => {
 // Handle any errors that occurred during authentication
 console.log('FAIL', error)
 });
```

If the authentication fails or if there are errors, the promise will be rejected, and you can handle the errors accordingly.

Remember that the server-side verification of the authentication assertion is an essential part of the process. The server should validate the assertion's signature and ensure that it matches a previously registered credential for the user.

These steps provide a high-level overview of how to use `navigator.credentials.create` and `navigator.credentials.get` in the WebAuthn API for user authentication. The actual implementation will vary based on your specific use case and server-side verification requirements.

## Conclusion

WebAuthn offers a passwordless and highly secure alternative to traditional authentication methods. Leveraging public key cryptography, user verification methods like biometrics, and a challenge-response model, WebAuthn effectively mitigates the risks associated with phishing attacks and enhances online security. It's important to note that while WebAuthn is phishing-resistant, it is not immune to all types of attacks. Therefore, proper implementation and security best practices on both the client and server sides are crucial to harness the security benefits of WebAuthn fully. [Auth0 supports WebAuthn](https://auth0.com/blog/mfa-with-webauthn-for-fido-device-biometrics-now-available/) and adheres to industry best practices and security standards, removing the heavy lifting of implementing on your own. It is a simple toggle switch in the configuration to show up in your login box, and all the background processing is taken care of by Auth0.

<include src="SignupCTA" text="Try out WebAuthn with Auth0?" linkText="Get started →" />

WebAuthn - A Short Introduction

pawan bhardwaj

Pawan is a seasoned business and technology enthusiast who welcomes challenges and pushes boundaries for value creation. In addition to his passion for technology, he also enjoys learning about music, art, architecture, and philosophy as lifelong pursuits.

In his career, he has worked in the domains of product management, solutions architecture, cybersecurity, cloud, telecom, and software engineering. He has led SaaS scaling initiatives in Cybersecurity (IAM), portfolio evolutions to cloud and telecom APIs, and deep partner engagements.

He has an MBA from Sonoma State University and an MS from the University of Delhi.

Principal Product Manager

Pawan Bhardwaj

jc tierney

JC Tierney was born and raised in the suburbs of Chicago, and is a life-long Blackhawks, White Sox and Bears fan.

He graduated from Benet Academy in Lisle, Illinois. He went on to attend the University of Dayton, where he graduated with a degree in Management Information Systems, and loved every minute of the experience.

Director, Engineering

JC Tierney

Efficiency on a robust foundation: Exploring multi-subscriber (Public Cloud) deployment on Auth0's converged platform architecture.

**TL;DR:** Auth0’s SaaS services are available via two modes of cloud deployment:

* Multi-subscriber (shared infrastructure, a.k.a. Public Cloud) 
* Single subscriber (dedicated infrastructure, a.k.a. Private Cloud). 

These offerings now have a converged platform architecture that increases business agility, developer productivity, scalability, reliability, and security by using industry-leading tools and fully automated operations.

This article continues a series of earlier ones focused on Private Cloud deployments. Unlike the single-subscriber Private Cloud, the Public Cloud hosts thousands of subscribers. In multi-subscriber deployments, data isolation, security, and elimination of noisy neighbor problems are paramount.

Public Cloud leverages the converged architecture composed of three tiers - the Central tier, Points of Presence (PoPs), and Spaces. The Central tier and PoPs are for control, operations, and shared services. Spaces are environments that provide customer identity services as per customers’ needs.

We leverage Kubernetes for lifecycle and runtime management of Auth0’s cloud-native containerized solution. Auth0 is composed of stateless services that are easier to scale. We use MongoDB, PostgreSQL, and Redis as required by the situation. We ensure a robust and performant solution through network isolation and extensive use of edge networks for DDoS protection, rate limiting, and low-latency DNS resolution (including custom domains). The converged architecture's intra-region High Availability (HA) and inter-region geo-failover characteristics help us meet the availability SLAs of Public Cloud deployments.

## Auth0 Services on Multi-Subscriber (Public Cloud) and Single-Subscriber (Private Cloud) Deployments

Auth0 is a Software-as-a-Service (SaaS) solution with two deployment models - Public Cloud and Private Cloud. The Public Cloud is a multi-subscriber environment where resources are shared between customers and is available in the United States, Europe, Australia, Japan, and now in the United Kingdom. Private Cloud deployments, on the other hand, are single-subscriber environments that provide customers with dedicated infrastructure and can be deployed in most regions across Amazon Web Services (AWS) and Microsoft Azure.

The Public Cloud offering is deployed on AWS and addresses the needs of a vast majority of customers. However, customers may choose Private Cloud for a variety of reasons, such as: 

* Geographical requirements that dictate deploying in an area not served by Public Cloud (e.g. for data residency and/or latency reduction)
* Industry-specific needs (e.g., PCI compliance)
* Preference for Microsoft Azure instead of AWS
* Higher transaction volume than allowed on Public Cloud

![Auth0 Services on Multi-Subscriber (Public Cloud)](https://images.ctfassets.net/23aumh6u8s0i/6ex2w8DgyfbKhdJLx1lIPi/60a5ba0c641c9059317da35e9f6aab1c/multi-subscriber-public-cloud-01.png)

## Why Converged Architecture?

The converged architecture allows us to deploy and manage both Public and Private Cloud offerings on the same underpinning. This architecture is built on the following premises:

* Multi-cloud: AWS and Azure cloud support through a common interface
* Container orchestrated: use of container images instead of installing packages
* Stateless: scalable and replaceable by design
* Immutable: run only trusted code and configuration
* Fully automated: provisioning, upgrades, and decommissioning are done by machines
* GitOps: enhanced DevOps, push code and safely reproduce it thousands of times

![Architecture](https://images.ctfassets.net/23aumh6u8s0i/57nIODdJEv5clLYYswHEl5/12fabdd26c7eddf4db40754196ef1659/multi-subscriber-public-cloud-02.png)

The benefits of a single underlying architecture for developing, deploying, and operating services across different environments are manifold. The primary reason is the ability to offer new capabilities to customers faster and at a lower expense. The architecture also allows us to ensure feature parity across different deployment environments seamlessly.

The converged architecture helps in focusing the organization’s energy on a common infrastructure that yields higher developer productivity/velocity. It results in improved platform scalability to address various scaling demands from both multi-subscriber and single-subscriber deployments. It provides a constructive space for assessment and adoption of security practices that might be perceived as unique to one deployment environment type, but have practical implications on the other as well. It also helps with reliability refinements and enhancements across the board. 

Besides optimizing engineering resources, a converged architecture has several other internal benefits through unified automation, toolsets, and processes. It has expedited identification and realization of infrastructure and operational cost optimizations across the board, which helps deliver good value to our customers.

## Deployment Characteristics of Multi-Subscriber Services 

As a reminder, the Public Cloud is designed to host thousands of subscribers over shared resources, whereas a Private Cloud deployment is designed for a single subscriber. 

Ensuring optimal performance and security for the different Public Cloud subscribers is paramount. While the underlying compute, storage, database, networking, domain name, and other resources are shared in a multi-subscriber deployment, this solution ensures each subscriber is isolated within this shared environment.

The database and application workloads are partitioned to ensure an appropriate level of data isolation and security. The Auth0 Public Cloud combines pooled partitioning (i.e., partitioning of data by subscriber identifier) and on-demand subscriber-specific workload instances. The architecture is refined continuously to eliminate “noisy neighbor” problems.

## Public Cloud Platform Infrastructure Architecture

### Tiers - Central, PoPs, and Spaces

Once again, the converged architecture has three tiers - Central, Points of Presence (PoPs), and Spaces. Besides these, the Edge network for DNS and DDoS protection, and Auth0 HQ based systems for analytics and operations complete the picture.

![Tiers - Central, PoPs, and Spaces](https://images.ctfassets.net/23aumh6u8s0i/5wVpjNsZNeyRnxGmRIHLwM/deee78839a615f2ebc1679b65eafc873/multi-subscriber-public-cloud-03.jpg)

It’s important to note that the solution has been designed with isolated fault domains; the control plane and data plane separation allows the central control plane to be offline/under maintenance without impacting customers’ authentication flows.

* **Central**: A globally unique component that contains the platform control plane and other centralized global infrastructure. The control plane manages the creation of Public Cloud environments and keeps them updated with continuous (daily) releases.
* **PoPs**: An intermediate point of infrastructure pinned to a specific cloud region (e.g., AWS us-east-1). The PoP hosts internal visibility tools and securely proxies messages from the central down to the regional Public Cloud environments.
* **Space**: The Public Cloud environment is located ‘beneath’ a PoP in a particular AWS region. These spaces have cross-region geo-failover capabilities to ensure resiliency.

### Aspects - control and runtime, scalability, datastores, networking, and reliability

When Auth0 took on the converged platform project, it started as a small team, initially focused on our single-subscriber (Private Cloud) offerings. This team comprised a cross-section of our platform teams with expertise ranging from Kubernetes to API, tooling, infrastructure, and datastores. They were focused on developing a proof of concept for the converged platform.

As we learned from our experiments — and as the converged platform evolved and matured — we launched single-subscriber environments for general availability. You may read more about this in a series of posts we shared outlining the technical, security, and architectural decisions we made:

* [A Technical Primer of Auth0’s New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/)
* [The Architect’s View of Auth0’s New Private Cloud Platform](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/)
* [Securing Auth0's New Private Cloud Platform](https://auth0.com/blog/securing-auth0s-new-private-cloud-platform/)
* [Data Pipelines on Auth0’s New Private Cloud Platform](https://auth0.com/blog/data-pipelines-on-auth0-s-new-private-cloud-platform/)
* [How We Do Releases in Auth0’s New Private Platform](https://auth0.com/blog/how-we-do-releases-in-auth0-s-new-private-platform/)
* [Optimizing Cost and Performance of Auth0's Private Cloud](https://auth0.com/blog/optimizing-cost-and-performance-of-auth0s-private-cloud/)

We continued the logical progression with the converged platform, and adopted it for Public Cloud. Behind the scenes, the team continued to grow, and eventually, as we began to gain more and more traction from the converged platform, we organized the team into specialties to best support growth.

* **Runtime -** Heavily focused on our Terraform and Kubernetes layers. Ensuring that the core of the platform functions and that automation has the flexibility to meet the needs of product delivery teams.
* **Control -** Owners of our controlling API and platform CLI. The tooling that is used for operating the platform in all cases both normal and incidents.
