RichardSchwabacher

Richard brings an extensive track record developing digital strategies, best-in-class products, services, and personalized solutions that offer superior digital consumer and physician experiences as BioReference’s Senior Vice President, Digital Health and Chief Digital Officer. He is adept in building high-performing teams and leading colleagues through a shared purpose and vision, and creating customer empowerment through human-centered design, technology, innovation and digital solutions.

SVP for Digital Health and Chief Digital Officer

Richard Schwabacher

BioReference Laboratories SVP for Digital Health and Chief Digital Officer Richard Schwabacher on how the pandemic will make virtual health the default

_ EDITOR’S NOTE: During a recent case study interview, Senior Vice President, Digital Health and Chief Digital Officer, BioReference Laboratories, Inc., an OPKO Health company, [Richard Schwabacher](https://www.linkedin.com/in/rschwabacher/) said that responding to COVID-19 has accelerated trends in the digital health by 7-10 years. We asked Schwabacher, a veteran of Pfizer and Quest Diagnostics who had left diagnostics only to return due to COVID, to expand on his perspective in this guest author post. ([Learn](https://auth0.com/case-studies/bioreference/) how BioReference used Auth0 to quickly scale to meet pandemic requirements.)_

There has not been an event that has impacted humanity as intensely as COVID-19. It has exacted a heavy toll, and it is clear that we will be confronting the effects for years to come. 

In terms of digital health, we already see COVID-19 accelerating trends that were thought to be a decade or more away. Trends like telemedicine and remote patient monitoring, to name just a few, were just starting to take hold when the pandemic hit and are now experiencing rapid adoption. 

Responding to COVID-19 has created a moment when patients, physicians, and insurers are more open to new ways of thinking and working. What this means for the future of healthcare is not just exciting but potentially profound.

## FinTech as a Proxy for HealthTech

Today, most of us bank from our smartphones. This is, in part, because the financial services industry has done a relatively good job balancing customer experience and data protection within their digital solutions. FinTech companies that focused on micro journeys within the space, like peer-to-peer exchanges, led to consolidation in the sector as large institutions clamored for ways to attract new customers and delight their existing customers through thoughtful digital experiences. 

Take Zelle’s peer-to-peer payment technology. Zelle, now integrated into several of the traditional banking institutions, focused on simple peer-to-peer transactions. They appealed to a segment of the [population increasing in value to the banks as customers and offered a treasure trove of data on consumer behavior](https://www.paymentsjournal.com/peer-to-peer-payment-apps-are-diversifying/). Although peer-to-peer [can be prone to additional risk](https://www.wfmynews2.com/article/news/local/2-wants-to-know/what-you-dont-know-about-cash-apps-like-venmo-zelle-cash-app-consumer-reports-says-apps-dont-work-like-a-bank-there-are-no-protections/83-4157e228-c6f0-484c-b239-23119a44f3f5), the big banks incorporated Zelle into their user interface, knowing that customers would seek out this functionality and might leave their old bank behind. It’s a degree of personalization that is aligned with customers’ needs. The fear of a devaluating customer, or worse, one who's about to leave, is a powerful incentive for innovation. As consumers, there’s virtually nothing stopping a consumer from trying or switching banks entirely if not satisfied. We can do that with relative ease and without asking permission. We can just make the change frictionless. 

Not the case when it comes to healthcare. Don’t like your insurance company? Not so easy to jump ship. If you receive your health insurance from your employer, like most Americans, you’ll have to wait for annual open enrollment to make a change. And even then, you’ll have only a handful to choose from.