* **Datastores -** Focused on our data storage technologies and interacting with our product delivery teams and the most efficient way to utilize the available stores.
* **Networking -** Owners of our edge technologies and supporting the myriad of ways in which our customers leverage the edge.
* **Sizing -** Partners with other internal teams to establish the performance characteristics of our offerings and additionally adds improvements to our platform including auto-scaling.
* **Services -** Owners of tooling and services leveraged by product delivery in their development. This includes abstractions that allow for easier access to the underlying platform.
* **Data -** Responsible for ensuring the data flow from the individual environments to the regional Points of Presence (PoPs) and beyond. This includes application logs for support as well as abstracted metrics. 

In order to get the technology behind a solution right, it's critical to fully enable the people behind the technology to co-create innovative solutions. At Okta, we cultivate a BLOC culture, which stands for “Builder, Learner, Owner, and Collaborator.” These values foster a high-functioning, well-oiled machinery that can take on big and small challenges effectively and efficiently.

![BLOC culture](https://images.ctfassets.net/23aumh6u8s0i/1uDGWPkHZzzH5CKHlrvEbJ/114d89fab2474e4cb2aec9272dea795f/multi-subscriber-public-cloud-04.png)

With the different team specializations, collaboration becomes all the more important. At Auth0, we value documentation not only for informing but also for decision-making. Our Engineering teams follow a simple mantra for collaboration: "Write. It. Down." We use Request For Comment (RFC) documents to record architectural designs and Decision Record documents to discuss and align ideas across teams. These documents also provide important context for new team members about what we're building and how we arrived at the decisions we've made and served as an important knowledge base as we began onboarding service owners to the new converged platform. These core tenets have become critical for sustaining the growth of the platform and introducing new capabilities over time.

### Reliability

The converged architecture provides a highly reliable and available solution leveraging not only the High Availability (HA) constructs across three Availability Zones within an AWS region, but also geo-failover capability between Active and Failover regions.

![Reliability](https://images.ctfassets.net/23aumh6u8s0i/2jbDdi3fCuZ1hm6D0qyWCI/ffe5decea1a0c72156636d38073d1975/multi-subscriber-public-cloud-05.png)

The geo-failover regions are always synchronized from the datastores’ perspective, with demanding RPO/RTO and 99.99% availability SLA targets. Once the failover decision is made, a fully automated process is initiated for the failover to take effect.

![Reliability](https://images.ctfassets.net/23aumh6u8s0i/5HQ6xBqVyquDFEK7ewW4kC/299cf5878d8cee63c706c633cc0b1abf/multi-subscriber-public-cloud-06.jpg)

In the event of a multi-region failure (an extremely rare event), we can perform an automated restore from the last backup.

The historical availability metrics are a testament to the robustness of the Auth0 solution. We continue to meet our targets in Private Cloud with the converged architecture and expect to continue meeting or exceeding these targets with Public Cloud deployments on this architecture.

![Private Cloud](https://images.ctfassets.net/23aumh6u8s0i/3xjskcZcaHUYxFuePah6r4/fdd40e7755462d852c29d16293a3bc2e/multi-subscriber-public-cloud-07.png)

## What Next?

Auth0’s Public Cloud offering continues to be boosted across different facets. The availability of Public Cloud across geographies will continue to expand. The launch of the UK Public Cloud region in April 2023 is the latest example, providing yet another regional point of presence for customers with data residency and latency sensitivity needs. Also, support for a Public Performance tier in H2 2023 caters to customers’ higher performance needs on Public Cloud.


We look forward to continuing to deliver new and enhanced customer identity capabilities, ease of use, platform resilience, scalability, and security in our Private Cloud and Public Cloud offerings through the new converged architecture.

Multi-Subscriber (Public Cloud) Deployment on Converged Architecture

johnathan-campos

Johnathan Campos is a Senior Product Marketing Manager at Okta focused on platform infrastructure and scalability. Johnathan is responsible for helping customers and partners understand the value of the Okta platform. Prior to joining Okta, Johnathan was a Senior Product Marketing Manager of the Observability Practitioner team at Splunk. During his time at Splunk, he helped practitioners understand the details of why Observability is the new necessary for native cloud deployments. When not focused on platform infrastructure and scalability, John enjoys tinkering in his garage, learning new things, spending time with family, and is an avid motorcycle fan.

Senior Product Marketing Manager, Global Platform Service

Johnathan Campos

With our new UK Region, we can enable local subscribers to achieve compliance and benefit from the quickest login response times available.

**TL DR;** The UK joins our available public cloud regions across EMEA to help with compliance requirements, data residency, and performance for our subscribers based in the UK.

We are thrilled to announce the launch of our newest region across our Customer Identity Cloud (Powered by Auth0) service in the UK. This new offering will provide a high-performance and secure way to manage customer identities while helping subscribers comply with UK data privacy regulations. As our first public cloud region on our converged platform architecture, this brings the latest cloud-native design and employs cutting-edge tools and fully automated operations to enhance business agility, developer productivity, scalability, reliability, and security for both our subscribers and platform teams. We encourage you to check out our blog series [here](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) to learn more about our converged platform, and if you want to double-click even further on architecture, check out this blog [here](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/) by my colleague, Leonardo Zanivan.

This public cloud region is also a major milestone in supporting UK customers with data residency needs. UK-based data centers will enable subscribers to store their data within the UK, helping ensure compliance with UK regulations for those that need it. This is particularly important for businesses that operate in heavily regulated industries, such as finance or healthcare, where data residency requirements can often be strict. To choose their preferred location, subscribers can easily select from a menu when creating their new tenant where the UK is now available. 

![UK](https://images.ctfassets.net/23aumh6u8s0i/7oWDzK3Dj7HVHwHlQ8XuoV/4f01fd4cb8bdaa926b07ab83c9009419/UK.png)

In today's constantly connected environment, where numerous users - from staff to customers - need access to mobile applications, websites, APIs, and portals from any location and device, we are proud to provide our subscribers with an IDaaS solution that delivers the essential scalability, reliability, and accessibility organizations require. Our goal has always been to simplify identity management for developers and IT professionals worldwide. 

With the new launch, users in and around the UK can experience reduced latency while logging in and solve many challenges faced with data privacy regulations. Don't hesitate to contact us for any questions or help regarding the newly launched UK Region. We are always here to help!

The UK Joins Existing EMEA Regions for Public Cloud Deployments!

Salman Ladha

As a Product Marketing Manager, I’m responsible for communicating the value of identity for SaaS application builders and our public sector vertical. I’m particularly passionate about the role identity plays in accelerating business growth, promoting product adoption, and establishing trust. Outside of work, you can catch me reading, working out, or watching the latest Marvel movie.

Senior Product Marketing Manager

Modern identity can help the UK public sector deliver secure and user-friendly applications

The United Kingdom led countless pioneering advances in early computing history. It is a country of early adopters – and that's especially true for its government. 

The UK Government launched its first externally-facing website in 1994. Its first efforts were cautious and limited in scope. As its confidence and competence grew, Whitehall rapidly expanded its digital footprint. Not long after, you could apply for a passport, register to vote, and file a tax return, all without leaving the same centralized hub. 

In 2012, the Coalition Government launched the newest incarnation of its externally-facing web presence, dubbed gov.uk. This was more than a visual overhaul. This was a vastly more ambitious and expansive platform. It also represented a seismic shift in how public sector IT was built. 

Gone were the reliances of waterfall methodologies, costly external contractors, and proprietary software. Government IT projects would faithfully resemble their private-sector equivalents, with open source software widely used and applications built using agile methodologies. They put UX first, and developers agonized over aesthetics and accessibility. 

However, as Auth0's 2022 Public Sector Identity Index report demonstrates, there are several opportunities for improvement, particularly when it comes to how citizens authenticate and access vital government apps. 


## 88% Building External Applications

Auth0, in partnership with Market Connections, surveyed 200 UK IT leaders across local and national governments about their attitudes to identity and their priorities when developing digital citizen services. The [findings](https://auth0.com/resources/whitepapers/uk-public-sector-ciam) show local and national bodies have different perspectives when it comes to their priorities, their confidence when it comes to delivering a secure experience, and their attitude to authentication. 

Respondents from central and local government bodies were equally likely (64% each) to operate applications where the intended user is a member of the public. Both categories were equally likely to build external-facing applications (88% each).  

However, when we break down the data and focus on employee and vendor-focused applications, we notice a slight divergence in the data. Central government respondents were marginally more likely to build applications where the intended user is an external vendor (48% versus 42%). For the purpose of this survey, the term "external vendor" includes both private-sector suppliers and other government bodies. 

Those working in national government departments were similarly more likely to build and maintain applications for internal use. Almost three-quarters of respondents — 73% — reported operating applications intended for internal employees. 


## Mobile First Priorities, Low Confidence in Delivery

Although local and national respondents were equally likely to build citizen-focused external applications, we noticed several significant disparities in their priorities. Central government respondents were more likely to value user experience (UX) than their counterparts in local government. 

The most commonly-cited priority in this cohort was mobile availability (78% versus 65% for local government), followed by accessibility via computer (73% versus 61%), and "overall accessibility" (72% versus 74%). 

![Mobile First Priorities, Low Confidence in Delivery](https://images.ctfassets.net/23aumh6u8s0i/24uCeR7yhZbNmMpbFE7v3v/c2245aa707cc9d83b5242357ed06ac39/Passwordless-Authentication-sep1.jpg)

Despite these lofty goals, neither cohort described feeling confident about their ability to deliver on the items they cited as their biggest priorities. Local and central government respondents were equally pessimistic about their ability to provide an accessible mobile experience, with just 53% describing themselves as "extremely" or "very" confident. 

Perhaps surprisingly, central government respondents were vastly more likely to rank "cost reduction via process automation" as "very" or "extremely" important (68% versus 51%). According to the Institute for Government (IfG), local government funding dropped by 16% between 2010 and 2020. 

The IfG notes that local governments face increased demand for social care services but are limited in their abilities to generate additional revenue. Just 12% of taxes are collected locally in the UK, compared to 30% in Germany and 50% in Canada. Compounding this problem, block funding from Westminster dropped by 37% in the 2010 to 2020 period, whereas council tax rates soared by 25%. Poorer regions (including Merseyside, Northumberland, and Pembrokeshire) faced the biggest overall hikes.

Digitization and process automation can help councils use their increasingly-diminishing funds more efficiently, deliver better value to taxpayers, and meet the challenges of an aging population. Achieving this goal, however, may prove elusive. Just 50% of local government respondents, and 45% of those surveyed from national bodies, said they felt "very" or "extremely" confident in their ability to deliver on this point. 


## Local Government Leading on Biometric and MFA 

Unsurprisingly, usernames and passwords were the leading authentication method for citizen applications, as reported by 89% of central government respondents and 80% of the local government cohort. 

The data showed significant discrepancies between local and central government bodies when it came to their use of more modern and secure authentication methods. Local government bodies were significantly more likely to use biometric or passwordless authentication (24% versus 11%) and reported higher rates of two-factor authentication usage (66% versus 52%). 

Local governments were marginally more likely to report using in-house CIAM solutions (31% versus 27%) and more likely to report scaling, deployment, and compatibility issues. Almost half of the local government respondents said they lacked the resources to adapt their IAM solution to the various apps used by citizens, employees, and external partners. 40% reported compatibility issues, and 44% complained about a slow time to implementation. 

![Local Government Leading on Biometric and MFA](https://images.ctfassets.net/23aumh6u8s0i/3DuYOoznWG10geDOeYwBVm/02b5dbc23075eebf4d984f22dbaaec76/Passwordless-Authentication-sep2.jpg)

Despite that, respondents from both central and local governments reported high levels of enthusiasm for a centralized IAM system, where users and stakeholders use a single credential throughout all their touchpoints. Additionally, both cohorts were roughly aligned on their vision for what such a system would ultimately look like, with privacy, interoperability, and user experience all listed as urgent priorities. 

One point of divergence is in backward compatibility, with local government respondents vastly more likely (73% versus 56%) to value solutions that would allow them to use their existing databases rather than migrate to a new system. This trend is likely indicative of the prevalence of legacy systems in local government and the comparatively lower availability of IT resources. 


## How Modern Identity Can Help 

The UK pioneered digital citizen services, setting the benchmark for other nations to beat. Adopting a modern approach to identity can further expand upon those early successes and ensure its leading status endures for years to come. 

Commercial off-the-shelf identity solutions like Auth0 can help local and central government bodies accelerate their time-to-market while ensuring the security and usability of services. 

Auth0's platform uses open standards such as OpenID Connect, OAuth2, Security Assertion Markup Language (SAML), and Fast Identity Online Alliance (FIDO), ensuring compatibility with existing applications. It includes essential security features, like Adaptive MFA, Brute Force Protection, and Breached Password Protection. And with capabilities like WebAuthn Passwordless authentication, governments can accelerate the rollout of UX and security-boosting identity features. 

To learn more about the state of identity and access management in the UK public sector, check out our [whitepaper](https://auth0.com/resources/whitepapers/uk-public-sector-identity-index-report-2022).

Delivering Value for Money with Modern Identity

Auth0 Public Sector Identity Index shows government leaders in the United States are clear on their priorities but could use some help improving citizen security.

Over the past two years, all levels of government in the United States (US) have made massive strides in their ability to deliver digital citizen services. Whether filing for unemployment benefits or renewing a driver's license, the COVID-19 pandemic accelerated digital government initiatives by [years](https://home.kpmg/us/en/home/insights/2020/09/digital-acceleration.html), enabling citizens to access critical services online rather than in-line. 

As these services continue to be deployed digitally, a key area of focus amongst all US government officials is managing the constantly evolving cybersecurity landscape. [Executive orders](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/) from President Joe Biden and the [1.2 trillion dollars](https://www.whitehouse.gov/briefing-room/statements-releases/2021/11/06/fact-sheet-the-bipartisan-infrastructure-deal/) bipartisan infrastructure bill are both examples of steps taken to improve the nation's cybersecurity posture. 

Data from our own [Public Sector Identity Index](https://auth0.com/resources/whitepapers/us-public-sector-identity-index-report-2022), a primary research report with insights into the identity maturity of public sector organizations around the world, further supports how Federal, State, and Local government leaders prioritize security when delivering government-to-citizen (G2C) applications. In our survey, the top three priorities cited by respondents when launching online services for citizens were: 

1. Abiding by data security regulations
2. Securing citizen services 
3. Ensuring citizen trust in digital services 

Despite the intense focus on protecting citizen data, the results show there's still room for improvement. Only 19% of government leaders were highly confident in the security of their current authentication solutions, and 86% of governments rely on custom username and password credentials as a citizen's primary means of authenticating into applications, despite their [well-documented security risks](https://auth0.com/blog/what-is-credential-stuffing/). 

Fortunately, Customer Identity and Access Management (CIAM) solutions can help governments improve their applications' security without compromising the citizen experience.

## Billions of Dollars Lost to Fraud 

Over the past decade, data breaches in the US have [doubled](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/), and governments have been a primary target for bad actors amidst the pandemic. This shouldn't come as a surprise due to the highly sensitive data they store, legacy technology infrastructure, and the pace at which citizen services were launched; governments were and continue to be a perfect target for [hackers](https://www.govtech.com/sponsored/why-government-institutions-are-the-perfect-target-for-hackers).

Notably, levels of fraud have significantly increased amidst the pandemic as bad actors take advantage of the dire circumstances in which citizens required relief and governments scrambled to set up systems to deliver it. The Federal Trade Commission (FTC) reported a [3,000%](https://www.forbes.com/advisor/personal-finance/identity-theft-unemployment-benefits-fraud/) increase in fraudulent applications for government benefits in 2020. Data from the department of labor estimates that 36 billion of the 360 billion from the Cares Act was [lost to fraud](https://www.cnbc.com/2021/01/05/scammers-have-taken-36-billion-in-fraudulent-unemployment-payments-.html). 

Some sources are even citing 2020 as the year the world experienced a health care crisis and a [cyber pandemic](https://www.govtech.com/blogs/lohrmann-on-cybersecurity/2020-the-year-the-covid-19-crisis-brought-a-cyber-pandemic.html) due to the radical shift in online life. 

## A Void of Security Talent 

Despite rampant cyberattacks, citizen adoption of digital applications in both the public and private sectors continues to accelerate. [Data from McKinsey](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/how-covid-19-has-pushed-companies-over-the-technology-tipping-point-and-transformed-business-forever) shows that in the United States, the adoption of digital consumer interactions was pulled forward by three years. 

As citizens—who have the dual identity of also being consumers—continue to shift to an online world, authentication becomes increasingly important as it's the front door to any service. 

Unfortunately, the onus is on service providers to ensure their authentication methods are secure. [Most people](https://www.darkreading.com/informationweek-home/password-reuse-abounds-new-survey-shows/d/d-id/1331689) know password reuse is unsafe but choose to use the same password on multiple sites because they have roughly [100 passwords](https://tech.co/news/average-person-100-passwords) to remember. 

This poses a natural challenge for government agencies because finding, acquiring, and retaining cybersecurity talent to build and maintain security infrastructure is increasingly challenging. State CIOs have been quite [vocal about this](https://www.govtech.com/workforce/texas-cio-tackles-digital-services-workforce-challenges?utm_campaign=Newsletter%20-%20GT%20-%20GovTech%20Today&utm_medium=email&_hsmi=195931325&_hsenc=p2ANqtz-88YI7vDYWmct12A7bOeNFeYSw69onWa0MuOvfUAOKzukIH--YsPBMwI5ufQLqehSrlxgHaeqaH_khrQFZy3YoMvN-yJA&utm_content=195931325&utm_source=hs_email). Concerningly, it's not just a problem limited to the public sector. The International Information System Security Certification Consortium ([ISC]2) recently conducted a study that found [60% of security leaders globally worry the cybersecurity staffing shortage is placing their organizations at risk](https://www.isc2.org/-/media/F829F79ADBDC4F6391432B7D122DA32E.ashx).

## Protecting Citizens with Identity-as-a-Service 

Commercial off-the-shelf identity solutions like Auth0 are one option governments can rely on to improve the security of their citizen-facing applications with limited internal resources. 

Auth0's platform is built using open standards such as OpenID Connect, OAuth2, Security Assertion Markup Language (SAML), and Fast Identity Online Alliance (FIDO) so that when new threats emerge, they can be quickly identified, understood, and neutralized by a community of experts. 

Attack protection capabilities are also available out of the box to help governments ensure end-user security through features like Adaptive MFA, Brute Force Protection, and Breached Password Protection. 

Additionally, with capabilities like WebAuthn Passwordless authentication, governments can introduce login experiences that improve the citizen experience while enhancing the security of their services. 

To learn more about the state of identity and access management in the public sector, download our latest [whitepaper](https://auth0.com/resources/whitepapers/us-public-sector-ciam). In the report, we highlight key trends observed across both Federal and State/Local governments pertaining to digital citizen services, highlight areas of opportunity, and shed light on how identity can improve the nation's cybersecurity posture. For a quicker read, you can also check out an infographic we published, calling out key findings [here](https://auth0.com/resources/ebooks/us-public-sector-ciam-infographic).

Improving the Nation's Security, Starting with Identity

dean-scontras

Dean Scontras has spent the last two decades in public sector sales roles at high-growth cybersecurity and technology companies, including Duo Security, MobileIron, and Hewlett-Packard. Currently, Dean sits on the advisory board of Advanced Technology Academic Research Center (ATARC) and DiversifyIT. Prior to joining Auth0, he served as the vice president of U.S. Public Sector at Duo Security (acquired by Cisco), leading federal, state, local, and education sales initiatives, alongside securing the company’s successful FedRAMP certification.

VP, State and Local Government and Education, Okta and Auth0

Dean Scontras

Consumers expect seamless, high-value digital experiences, including with the public sector.

What does it mean to build digital services that citizens both use and trust? From the local to the national, generating effective digital transformation and [getting citizens onboard with digital public services](https://www.sciencedirect.com/science/article/pii/S0740624X18304131) has been a challenge. The promise of digital government has often been muddled by institutional inertia and perceptions of government as slow-moving and bureaucratic. At the same time, positive initiatives, such as the [Tallinn Declaration on eGovernment](https://ec.europa.eu/newsroom/document.cfm?doc_id=47559), which embrace objectives as wide-ranging as improved service delivery, greater efficiency, increased transparency, interoperability, and citizen satisfaction, have begun to remove entrenched ambivalence about e-government. Modern GovTech is where these barriers collide, creating the opportunity to address newly accelerated consumer demand in the face of private-sector conveniences and the [consequences of the Covid-19 pandemic](https://www2.deloitte.com/us/en/insights/industry/public-sector/government-digital-transformation-strategy.html). 