## Experience Will Shape Future Digital Health Solutions

We have become conditioned as consumers to expect all experiences to generally be the same, often judging an experience against those that immediately preceded it, especially a personalized experience. When it comes to healthcare, personalization is difficult. Pre-COVID, the patient experience would weave from analog (i.e., in-person experience) to digital (i.e., telehealth) and back, all the while attempting to silo data and protect privacy. The protection and safe transportation of data in healthcare is an industry in and of itself. The patient, or consumer’s, expectation is that when they show up at a healthcare institution, that experience is going to be consistent with what they get at their bank, and they are frustrated when it’s not. [Healthcare accounted for 17.7% of the gross domestic product (GDP)](https://www.cms.gov/Research-Statistics-Data-and-Systems/Statistics-Trends-and-Reports/NationalHealthExpendData/NHE-Fact-Sheet) in the U.S. in 2019, and given the amount of interaction behind that large a number, we’re seeing a high degree of general dissatisfaction within healthcare. When so many of us are interacting with a sector that’s antiquated and unable to keep pace with consumer expectations, dissatisfaction is expected.

Pre-COVID, the solution to personalizing experiences was to create healthcare institutions that are oriented horizontally so that experience would be tailored to patient circumstances. For example, if you were receiving treatment for cancer, the cancer center's physical layout would be orchestrated literally around a patient’s journey. 

As digital experience continued to grow in other sectors, patient’s expectations seemed to outpace healthcare experiences. After all, there’s only so much that a building layout can accomplish when you’re still working off a clipboard every step of the way. Patients began to expect their medical records would simply travel with them. For the patient, this might mean a combination of an analog and digital experience that might not feel seamless due to the rigor required to protect sensitive data.

## Post-COVID Norms

The shift we see from analog to primarily digital experiences is driving three main trends: the decentralization of healthcare, improving physician acceptance of telehealth, and where I think we’re headed; virtual care will become the default.

* **Decentralization of healthcare:** One of the important and immediate impacts of COVID was an attempt to keep most patients that didn’t need to be in a healthcare setting at home for care. This change started with the most at-risk patients for [COVID co-morbidities](https://www.cdc.gov/coronavirus/2019-ncov/need-extra-precautions/people-with-medical-conditions.html). 
If you have chronic kidney disease, going into a healthcare facility puts you at a higher risk, even if you’re taking all the precautions. But assuming greater risk by having the patient physically enter a facility is not just about protecting the individual patient. 
With the pressures of COVID, hospitals are trying to manage available ICU beds. For a small hospital operating at a typical capacity, two to four additional ICU patients mean they go from having an ICU, that’s at 40- to 50%-full to 90%-full pretty quickly. By keeping high-risk patients at home, they not only protect those more vulnerable to COVID they also can focus limited resources on those who need it most. 
Adoption typically follows payment structures and incentives. In November, the U.S. government released new reimbursement schedules for asthma patients, another at-risk group, to receive in-home treatment. That probably would have happened at some point. The trend line was there, but pre-COVID, it certainly wasn’t at the degree that it is now. 

* **Physician’s more receptive to telehealth:** Having a human in front of you is very different from observing them via a computer screen. In person, physicians notice things and investigate and interrogate them in a way that can lead to a diagnosis. There’s nothing that will ever replace that level of care, which is one of the reasons many physicians were reluctant to shift to a primarily virtual model. 
Most physicians tend to follow the practices learned during medical school. We have a large physician population that didn’t learn how to diagnose via an electronic tablet. For them, this may feel like a hindrance. However, doctors who came through medical school more recently were more likely to use electronic tablets during their much more receptive. Again, the trend lines for telehealth there, but COVID has forced acceleration. 

* **Virtual care will become the default:** Patients typically aren’t willing to pay for care that isn’t covered by insurance, and many virtual care services weren’t reimbursable. These virtual services are now seeing insurance coverage. Alongside payment, we are also seeing massive investment in the telehealth model. 
In the first three quarters of 2020, $1.6 billion was [invested in telemedicine](https://rockhealth.com/reports/q3-2020-digital-health-funding-already-sets-a-new-annual-record/)—more than twice what was invested in all of 2019. 
Based on this investment and the behavioral changes amongst patients, physicians, and insurers, I think we’ll see virtual care increasingly become able to perform primary care visits. Hopefully, this will increase both the access to care and the frequency in which it occurs. 
Now that people are more comfortable with a secure video conferencing experience, we may start to see connected devices like an Apple Watch or other bracelets feeding data to the physician’s computer or tablet. This allows the patient and the physician to have more of a shared experience while providing the opportunity for the data to aggregate because it’s being collected for a specific reason within the bounds of privacy regulations. 