GovTech, according to public sector entities such as [the World Bank](https://www.worldbank.org/en/programs/govtech), is a technology-based “government approach to public sector modernization.” The same definition emphasizes three core areas for modernization: universal accessibility, citizen-centric services, the delivery of efficient and transparent government systems, and finally, digital transformation, all of which rely on overcoming long-cited barriers to adoption and success, such as [citizens’ willingness to use and trust services](https://doi.org/10.1145/2096140.2096142).

GovTechs, an umbrella term for technology-based solutions (and the companies behind them) that power the technical aspects of digital transformation, can be a bridge between use and trust and learning to [see citizens as customers](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/building-the-tech-enabled-government-of-the-future-a-day-1-list-of-common-pitfalls).


## Changing User Expectations 

In a pure consumer context, choice and convenience rule: you can easily go online and search, comparison shop, and buy a desired product in a few clicks without thinking about any of the complexity of the transaction. Consumers naturally transfer their positive consumer expectations to all of their digital experiences,[ according to McKinsey, raising the bar for government entities](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/digital-public-services-how-to-achieve-fast-transformation-at-scale). 

But how many consumers have enjoyed the convenience of one-click (or similarly easy) citizen services, such as reviewing and paying utility bills, filing income taxes, or having a streamlined, one-stop car-and-driver licensing experience? Or, for example, registering for unemployment benefits digitally, making the physical queue at the unemployment office shorter and more efficient for those going through the process in person? 

Rapid change has led to the expectation that public sector services offer private-sector-rivaling availability, choice, and convenience, which overrides previous consumer doubts about public sector readiness. 

Driving GovTech strategy in complex public sector environments demands a delicate balance between overarching strategic questions and the nitty-gritty of implementation. For example, this balance could be examining the[ underpinnings of transformation](https://www.accenture.com/_acnmedia/pdf-90/accenture-govtech-pov.pdf) strategically, such as public expectations, financial considerations, accessibility, demographics, and sustainability, against the competing operational demands of introducing new technology into hierarchical, political, and often change-resistant environments. Practically, such implementations involve extensive political and stakeholder management and support, consideration of legacy investments and programs, and a well-defined plan for rolling out proposed changes and the downstream effects these may have, whether positive or negative. 

Ultimately, the strategy for selecting and implementing GovTech solutions and providers rests with public sector employees who are responsible for the strategic and tactical approaches described and for meeting consumers’ increasingly private-sector-style expectations. This is redefining how governments interact with citizens. 

Three core considerations highlight how uniquely demanding delivering on these expectations can be for government agencies:

### 1. Deliver on citizens’ demands and expectations. 
Government digital transformation is different from its private-sector counterpart. Historically,[how consumers perceive and use public and private sector services has differed](http://dx.doi.org/10.4018/IJIDE.2019010102). However, societal changes stemming from the Covid-19 pandemic and the attendant shift to living life almost 100% online have resulted in heightened citizen expectations for public services to be available digitally in the same way as online shopping and food delivery. As a result, old barriers against citizens' willingness and ability to use e-gov services have declined significantly. 

### 2. Balance privacy and user experience. 
More fundamentally, the private sector is driven by consumer demand and choice, incentivized by increasing profit and reducing cost. While the public sector shares these concerns, because citizens often do not have a choice in deciding whether to interact with the government, the government’s primary aim is to provide services to citizens efficiently while building trust, safeguarding citizens’ data privacy, and ensuring compliance with regulations, mandates, and standards to which government agencies are tied. Trust remains an important issue for consumer-citizens, who[ perceive a level of risk in exposing their private data to public entities in ways they don’t when dealing with private entities](https://www.ey.com/en_no/government-public-sector/how-can-digital-government-connect-citizens-without-leaving-the-disconnected-behind). For public sector agencies, privacy concerns have historically taken precedence over user experience, but they need to prioritize privacy and security over user experience and convenience is beginning to change as GovTechs offer secure solutions leveraging modern infrastructure and economies of scale that facilitate both outcomes at a lower overall cost.

### 3. Make public services accessible to all citizens. 
The rapid digitization of society champions convenience above all, but digital-only approaches can create [accessibility blindspots](https://www.openaccessgovernment.org/accessibility-making-government-work-better/55530/) and [exacerbate the digital divide](https://www.ey.com/en_au/government-public-sector/how-can-clever-governments-choose-to-close-the-digital-divide). Government agencies must serve _all_ citizens, which means designing for everyone or else disenfranchise citizens who do not have access to digital services, devices, or connectivity. 

## How Can GovTech Enable These Citizen Experiences? 

Government agencies want to deliver on these citizen expectations because the agency benefits by achieving its mission, improving efficiency, and reaching all of its citizens — ultimately benefiting citizens. 

“A valuable function of government is providing all constituents with equal opportunity to access different services. By enhancing government with modern technologies, citizens are presented with multiple paths to the same services. These paths can now be both digital and in-person avenues, allowing the government to be more efficient in providing the right access to the right group of people,” Auth0’s Jeet Shah, Identity Architect, and Senior Solutions Engineer explains. “GovTechs introduce options for how citizens are served, allowing governments to dedicate resources more effectively. Citizens who prefer interacting with their governments online allow in-person services to be more accessible and can ultimately improve the quality. GovTech vendors and what they provide to governments ultimately leads to better services for all constituents.” 

GovTech grows from two branches: the first is the services governments offer to their citizens, the second is the vendors that enable those services. Governments furnish services in line with citizen expectations, which brings together these two branches.

### Government services to citizens: Focus on usability and trust

At the heart of delivering efficient public services is the ability to unify disparate, siloed departments and functions under a single sign-in. Forcing citizens to keep track of and maintain access to multiple portals and sites creates friction and disincentivizes use while also introducing the greater potential for security vulnerabilities and data privacy breaches. 

At the same time, maintaining this fractured setup is less efficient, potentially open to fraud, and forfeits opportunities for fostering citizen trust and personalizing user experiences. For example, imagine being able to offer all citizen services through a centralized digital portal or app with a single sign-on experience. From license renewal to viewing existing permits to paying bills, governments can leverage GovTech that enable these features and gather user analytics simultaneously to feedback into personalization efforts and a deeper understanding of citizen needs and wants.

## Identity Jumpstarts GovTech Services

[Various barriers have slowed technology-driven public sector transformation](https://doi.org/10.1007/978-3-030-57599-1_4) over the past two decades. Many of these barriers, such as embedded organizational and cultural issues, existing processes, and legacy structures and infrastructure, persist regardless of technology. The impetus to accelerate the pace of change, however, has positioned GovTech to play a key role in helping to overcome some of these barriers. 

Identity enables all levels of government to bring their services to more citizens via the channels they prefer and already have access to. If the barrier faced is the difficulty of use, unified identity simplifies usability for both the government agency and the citizen user. If the barrier is trust, secure and transparent identity technologies can breakthrough. 

### Vendor service enablers: Auth0 for unifying identity

Auth0 is a GovTech vendor that, in this case, acts as an umbrella, freeing government agencies from service and platform fragmentation by bringing them together under a single, flexible sign-on solution. By reducing infrastructural complexity and providing options government agencies can use to offer services across multiple vectors, Auth0 helps public sector entities to expand the base of citizens who can access their services. 

By doing the heavy lifting of the platform and digital identity consolidation, Auth0 enables governments to reorganize and reprioritize resource allocation for more efficient processes – dedicating resources to digitizing what is possible and improving those that cannot be digitized.

If you’d like to learn more about how identity can accelerate digital change and invite citizens along for the journey, please get in touch with the [team at Auth0](https://auth0.com/contact-us).

What is GovTech?

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New global report highlights how identity is foundational in helping governments improve existing services, and launch new ones faster and more securely

**BELLEVUE, Wash.** **– January 12, 2022** –[ Auth0](https://auth0.com/), a product unit within[ Okta](https://www.okta.com/) (NASDAQ: OKTA), today released the findings of its first [Public Sector Identity Index](https://www.auth0.com/public-sector/identity-index-report), a global research report that provides government technology leaders with insight into the identity maturity of public sector organizations around the world. The report highlights the importance of a centralized identity strategy in putting safe and accessible services into the hands of citizens faster.

Over the past two years, many public sector organizations were prompted by the immediate need to deploy digital infrastructure to maintain continuity of their services amid the COVID-19 pandemic — such as offering citizens license renewals online and virtual education — and are now grappling with the impacts on cybersecurity and user experience. From the Executive Order on ‘Improving the Nation’s Cybersecurity’ in the U.S., to digital identity and Single Sign-On (SSO) initiatives in the UK and Australia, enabling employees, citizens, and other government entities to access all of these applications easily and securely has become a demand around the world. 

The 2022 Public Sector Identity Index, conducted by Auth0 and [Market Connections](https://www.marketconnectionsinc.com/), captures the perceptions of 850 IT and line of business decision-makers within national and state/local government organizations across the U.S., UK, and ANZ (Australia and New Zealand) with regard to their [Identity and Access Management (IAM)](https://auth0.com/resources/whitepapers/how-identity-forms-a-foundation-for-digital-govenrment) strategy.

The report’s key findings include:

* Only one in five are extremely confident in either the security (17%) or ease of use (19%) of their current authentication solution.
* Username and password is the most frequently used authentication method by citizens (86%), compared to very little usage of biometric or passwordless authentication (16%).
* Four in ten are currently building their own IAM solution in-house (41%), and cite speed to implementation (83%) and using internal staff to manage IAM internally (82%) as two of the biggest pain points in doing so.
* Most governments are looking to expand their digital services in the next two years (75%) and rank protecting citizen’s privacy and data as most important when thinking about citizen services (73%).

 

Regional analysis shows U.S. respondents rank ensuring citizens’ trust in digital services as an area of high importance (71%), but have less confidence in their organization’s ability to deliver this (56%). Similar discrepancies in importance versus confidence in delivery include speed in adding new services in the UK (66% importance vs. 48% confidence), and improving the user experience in ANZ (72% importance vs. 60% confidence).

Dean Scontras, Vice President of State and Local Government and Education (SLED) at Okta, said: “Digitization is likely to continue in light of Zero Trust mandates and mounting consumer expectations. Public sector organizations greatly benefit from bringing their identity management strategy in line with their digital goals. While there is a strong focus on securing citizen data, the vast majority of applications are still protected by a username and password, despite their well-documented security risks.”

According to Forrester Research, the public sector has a massive influence on the entire economy making up 30% of the global GDP and 33% of the global workforce, and the global research firm predicts that more governments will adopt Zero Trust frameworks to revive public trust in digital services.[^1]

An [Identity-First approach](https://www.youtube.com/watch?v=g7ZzOJQwRsE) puts identity at the center of government digital transformation, while also laying the foundation for a Zero Trust security model. Key to this approach are modern login technologies that replace traditional passwords, and introduce friction only when suspicious behavior is detected. By making the shift to Identity-First, organizations like [Larimer County](https://auth0.com/case-studies/larimer-county/) provide easy and seamless access for legitimate users, while decreasing the risk of security and compliance breaches.

Jessica Figueras, a cybercrime and digital identity advisor to governments and Okta consultant, said: “In the face of increasing digitization, skills shortages, and online harms, governments are taking a hard look at the technologies they can bring onboard to help them reach their digital goals. The research suggests that identity is one such technology that can help the public sector do more with less.”

To learn more and download the full report, please visit: [2022 Auth0 Public Sector Identity Index](https://www.auth0.com/public-sector/identity-index-report).

## Methodology

Auth0 engaged Market Connections to design an online survey of 850 IT and line of business decision-makers within national and state/local governments in the U.S. (200 federal, 200 state & local), UK (100 federal, 100 state & local), and ANZ (Australia and New Zealand) (155 federal/national, 95 state & local), fielded in September-October 2021.

<include src="asides/AboutAuth0" />

## About Okta

Okta is the leading independent identity provider. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With more than 7,000 pre-built integrations to applications and infrastructure providers, Okta provides simple and secure access to people and organizations everywhere, giving them the confidence to reach their full potential. More than 14,000 organizations, including JetBlue, Nordstrom, Siemens, Slack, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Okta 
[press@okta.com](mailto:press@okta.com) 

### Investor Contact:
Investor Relations 
[investor@okta.com](mailto:investor@okta.com) 

**Disclaimer:**
Research reports and related summaries referenced herein are provided for informational purposes only, and consist of the opinions of the organizations publishing such research and should not be construed as statements of fact. Okta and Auth0 make no representations, warranties, or other assurances with respect to such research.

[^1]: Public Sector Predictions 2022, Forrester Research, Inc., November 3, 2021.

Auth0 Public Sector Index Shows Governments Struggle to Provide Trustworthy Online Citizen Services

anthony-herbert

Anthony makes tutorials on his <a target='_blank' rel='noopener noreferrer' href='https://www.youtube.com/c/prettyprintedtutorials'>YouTube channel Pretty Printed</a>. He focuses primarily on Python web development, but he has broad interest in programming of all forms. Outside of writing code, he enjoys strength training and travel.

Founder of Pretty Printed

Anthony Herbert

Learn how to create a Django public feed application, add authentication, and moderate posts.

Django Authentication Tutorial

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Here’s an easy-to-understand analogy to help your non-technical friends and customers understand public keys and private keys, and how they relate to cryptography and digital signatures.

**If you work in cybersecurity or any computer-related field, sooner or later, you’ll have to explain public-key cryptography and digital signatures to non-technical people.** With the recent rise of remote work and stories about system breaches, computer security has become a topic of discussion even among laypeople.

After trying to explain public-key cryptography and digital signatures to some clients with varying degrees of success, I wanted to develop an analogy that explained them and was easy to remember. I’ve found that even techies get confused by the formal definitions, and many non-technical explanations just seem unsatisfying.

That’s when I stumbled upon [Panayotis Vryonis’](https://twitter.com/vrypan) article, [*Public-key cryptography for non-geeks*](https://blog.vrypan.net/2013/08/28/public-key-cryptography-for-non-geeks/). It became my go-to analogy until my computer science professor, [Dr. Robin Dawes](http://research.cs.queensu.ca/home/dawes/) pointed out a flaw. I refined it with his help, and a suggestion from Matthew Ernest, and the result is below. I hope you find it helpful when trying to explain these concepts to anyone!


## The Box

Imagine a box with a special lock, as pictured below:

![Photo of a box with a lock. There is a key inserted into the lock. Caption: "The box has a lock with three positions: Locked (at the 9:00 position), unlocked (at the 12:00 position), and locked (at the 3:00 position)."](https://images.ctfassets.net/23aumh6u8s0i/4nm7EvXpqVqMxfOPkjUlXe/bca6b7d8d0a00658045dd4f3fd0a5c7f/the_box_has_a_lock_with_three_positions.png)

The lock has three positions:

1. When the lock is at the “9:00” position, the box is locked, and its contents are inaccessible.
2. When the lock is at the “12:00” position, the box is unlocked, which means you can open it and view its contents.
3. When the lock is at the “3:00” position, the box is locked, and its contents are inaccessible.

In order to avoid wandering into endless “What if...?” tangents, assume that it’s prohibitively costly to pick the lock or break the box.


## The Keys

There are two kinds of keys that work with the box’s lock.

### The private key

The first kind of key belongs to you, and only you. You don’t share it with anyone else, which is why it’s called the **private key**. You might make a backup copy in case of emergencies, but you keep it in a safe place that only you know.

![Photo of a single key. Caption: "You keep the private key to yourself."](https://images.ctfassets.net/23aumh6u8s0i/2PJXCaqzggdgTpN4FSm8Qj/4a1228e2e8a6a46ad103c01ffd197e58/you_keep_the_private_key_to_yourself.png)

The private key fits the lock, but it has a particular limitation: it can only turn *clockwise*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "The private key only turns clockwise."](https://images.ctfassets.net/23aumh6u8s0i/qqPVi6JTc2HOW4SuE4sEj/8fcd841021e55b659a3c5b92ad9b2da2/the_private_key_only_turns_clockwise.png)

### The public key

You treat the second kind of key very differently. Unlike the first key, you’ve made many, many copies of these keys. You’ve given them to everyone you know, and even people you don’t know. You’ve left them in as many public places as you could reach: restaurants, stores, busy streets, dark alleys, and any place you happened to pass through. You’ve even left them in other towns, and even other countries! Because of the way you treat this key, it’s called the **public key**.

![Photo of hundreds of keys hanging on hooks on a wall. Caption: "You hand out copies of the public key freely."](https://images.ctfassets.net/23aumh6u8s0i/2LTNf9JxfjDuB4rMZyM7K6/4a3a6264b81bf2b90efaffe469d3406c/you_hand_out_copies_of_the_public_key_freely.png)

Like the private key, public keys also fit the lock, and they also have a particular limitation — but in the opposite direction. They can only turn *counterclockwise*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "The public key only turns counterclockwise."](https://images.ctfassets.net/23aumh6u8s0i/6QVsGSSoLuNdRgpfHznh6H/b5f42c68a9d5aa9e322e898cac14aeb3/the_public_key_only_turns_counterclockwise.png)


## How They Work Together

The lock, private key, and public keys work together to produce these interesting outcomes:

* If the box is locked with a public key, only the private key can unlock it.
* If the box is locked with the private key, only a public key can unlock it.

The keys are designed so that you can’t use one key to figure out how to make the other key.

We can use the box and keys to create two useful kinds of secure communication:

1. I can send you a secret message.
2. You can send me a message with proof that you (and not some impostor) sent it and that it wasn’t altered *en route*.

Let’s take a closer look at each of these kinds of secure communication.

## Sending Secret Messages

Suppose I wanted to send you a message that I wanted only you to read. We have enemies in common who’d love nothing more than to know what’s in the messages I send you.

We each have a cadre of minions to deliver our messages. We trust them... to a limited extent. It would be all too easy for our foes to intercept our messages through force or bribery. 

There must be a way to send messages to you secretly, and that’s where the box comes in. I can use the box to send the message so that no one but you can read it. 

You have the only private key. Everyone else has at least one of the public keys because you’ve been giving them away like candy. 

I put my message in the open box. Since it’s open, it’s unlocked, which means the lock is at the “12:00” position. 

I use one of the many copies of the public key that I own to lock it, turning it counterclockwise from the unlocked “12:00” position to the locked “9:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "I lock the message in the box with the public key..."](https://images.ctfassets.net/23aumh6u8s0i/3WnNKlXN7MC0BfDdEU8GyX/2bcc1521f829c80ff548cf7234078bba/i_lock_the_message_with_public_key.png)

The message is now ready for a minion to deliver to you.

I’m not worried that my minion or anyone other than you will be able to read the message while it’s in transit. Even though anyone can easily find the public key, they can’t use it to unlock the box. Only the private key can unlock the box if it’s been locked with the public key.

When you receive the box, you use the private key to unlock it, turning the key clockwise from the “3:00” position to the “12:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "...and you unlock it with the private key."](https://images.ctfassets.net/23aumh6u8s0i/2kwG5ogtYDYCkDtjC0MqgN/75f2cb365ea0014a0af58a7dbc90c481/you_unlock_it_with_the_private_key.png)

In summary: to send you a secret message, I use a public key to lock the message so nobody can read it, and you use a private key to unlock the message so that you can read it.

This is the general idea behind public-key encryption: **encrypt with the public key, decrypt with the private key.**

## Signing Messages

The “secret messages” use case for the box and private and public keys is intuitive: anyone with a public key can lock a message, but only the holder of the private key can unlock it.

There’s another way to use the box and keys: you can lock a message with the private key, which anyone with the public key can unlock. What could a possible use case there be for a system where anyone can unlock the box?

Suppose one of our common enemies has been trying to break up our alliance and that I’ve been receiving very hurtful messages that appear to have come from you. (I’ll leave the content of those messages to your imagination.)

That enemy has either been sending fake messages or has been intercepting and altering your real ones. There has to be a way to package a message in order to prove that it’s actually from you!

There *is* a way: the box!

In this scenario, you put your message in the open box. Since it’s open, it’s unlocked, which means the lock is at the “12:00” position. 

Using the private key, you “sign” the message by locking it, turning the key counterclockwise from the “12:00” position to the “9:00” position.

![Photo of the box with lock and key. An arrow indicates that the key is being turned clockwise. Caption: "You 'sign' the message with the private key..."](https://images.ctfassets.net/23aumh6u8s0i/1U2aOr7mKgMtGdZM8lPLWT/82ff89d7160d93b04fff8ac635fd41d7/you_sign_the_message_with_the_private_key.png)

One of your minions delivers the box to me.

Since you locked the box with the private key, anyone can unlock it with any one of the many public keys you have distributed. Our common enemy, knowing that this message is in transit, could intercept it and replace your invitation to tea with a “top ten” list of very cutting insults that would surely dissolve our alliance.