These accelerating trends also underscore the need to address the Digital Divide, the noted difference between those that have access to and can afford Wi-Fi, computers, and smartphones, and those that don’t. Data has a tremendous opportunity to increase understanding, but only if we are able to provide access.

## Connecting the Dots Is Key

A major concern among patients and physicians is how to secure all this new information, and data is collected and aggregated for patient care. There’s never enough that you can do to protect personal health data, but there are important tools that can be put in place — like identity verification — that can help. 

The truly transformative unlock will occur when data transportability connects important behavioral and clinical dots to form a horizontal view. Think if all of the actors in any particular set of clinical settings could actively manage and engage with patient data. 

The CDC and other health organizations formally recognize that “[how we live, work and play affects a wide range of risks and outcomes](https://www.cdc.gov/socialdeterminants/index.htm).” The ability to connect disparate data is an incredibly powerful tool to understand the progression of social determinants of health. This is why there are entire healthcare verticals spending so much time trying to figure out how to connect the dots. If you can connect the dots, outcomes should become more positive. 

The global pandemic has made it easier for policymakers to see the clear connections between things like housing, food insecurity, and COVID outcomes. Many are hopeful that this will continue to drive social determinant conversations that could have substantial impacts. The key to this will be the successful protection of health data and patient identity. 

## What This Acceleration Means for Diagnostics

It doesn’t matter where you are in this world; you’ve been impacted in some way, shape, or form by COVID-19. Directly or indirectly, diagnostic testing is at the core of being able to manage what’s happening in the world and understand it. Healthcare diagnostics is like the zeros and the ones that create the binary code of healthcare.

<include src="TweetQuote" quoteText="Humanity’s collective understanding of the value of diagnostics has never been higher than it is right now." />

When you consider the number of people that have been tested for COVID-19 around the globe, it is incredible. And for every person that’s been tested in the United States, they probably created a patient portal account with whoever performed their COVID analysis. This means that not only these patients see their COVID-19 test results, but likely every other test that that institution performed for them previously is now in front of the patient. That’s millions and millions of patients interacting with their diagnostics data directly.

The conversations that are happening with healthcare providers, municipality leaders, and companies offer the possibility of lasting change because they’re not stopping at COVID-19 testing. They’re asking questions that go beyond it. I came back to this industry because I do believe in all of the trends that we’re talking about are going to lead to a significant shift. 

I’m fortunate to have the opportunity to work with a team of like-minded individuals who are approaching these problems, knowing that technology, digital in particular, is going to help us solve them. And, for my colleagues and me, this is exciting, but it also comes with responsibility because we understand the opportunity that we have, and we want to make sure to make the most of it.

COVID-19: The Great Digital Health Accelerator

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Find out how business leaders are using identity to accelerate their business strategy

In response to COVID-19, 75% of CEOs have accelerated digital transformation, a recent [Zscaler study](https://www.zscaler.com/resources/white-papers/securing-remote-work.pdf) found. 

While the study specifically focused on work from anywhere (WFA) solutions, the need for digital change isn't critical just for employee access. As nearly every customer experience is driven online, your customers' digital experience is the major way they experience your brand.

[Fortune](https://fortune.com/2020/06/26/coronavirus-accenture-ceo-digital-transformation/) noted that the crisis has quickly widened the performance gap between companies investing in digital innovations and those who weren't into a "chasm," saying "digital leaders were performing better through crisis." Companies need new technologies that allow them to activate new business models fully. In this environment, digital transformation initiatives may still be scoped over multiple years, but CIOs need to demonstrate value on a much faster timeframe. 