The problem with the enemy’s plan is that it won’t work. Intercepting and altering the message means that they would have to do one of two things before forwarding the box to me.

1. They could leave the box unlocked. Since the box is supposed to arrive locked, this is an obvious sign that the message may have been tampered with.
2. They could lock the box. They would have to do it with a public key, which means that only the private key can unlock it. I wouldn’t be able to unlock the box with the only key I had — the public key — which would lead me to conclude that someone had unlocked the box before I did.

If the box arrives at my doorstep and...

* It’s locked
* I can unlock it with the public key

...then, I can be assured that the message came from you and wasn’t changed *en route*.

![Photo of the box with lock and key. An arrow indicates that the key is being turned counterclockwise. Caption: "...and I verify your 'signature' with the public key."](https://images.ctfassets.net/23aumh6u8s0i/4Fax8BanX5Qts7KJzW7166/b4dc34b169f6eca961c8d8f3c7452af4/i_verify_your_signature_with_the_public_key.png)

In summary: to send me a message with proof that you are the sender, you use the private key to lock the message. You’re the only person with the private key, and only a public key can unlock messages locked with the private key. If one of the public keys can unlock that message, I know that it came from you.

This is the general idea behind digital signatures: **sign with the private key, verify with a public key.**

## How About Sending a Message That’s Both Secret *and* Signed?

You might think that sending a message that is both secret and signed is paranoid. I would answer by saying, “Paranoia is the ***mistaken*** impression that people are out to get you.”

Suppose I wanted to send you a secret signed message. I could do it with two boxes:

1. A smaller box, which I own. It will prove that I sent the message. I have the private key for this box, and you have one of its public keys.
2. A larger box, which you own. It will keep the message secret. You have the private key for this box, and I have one of its public keys.

I would lock the message in my smaller box using my private key and then lock it in your larger box using your public key.

When you receive the delivery, you will unlock your larger box first, using your private key. This would reveal my smaller box inside, which you would unlock with my public key.


## It’s Not Keys and Boxes, but Numbers and Algorithms

Of course, we’re not really dealing with boxes, keys (at least the kind that goes into locks), or minions. Here’s a list of elements in these stories and their real-world equivalents:

* **The message**: Anything that you’d want to send that can you can view or edit with a computer. It could be text, one or more pictures, an audio or video recording, a database, or even an application. As far as the computer is concerned, messages are just a long series of numbers.
* **The private and public keys**: Very large numbers that are used in a lengthy math process to encrypt, decrypt, sign, and verify messages.
* **The box**: An algorithm that takes the message and keys and performs the math process to encrypt, decrypt, sign, and verify messages.
* **Minions**: The way in which the message is sent. This could be the internet but could just as easily be an actual minion, such as an unsuspecting summer intern with a USB key.

In the alternate universe where messages are sent with boxes and keys, everyone would have their own set of boxes with their own private keys, as well as copies of other people’s public keys. In the real world, we run applications that run public-key encryption and digital signature algorithms to secure our messages. We still use public and private keys in the real world; they’re just digital.

How to Explain Public-Key Cryptography and Digital Signatures to Anyone

Evaluating Identity Management in the Public Sector

Recently, I attended a National Association of State Chief Information Officers (NASCIO)

Committee meeting where one state gave an impressive presentation on how they built their own [Identity-as-a-Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) for all of their citizens. It was a massive undertaking that took the better part of four years and required buy-in from the highest levels of the state government.

Not for the faint of heart, but to this state’s credit, they did it.

Enrollment is up, and applications have been added. However, even by their own admission, if they had to do it again, they may have chosen to buy or consider a hybrid approach (build and buy).

A modern state identity solution like Auth0 provides the option for governments to do both: build and buy.

## The Rise of Citizen Digital Services

Current and potential customers sometimes cite future uncertainty as one reason they choose to keep IDaaS development in-house, but digital citizen services are here to stay. [NASCIO recently affirmed in their 2021 State CIO Top 10 Priorities](https://www.nascio.org/wp-content/uploads/2020/12/NASCIO_CIOTopTenPriorities.pdf) that digital citizen services, Identity and Access Management (IAM), and the shift to cloud are all top priorities.

As a result, [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) solutions and statewide Single Sign On (SSO) for citizens should remain top priorities to work towards for state IT. In fact, as the digital natives age, the demand for digital citizen services will only _continue_ to grow, as will the expectations for competitive customer experiences.

The public expects to interact with the government the way they do with other websites and applications like their bank. There is a growing understanding of this among state governments and other public sector institutions. Subsequently, those who opt to build IDaaS solutions from scratch will be forced to adapt, support, and scale with the speed and agility of private SaaS companies.

But building the solution is just the beginning.

## Customizable CIAM for Custom Applications

Departments that [opt to build their own CIAM](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management) solutions will have to keep up with changes, emerging threats, breaches, and outages, along with emerging compliance and privacy requirements; then there’s the need to keep pace with citizen demand for new features as the internet evolves.

In government administrations that change frequently, CIOs leave. The potential of the solution becoming antiquated or obsolete is real. By having a modern state identity solution as at least part of your solution, you can still private label it as your own while using a pre-built solution that can be quickly picked up by a new development team.

Cloud-based identity solutions like Auth0 provide an elastic identity engine that can expand or recede. It provides a nice hedge against the future, just in case.

Another reservation expressed with the “build” approach is the ‘speed to service’. How quickly can state governments make applications available to the general public by building them versus partnering with custom IDaaS solution companies like Auth0?

Typically, one of the most critical parts of a project is wiring up applications for identity. States can take months, even years developing their own IDaaS solutions and slow the rollout of their applications. This can mean citizens are not getting access to crucial services for long periods of time.

## Offloading CIAM to Expedite Secure Application Deployment

With a buyable solution like Auth0, state administrations are able to roll out digital services in days versus years for a custom-built in-house solution. The back-end of Auth0’s solutions are pre-built, allowing teams to customize quickly with low to no-code inputs from a development team to get a new release deployed faster.

This is Auth0’s sweet spot: our extensibility. The right buyable CIAM solution is customizable and designed to offload the burden of custom configuration for developers. This enables government organizations to move faster and get citizen technology shipped sooner without compromising on the security of critical information.

Buyable CIAM solutions like Auth0 will produce the seamlessly secure customer experience that citizens have come to expect from digital portals while offering developers and IT teams the customization and extensibility they need to get projects out the door sooner.

To learn more about CIAM for government, [start with our whitepaper](https://auth0.com/resources/whitepapers/how-identity-forms-a-foundation-for-digital-govenrment) then get in touch with our identity specialists to continue the conversation.

Finally, it is our opinion there is a vast difference between those who build IT identity solutions meant for the workforce and those who build them for customers and citizens. CIAM solutions often require a great amount of extensibility and flexibility, whereas off-the-shelf third-party applications for the workforce are plug and play.

Perhaps the answer is not build or buy, but both. Use Auth0 as part of your build scenario, if only as a hedge against the future.

State Identity Solutions: Build? Buy? Or Both?

Global identity management provider recognized for commitment to government, education, and nonprofit customer success

**BELLEVUE, Wash. – April 14, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has joined the [Amazon Web Services (AWS) Public Sector Partner (PSP) Program](https://aws.amazon.com/partners/public-sector/). The AWS PSP Program recognizes AWS Partner Network (APN) Partners with solutions and experience in delivering government, education, and nonprofit customer missions around the world.

Auth0 and AWS are teaming up to help serve public sector customers in solving their unique security, privacy, and user experience challenges to meet mandates, reduce costs, drive efficiencies, and accelerate innovation. As an AWS Public Sector Partner, Auth0 now offers its extensible authentication and authorization solutions to the public sector community on the AWS Marketplace. To be selected for the program, Auth0 had to meet pre-defined criteria, including deep expertise and commitment to delivering government, education, and nonprofit services on a global basis. 

“We are honored to join the AWS PSP Program—this recognition reflects Auth0’s commitment to helping the global public sector community,” said Bill Lapcevic, VP of Business Development at Auth0. “As a Public Sector Partner, we are enabling public sector customers to accelerate their business growth on AWS, and are in a unique position to help these customers achieve their cloud security goals as they scale.”

In addition, Auth0 announced the appointment of Dean Scontras, Senior Director of Public Sector Sales, to lead the company’s federal, state, and local business and sales strategy.

“For the public sector, in particular, the onset of COVID-19 has accelerated the transition to digital citizen services, and heightened the need for organizations across all industries to secure their valued assets and data more firmly,” said Scontras. “I’m honored to join the Auth0 team and aid the company’s continued efforts in helping government agencies at the local, state, and federal level as they move towards digital citizen services and the essential role identity will play in that move.” 

Auth0 is an AWS Advanced Technology Partner that is participating in [AWS Public Sector Summit Online](https://aws.amazon.com/events/summits/online/public-sector/?did=ep_card&trk=ep_card), taking place April 15, 2021. To learn more, visit: [https://info.auth0.com/auth0-at-aws-publicsectorsummit-2021.html](https://info.auth0.com/auth0-at-aws-publicsectorsummit-2021.html)

Auth0 achieved the [AWS Security Competency](https://auth0.com/blog/auth0-achieves-aws-security-competency/) status in 2020 and was one of the first AWS Partners to give AWS customers seamless access to [professional services in AWS Marketplace](https://auth0.com/blog/auth0-supports-the-launch-of-professional-services-in-aws-marketplace/). For more information, visit [Auth0’s AWS Partner page](https://partners.amazonaws.com/partners/001E000000YKGRTIA5/Auth0). 

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Joins the Amazon Web Services Public Sector Partner Program

Nearly zero downtime now standard for Enterprise customers

**BELLEVUE, Wash. – March 3, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced its 99.99% availability service level agreement (SLA) guarantee for authentication services across all [Auth0 cloud](https://auth0.com/cloud) deployments&mdash;shared and dedicated environments. With private cloud deployments already supporting ‘four 9s’ availability, this SLA now extends to Auth0 public cloud deployments, making 99.99% a reality for all enterprise customers. 

Auth0 authenticates and authorizes more than four billion logins per month, demonstrating the scale at which its global customers operate. Whether authenticating consumers, business partners, or employees, reliability and uptime are crucial for every application&mdash;even more so for those with a continuously high volume of traffic. Any kind of downtime in high-demand applications can severely impact revenue, productivity, and brand perception. 

“We deeply understand how critical Auth0’s identity management platform is for the success of our customers’ businesses,” said Shiv Ramji, Chief Product Officer. “The 99.99% availability guarantee across all cloud deployments gives current, and future customers added reassurance of superior reliability and security, and an optimal end-user experience for all of their applications.” 

Auth0 continues to invest in improving the resilience of its platform and the reliability of its application services. While 99.99% is now a guarantee for customers on Auth0’s enterprise plan, platform uptime across Auth0’s U.S. public cloud environments in the past 12 months has been 99.999%+, or five 9s, as seen here: [https://status.auth0.com/](https://status.auth0.com/). 

More information about this reliability standard and Auth0’s cloud deployment options can be found here: [https://auth0.com/cloud](https://auth0.com/cloud). 

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Guarantees 99.99% Availability on Public Cloud

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Official UK Digital Marketplace accreditation makes it easier for public sector organizations to access Auth0’s identity and authentication management

Auth0 has once again been named as a supplier in the Cloud Services category of the G-Cloud 12 framework, part of the United Kingdom's official [Digital Marketplace for the Public Sector](https://www.digitalmarketplace.service.gov.uk/). G-Cloud accreditation prequalifies Auth0 to participate in public sector tenders for critical software and security services. It is the gateway to servicing government departments (such as HMRC) and non-governmental organizations (such as Homes England and the NHS).

This is the fourth year in a row that Auth0 has achieved G-Cloud accreditation, demonstrating Auth0's commitment to the vital public sector. This accreditation ensures continued access to Auth0's world-class security platform for public sector organizations in the UK.

## What Is G-Cloud 12?

The G-Cloud 12 framework helps ensure that public sector organizations have the ability to make informed and competitive choices in choosing cloud service providers (CSPs). The platform's internal marketplace of pre-negotiated service terms provides transparency on CSP pricing models and allows the public sector to avoid negotiating per-product contracts. This significantly streamlines the tender process, providing a base level of legal protection and pricing benchmarks for public sector entities. 

![Auth0 Search Results](https://images.ctfassets.net/23aumh6u8s0i/6njj9d9z8Ud2dgohq8Wv8l/ca3e6746ed06452932631bde00097f3f/01-auth0-search-results)

The framework clearly outlines pricing structures, security protocols, cost, platform compatibility, and more, serving as a central repository that makes it easy for public sector organizations across the UK to assess the cloud-based software tools available to them.

G-Cloud 12 encourages organizations to make the best choices for their own use cases, allowing them to use implementations that might not be feasible through a traditional government procurement system. As in the private sector, public sector software needs aren't one-size-fits-all, and pre-approved pricing structures make it easier to try software on any scale. The G-Cloud hub is a vital resource helping the public sector update their workflows faster and more cost-efficiently.

As the UK Government moves to better serve the public by making online services more available, protecting user identity is a critical security priority. Building identity solutions themselves can tie up valuable resources and expose public sector entities to risk, so they are moving toward utilizing standardized solutions such as those offered by Auth0. These offer world-class security, reduce risk, and free up internal resources for other key tasks.

For example, the West Midlands Fire Service (WMFS) is one of the few government departments in the country with its own in-house software development team. WMFS has been a leader in [creating award-winning digital applications](https://www.itproportal.com/features/how-open-data-helps-put-out-digital-fires/), including Tymly, a low-code, an open-source software platform that allows businesses to create and use flexible applications to gather, process, and distribute data.

However, rather than spend months building its own authentication system for Tymly, WMFS chose to outsource it. WMFS used the G-Cloud framework for its search, ultimately choosing Auth0's Identity-as-a-Service (IDaaS) to provide GDPR-compliant, cloud-based authentication for the Tymly platform. 

Using Auth0, WMFS can implement multi-factor authentication (MFA), biometrics, single sign-on (SSO), and social login to provide ease of access and the high level of security needed for public sector data.

## Recent Changes to G-Cloud Frameworks

The G-Cloud 12 framework is the 2020 update of the cloud services portion of the UK's Digital Marketplace, the central hub for approved services and suppliers operated by the [Crown Commercial Service (CCS)](https://www.gov.uk/government/organisations/crown-commercial-service) since 2019.

The latest iteration is largely similar to G-Cloud 11, but with a few changes. 

New this year is a requirement that suppliers who hold or work with government data need to meet "buyer requirements in respect of AI ethical statements." The Government Digital Service (GDS) has joined with the Office for Artificial Intelligence (OAI) to offer guidance on using AI in the public sector, with the goal of making sure "the public sector is leading from the front in the safe and ethical deployment of AI and other emerging technologies."

This year, G-Cloud 12 also requires in-depth service definitions for each listing explaining the service and how it works — something that Auth0 has always provided for its G-Cloud listings.

![Auth0 Digital Marketplace](https://images.ctfassets.net/23aumh6u8s0i/3ek6TCIybEXqkMBVOXpUhP/2d158a8b6285aa918bb42d73d77f0782/02-auth0-digital-marketplace)

G-Cloud 11 features about 4,200 suppliers and nearly 31,100 services, both an increase over G-Cloud 10. CCS has tracked spend data since the inception of G-Cloud in real-time via an [online dashboard](https://app.powerbi.com/view?r=eyJrIjoiNTEyMTZhZDAtZGNiNi00OWQxLWI5ODYtMjg1ZWNlMmNkODVhIiwidCI6IjlmOGMwZDc5LTNlODctNGNkMy05Nzk5LWMzNDQzMTQ2ZWE1ZSIsImMiOjh9).

## Benefits of Identity Management in the Public Sector

The UK public sector has been criticized for being reactive to new technologies, which often doesn't take into account the complexities and sheer scale of public sector requirements. The G-Cloud regime is an ambitious program designed to help streamline the procurement of best in class CSPs &mdash; which, in the world of identity, means Auth0. 

Identity and access management are clearly critical issues for almost all public sector organizations, but adhering to the constantly changing standards is difficult when an organization is locked into a rigid software stack. Having the flexibility to pursue up-to-date software helps organizations nimbly respond to changing security needs and threats.

Auth0's ability to identify and protect against ever-evolving security threats and our agile development methodology ensures that our customers have accelerated access to security updates and enhancements. With our continued presence in the G-Cloud market, public sector organizations can also benefit from our expertise in this area. 

Our continued G-Cloud accreditation underscores our commitment to democratizing access to our software and mainstream security practices, much like the platform itself aims to improve accessibility and choice for the UK public sector.

## Auth0's Mission

We believe that world-class security protections don't have to be reserved for elite companies or users but should be applied in broad contexts and accessed on platforms such as G-Cloud 12. Auth0's mission is to provide users with secure access to any application with one click or less. Whether you're a public sector organization, a small business owner, or a security-minded user, Auth0 helps ensure that you can access the most up-to-date security standards with low overhead and a seamless user experience.

![Auth0 Identity Platform](https://images.ctfassets.net/23aumh6u8s0i/469d5UiPrrjSZE0cDLMAbC/27a2b8459e326c9b052ab326ca6d34f8/03-auth0-identity-platform)

<include src="asides/AboutAuth0" />

Auth0 named to G-Cloud 12 framework for fourth year in a row

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Use public support to your advantage. Roll out privacy features that build your brand's integrity.

In the wake of the EU-centric [_General Data Protection Regulation (GDPR)_](https://auth0.com/blog/get-ready-for-gdpr/), several other nations, as well as states in the U.S., followed suit with similar privacy regulations. One of the landmark follow-on initiatives, the [_California Consumer Privacy Act (CCPA_)](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375), was approved in June 2018. CCPA will take effect on January 1, 2020.

The Act [builds on existing California law](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=8.&title=&part=&chapter=22.&article), which requires businesses to disclose basic information on data collection practices and data breaches.

In January 2020, California residents, who share their state with many of the world’s tech giants, may ask companies handling their data to disclose what personal information has been collected, and how and why they’ve collected it. Residents will also be able to “opt out of” having their data shared with or sold to third parties.

If companies do not or cannot comply — residents have the right to sue. Many companies are already feeling the pressure.

According to Robert L. Wallan, a partner with Los Angeles-based firm Pillsbury Winthrop Shaw Pittman LLP, [as cited in *Insurance Journal*](https://www.insurancejournal.com/news/west/2019/07/01/530904.htm):

> “You’re going to see some class-action litigation, my prediction is, pretty early.”

Despite the threat of hefty fines ([$7,500 per violated record](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375)) — as well as reputational damages — for noncompliance, many teams are still not prepared. If you’re a chief security officer (CSO) or team lead responsible for safeguarding the data of your users, this article provides an update on major points in the current version of the CCPA — and ways to quickly meet these requirements.

In doing so, you could set yourself apart from [86%](https://fortune.com/2019/03/19/companies-california-privacy-law/) of organizations who are not yet compliant (according to a TrustArc survey reported on in *Fortune*), build greater credibility with your users, and set yourself up for more sustainable growth.

## CCPA: Major Points (the Good and the Bad) to Know

As of the [_July 1, 2020 enforcement date_](https://www.huntonprivacyblog.com/2018/09/01/ccpa-amended-enforcement-delayed-substantive-changes-made/), the Attorney General will support California residents who request the following from companies that collect and use their personal information (PI):

* the particular pieces of personal information they collect,
* the categories of sources that provided their data,
* the categories of third parties with whom they share the data, and
* their commercial reasons for collecting or selling the data.

The CCPA broadly [defines PI](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375) as information about a California resident that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This covers standard items, such as:

* SSN
* driver’s license and passport numbers, purchasing histories,
* internet activities,
* geolocation data, and
* professional or employment-related information.

It also includes “inferences drawn about a California resident” — personal details such as interests, aptitudes, or predispositions that a company uses to [create a customer profile](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/). For a full list of PI as defined by the CCPA, see [here](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375).

Under the CCPA, residents may also request that companies delete any personal information (subject to certain exceptions). As mentioned above, they may also opt out having their data sold.

While the Act isn’t set to be enforced until July 1, 2020, it covers personal data twelve months prior to the January 1, 2020 effective date. This means that the CCPA *already* applies to companies’ data collection, storage, and usage practices today—and throughout 2019. If you don’t have a process in place to handle these specific requests, it’s time to create one.

There are more important criteria to note. If an individual does not want their information sold, the CCPA gives them the right to maintain a consistent level of service and steady costs (i.e., not be discriminated against for not consenting). Under the Act, companies are required to clearly display a link that says "do not sell my data" at the bottom of any page that collects personal information. The CCPA also increases fines and penalties for companies that do not take reasonable measures to secure consumer data—again, a civil penalty of up to $7,500 for each violation.