And the need for rapid digital adaptability is surfacing as an even stronger driver amongst Auth0 customers, especially for those seeking [B2B](https://auth0.com/b2b-enterprise-identity-management) and [Customer and Identity Access Management (CIAM)](https://auth0.com/b2c-customer-identity-management) solutions.

<include src="ebook-ads/DigitalTransformationBook" />

For many business leaders, the question is not just about how to add artificial intelligence and machine learning to new products, but how to keep their companies moving forward, given unpredictable global conditions. Others are wondering if it's too late to catch up &mdash; or even run ahead.

If you're willing to treat Identity Access Management (IAM) as a reusable service as part of your digital transformation strategy, it's not.

## Reusable Services Speed Digital Transformation Success

Many digital transformation projects are executed over the course of several years, while everyone works through "rigid" monolithic I.T. infrastructures and apps created for specific moments in time. Replacing legacy technology with "[componentized](https://auth0.com/resources/whitepapers/state-app-assembly-2020)" digital technologies (think building blocks) that can be more easily reassembled and re-architected allows companies to adapt more rapidly to changing business needs.
 
Reusable services like online payments, communications capabilities, and identity management allow companies to speed their digital transformations and deliver scalable value to customers. Basically, these services give you the power to do what you need to do, when and how you need to do it.

As Pierre Alvear Foxler, Service Manager, IAM, for Northern Europe's leading farming cooperative, [Lantmännen](https://auth0.com/case-studies/lantmannen/), points out, shifting from on-premises to services-based solutions like Auth0 have financial benefits as well as usability benefits. "We went from an on-premise solution that was capable, but complex and costly, to one that saves us money on infrastructure, IAM delivery, and application management," he says.

Strongly designed services can also make it easier to manage the complexity of the fragmented healthcare system, says Chris Carruthers, Principal Technical Program Manager, [Providence](https://auth0.com/case-studies/providence/), a nonprofit healthcare organization based in the U.S. "The healthcare industry is a complex landscape. Many customers have legacy applications and require highly secure vendor systems that meet patient data privacy requirements. Auth0's adherence to top compliance frameworks makes them a valuable identity partner for us."

## Reduce Time to Implementation

The most effective business strategy in the world, expressed through well-planned business models, can easily stall (or die) due during change management. IAM can be a powerful tool for business leaders to speed implementation. Resolving IAM challenges with the help of a vendor focused on not only current, but potential business possibilities means that you can use the IAM discussion as a framework to drive consensus and momentum for their evolving digital transformation strategy.

### Lifen: Contact Tracing in 5 Days

AI-powered [Lifen](https://auth0.com/case-studies/lifen-cs/), a solution that facilitates the secure transfer of medical documents between patients, private practitioners, and hospitals, came to Auth0 early in the pandemic with the goal of replacing their existing identity infrastructure &mdash; and rapidly spinning up a contact tracing solution. We delivered in five days.

You read that right &mdash; five days.

"It was in record time," says Lifen CTO Dali Kilani. "We've put it in the hands of multiple healthcare institutions."

But speed wasn't Lifen's only goal. 

Especially in a global environment with an increasing number of [data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/), fast means nothing if your new solution isn't also more secure. Despite the rapid turnaround, Kilani is more than comfortable. "Auth0 maintains the highest level of security that is possible at this point. Every single doctor and patient that accesses our solution performs their authentication through Auth0. We've put Auth0 at the heart of our service."

### Gymshark: Headless Commerce + Credential Stuffing Protection

For Auth0 customer [Gymshark](https://auth0.com/case-studies/gymshark/), a conditioning brand dedicated to fitness apparel, digital adaptability means making major shifts away from siloed logins that were spoiling their user experience. "We're going down a headless commerce route, doing much of our ops and infrastructure through serverless technologies with cloud partners such as AWS. We're kind of rebuilding the whole back office of the company from the ground up," says Dan Lake, Gymshark Engineering Director.