The Act exclusively applies to businesses that:

* have annual gross revenues greater than $25,000,000;
* buy, sell, or otherwise use personal information of 50,000 consumers, households, or devices each year; or
* derive 50% of their annual revenue by selling personal information.

Since being approved in June 2018, the CCPA has already [_been amended_](https://www.dataprivacymonitor.com/ccpa/california-amends-landmark-privacy-law-delaying-enforcement-and-making-revisions/) — and it’s likely to be revised further. Numerous bills could make the CCPA even more stringent. If the CCPA applies to your company, it’s critical that you’re up to speed to avoid penalties. At the same time, this might feel like an overwhelming task when the regulations continue to grow more numerous and complex.

### The Bad News

The practice of collecting consumer data has expanded without regulation for years. Many companies rapidly and successfully built themselves on this information, which underpins their marketing, product development, industry research, and corporate strategy. Now, they must make major operational changes, including the following:

* Tighten and clearly communicate the process whereby customers can request access to their data, have it erased, or transfer it to another data controller.
* Create new systems with better [user management](https://auth0.com/user-management) and/or potentially hire more IT staff.
* Consider outsourcing core services to an [expert managed services provider](https://auth0.com/blog/managed-service-providers-myths/) if the company can’t cover expanded data-privacy needs in-house
* Work with pared-down data sets in the event that consumers withdraw their information.

Figuring out what to do to bring your company into compliance has never been more important — but you don’t have to work through it alone.

### The Good News

Since California is a hotbed of startups, many young and medium-sized teams are flexible by nature. In contrast to industries like insurance, where many teams have processes set in stone over decades, most tech companies and [tech unicorns](https://auth0.com/blog/so-you-want-to-be-a-unicorn/) are more nimble and willing to adapt to changing circumstances. Already, most of these have sent out updated privacy-policy emails to their customers:

![Everlane changes its privacy policy making it easier to understand](https://images.ctfassets.net/23aumh6u8s0i/1E4wAnIObdgK5o5DS08bUP/063ec75b42428fec586862450e9da822/everlane-changes-privacy-policy-making-it-easier-to-understand)

![Houzz updates its policies to make them more transparent](https://images.ctfassets.net/23aumh6u8s0i/iH4yYW88yxsjFttg4ldXO/bdc27ad70562353ce495b040e03698cd/houzz-updates-policies-to-make-them-more-transparent)

In anticipation of CCPA enforcement — as well as the implementation of data privacy policies across [107 nations](https://unctad.org/en/Pages/DTL/STI_and_ICTs/ICT4D-Legislation/eCom-Data-Protection-Laws.aspx) and [nearly 15 other U.S. states](https://www.dataprivacymonitor.com/ccpa/the-california-consumer-privacy-act-frequently-asked-questions/) — other industries are quickly following suit. In addition to email, some best practices are arising across sectors on the back end, including [_identity and access tools_](https://auth0.com/b2e-identity-management-for-employees), specialized managed service providers, [more efficient deletion of user data](https://segment.com/blog/preparing-for-the-ccpa-and-the-future-of-privacy-regulation/), and enhanced anomaly protections for suspicious user behavior.

## Anomaly Detection

[Many companies are taking advantage of](https://twitter.com/intent/tweet?text=%22Auth0+has+anomaly+detection+to+protect+consumer+information.%22%20via%20@auth0%20http://auth0.com/blog/brace-yourself-the-gdpr-ripple-effect-in-california/) [anomaly-detection tools](https://auth0.com/docs/anomaly-detection) to ensure that the users accessing consumer information are (1) who they say they are and (2) behaving appropriately. With large organizations giving access to a wide swath of users both internally (IT staff, marketers, managers) and externally (third-party contractors or consultants), it can be difficult to figure out who is logging in when and from where, and who is using what device(s). Implementing identity access and management tools that incorporate anomaly detection can be essential for avoiding fraudulent practices.

![Auth0 has anomaly detection to protect consumer information](https://images.ctfassets.net/23aumh6u8s0i/4bGZ8v04Sr8DuJR9hXNeYg/583bb6a4ad7a7f7c7e4b02e8a7df8c69/auth0-has-anomaly-detection-to-protect-consumer-information)

With Auth0, anomaly detection is customizable. Once enabled, you can set rules that alert administrators to any suspicious activity and block login attempts by specific users if, say, they are working with data they do not have authorization to use or they fail to enter the system with the correct password.

<include src="TweetQuote" quoteText="Auth0 has anomaly detection to protect consumer information."/>

Teams have been testing and finding early success with these and other new features, like [user dashboard views](https://auth0.com/docs/getting-started/dashboard-overview). Even if you're not a hot tech startup, you still have the advantage of proximity to some of the most cutting-edge technologies and resources in the world.

## Seize the opportunity

The CCPA has strong momentum to become even more robust. As consumers continue to feel the damages from the massive Target and Equifax breaches, Cambridge Analytica’s [_data leaks_](https://auth0.com/blog/cambridge-analytica-and-facebook/), the recent [Marriott breach](https://auth0.com/blog/marriot-starwood-data-breach-5-steps-to-protect-your-data/) and [British Airways incident](https://www.nytimes.com/2019/07/08/business/british-airways-data-breach-fine.html) — they’re pushing their representatives for change. The original ballot initiative that gave rise to the CCPA had [>600,000 signatures](https://www.wired.com/story/california-unanimously-passes-historic-privacy-bill/) when it passed, nearly 2x the 366,000 minimum requirement. Private and public sector coalition backers included the Consumer Federation of California, DuckDuckGo, Consumer Reports, BLUR, DeleteMe, Catalina's List, the Center for Public Interest Law, the Parent Coalition for Student Privacy, and the Academy of Integrative Health & Medicine.

Instead of facing CCPA enforcement with anxiety or opposition, use this swelling public support for the measure to your advantage. Get ahead of the curve in rolling out privacy features to your users on the front end, improve your back-end policies with better identity and access management software to protect your customers, and build a reputable brand in difficult times.

<include src="asides/AboutAuth0" />

Brace Yourself for CCPA Aftershocks (2019 Update)

davide-barbato

Security is a mindset. It's something that goes beyond IT and working hours. In Auth0 I've found a community of people who live and breath security, who are passionate about it and are self-motivated to grow and make an impact — exactly as I am.

Security Engineer

Davide Barbato

Discover how AWS communicates the creation of S3 buckets and the implications of relaxed permissions.

Fantastic! Public S3 Buckets and How to Find Them

956290?s=200

R&D Content Engineer

Luke Oliff

Learn how to use Postman to manage a collection of public and secure API endpoints

Manage a Collection of Secure API Endpoints with Postman

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Japan’s public cloud spend is expected to reach $5.8 billion by the end of 2018, but cyberattacks are on the rise. Auth0 authentication can help.

## Rising Cyber Attacks Push Need for Stronger Defense

Shedding legacy systems through digital transformation is increasing the global spend on public cloud services, according to a recent [IDC forecast](https://www.idc.com/getdoc.jsp?containerId=prUS43511618). By the end of 2018, worldwide spending on public cloud is expected to reach $160 billion — a 23.2% increase over 2017. While the United States is still spending the bulk of those billions, Japan’s rapidly growing market is expected to contribute at least $5.8 billion to that spend.

With increased reliance on cloud services, comes an increased awareness of the potential for cyberattacks, especially since Japan’s government cloud faces consistent attacks. On April 3, Japan’s [National Center of Incident Readiness and Strategy for Cybersecurity](https://www.nisc.go.jp/eng/) warned that official email addresses for about 2,000 government officials had been leaked, reports the [Japan News](http://the-japan-news.com/news/article/0004351856), noting that each year, government agencies face more than one million attacks.

“Without the right protections,” says Auth0 CISO Joan Pepin, “government cloud can be at least as vulnerable as public cloud. Authentication — making sure that users are who they claim to be — is a foundational security control.”

Certain industries, like the discrete manufacturing, manufacturing, and professional services industries that will take up to 43% of Japan’s spend, are turning to IoT to increase their capabilities, according to IDC. While these devices offer rapid, non-touch action as well as the collection of massive amounts of data, they also open organizations to various vulnerabilities, since the [IoT industry lacks a consistent set of standards and protocols](https://www.gov.uk/government/publications/secure-by-design).

More than [20 billion connected devices](https://www.gartner.com/newsroom/id/3598917) are expected to be online globally by 2021, according to Gartner, bringing with them the potential for [geometrically increasing risk](https://auth0.com/blog/security-risk-20-plus-billion-iot-devices-by-2020/). These vulnerabilities are easily exploited by hackers — [botnet controllers increased by 140% in 2017](https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924).

<include src="TweetQuote" quoteText="“Without the right protections,” says Auth0's @CloudCISO_Joan, “government cloud can be at least as vulnerable as public cloud. Authentication — making sure that users are who they claim to be — is a foundational security control.”"/>

Given all the cybersecurity risks, Japan, [like several other governments around the globe](https://auth0.com/blog/gdpr-effect/), took significant steps to protect personal data when the [Act on the Protection of Personal Information (APPI)](https://iapp.org/news/a/matchup-gdpr-and-japans-act-on-the-protection-of-personal-information/) came into force last May. Although focused on data protection and privacy like the EU’s GDPR, APPI focuses on protecting the rights of individuals and extends protections to include personal identifier codes, and aggregated information in the "business operator’s" database. The EU and Japan are currently in discussions regarding mutual "whitelisting."

Based on these regulations and stricter policies around data management in the region, the need for enterprises in Japan to prioritize identity management is undeniable. We addressed this demand by establishing a formal Auth0 presence in Tokyo last year, and launching our [website in Japanese](https://auth0.com/blog/auth0-japanese-localization/): [https://auth0.com/jp](https://auth0.com/jp), and are continuing to dedicate significant resources to this region. Auth0 is uniquely suited to address the challenges of Japan-based and global companies looking to expand in this growing market. If you’re based in Japan and would like to learn more about how Auth0 can create a first line of seamless and secure defense, please reach out to [yuichiro.kuwano@auth0.com](mailto:yuichiro.kuwano@auth0.com).

<include src="TweetQuote" quoteText="Auth0’s authentication can help protect industries like discrete manufacturing, manufacturing, and professional services expected to take up to 43% of Japan’s $5.8B public cloud spend spend in 2018."/>

"public"