The complexity of managing a digital transformation alongside a social media following of 10+ million and customers in over 170 countries could have made customer identity and access management (CIAM) changes extremely challenging. 

Instead, Auth0 saved time and effort.

"The ease of implementing Auth0 was brilliant. It saved us months of time, salaries, effort in finding the right engineers, obviously ongoing support, and also probably given us back a few years in our lives as well through stress," says Lake.

Lake also points out that Auth0 has added benefits. "Auth0 protects us against credential stuffing. You don't realize how valuable [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) features are until it happens. Those are the kind of features that we relish at the moment, things we see that our customers don't."

### Scale Quickly Across Multiple Applications 

Global technology powerhouse [Siemens AG](https://auth0.com/case-studies/siemens/) plays a pivotal role in everything from digital enterprise to energy to financial services and operates in nearly every country in the world. Performing on a global scale can get extremely expensive when apps are measured across multiple divisions. Creating a uniform login experience for customers and partners allows Siemens to sustain a focus that benefits their business. 

"It was of the utmost importance to have a secured, stable and reliable authentication platform, [so that] our clients and partners can focus on their business instead of focusing on how to log into hundreds of Siemens' applications available in the market," says Hugo Francisco, Service Owner of Siemens ID, Siemens.

## Make Sure Your UX Keeps Pace With Your Business Innovation

With 170 superstores across the U.K., Dunelm prides itself on style and affordability &mdash; and is transforming their digital experience to keep pace with their tangible one.

Moving to a modern, flexible cloud platform is a critical part of that business strategy.

"One of the key things we wanted to do was move over to a cloud platform, AWS, where we could scale up and down and build the best in class for our online customers," says Antony Sohal, Head of Data Platforms for Dunelm.

But instead of building that digital experience in-house, Dunelm created the customer experience using a componentized approach. "One of the key decisions was to focus on what we're good at and single out what we're not good at. We built a product service, a pricing service, we bought authentication, we even bought search as a service. We bought the infrastructure we needed," explains Sohal.

Buying identity-as-a-service means that the effort that would be spent on authentication can instead be spent on core functions and, with the right identity partner, used to customize the user experience. This means there's no need to sacrifice digital innovation for time-to-market. A flexible, extensible identity platform means you can get to market faster and ensure future adaptability.

Treating identity as a reusable service can help your new products get to market faster — and strengthen your ability to adapt once you're there. As Lake explains, "The largest shift and growth at Gymshark is we've become a tech company through our aim to unite the conditioning community. We're building the foundation for where we're headed, and it's just going to get bigger and bigger."

Carruthers says [Providence](https://www.providence.org/en) turned to Auth0 for help creating a seamless, consumer-facing digital experience for patients. "We're years ahead of where we would be if we were to build identity ourselves," says Carruthers.

If you'd like to learn more about how Auth0 could help your company continue to adapt and grow, please reach out to an [Auth0 resource](https://auth0.com/contact-us).

<include src="asides/AboutAuth0" />

How Digital Transformation Enables Business Adaptability

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Leading laboratory testing provider seamlessly handles 25x volume increase in patient portal users during COVID-19 with Auth0

**BELLEVUE, Wash. – Dec. 10, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it is providing [BioReference Laboratories, Inc.](https://www.bioreference.com/), an OPKO Health company and a leading provider of laboratory testing services in the U.S., with end-to-end authentication for its patient portal, giving patients HIPAA compliant and secure, direct access to their lab results and medical data. This was essential as COVID-19 hit and BioReference faced a rise in new patient portal users&mdash;including a 25x increase in volume overnight&mdash;who needed a secure and easy way to monitor their test results.

BioReference provides comprehensive diagnostic solutions to healthcare providers, clinics, hospitals, employers, government units, correctional institutions, medical groups, and more. The laboratory’s vast test menu is utilized in the detection, diagnosis, evaluation, monitoring, and treatment of disease, including COVID-19. In recent months, BioReference has made significant investments in its B2B and B2C offerings, including Customer Digital Solutions, Direct-to-Consumer Solutions, Telehealth, and Patient Empowerment. 

“COVID-19 has caused a seven to ten-year acceleration in consumer and digital trends,” said Richard Schwabacher, SVP for Digital Health and Chief Digital Officer at BioReference Laboratories. “Securing, transmitting, and authorizing patient access to health information digitally is now critical to the practice of medicine and core to what is needed from a modern digital health solution.”

Identity and access management (IAM) was a key component in BioReference’s transition to providing a more patient-centric model. The company leveraged Auth0 as the IAM in its new patient portal so that patients can securely see results and pay bills, giving patients direct access to their healthcare information. Now, patients no longer have to depend upon their healthcare provider to act as an intermediary to access this information. 

“Auth0 helps address concerns about security and user access, especially during times like the present when COVID-19 is causing a significant increase in patient demand,” said Vinny Pacione, VP of Consumer Technology and Digital Solutions at BioReference Laboratories. “Enabling delivery of this data to individuals in a self-service way using scalable, automated digital platforms was a key problem to solve. The most fundamental piece of the solution is securing the data and ensuring that only the individuals who have appropriate authorization can access it.”

“Identity management is a critical component of any digital transformation initiative, and COVID-19 has forced many companies into transition,” said Ghazi Masood, SVP of Americas for Auth0. “BioReference aspires to transform telehealth and put patients at the center of the future of medicine. We are proud to aid them in their journey and help them to deliver a secure, seamless experience for their patients.”

More details on BioReference’s implementation of Auth0 can be found [here](https://auth0.com/case-studies/bioreference/).

## About BioReference Laboratories, Inc.

BioReference provides comprehensive testing to physicians, clinics, hospitals, employers, government units, correctional institutions, and medical groups. BioReference developed and offers test services that yield high quality and accurate results, including a molecular test for helping with COVID-19 diagnosis and a serology test to help indicate possible COVID-19 exposure. The company is in network with the five largest health plans in the United States, operates a network of 11 laboratory locations, and is backed by a medical staff of more than 120 M.D., Ph.D., and other professional level clinicians and scientists. With a leading position in the areas of genetics, women’s health, maternal fetal medicine, oncology, and urology, BioReference and its specialty laboratories, GenPath and GeneDx, are advancing the course of modern medicine. For more information, visit [www.bioreference.com](https://www.bioreference.com/).

<include src="asides/AboutAuth0" />

### Media Contacts: 
Auth0 Global Communications 
[press@auth0.com](mailto:press@auth0.com) 
 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com) 

BioReference Laboratories Communications 
[media@bioreference.com](mailto:media@bioreference.com)

Auth0 and BioReference Laboratories Answer Patient Demand for Secure, Direct Access to Test Results

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

Here’s how you can protect your customers, your employees, and yourself

Do you remember the last time you fell, or almost fell, for a phishing email? I do.

I received an email notification while I was checking my phone: “Unlock your Amazon account”, apparently coming from an amazon.com address. Although unexpected, it was feasible, I had made a purchase on Amazon recently and had changed settings that could have locked the account. 

Concerned, I opened the email.

The design matched Amazon’s style, there were no typos, and my phone’s email app interface just showed me the sender’s name rather than their email. I inspected the link and noticed it was fake.

It was one of the best phishing emails I’ve received in recent times. It managed to make me feel concerned while reading it. That’s the key.

Phishing is both simple to implement and effective. A relatively low-effort attack that can have a high reward. According to Verizon’s [2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf), attackers used phishing in 22% of the investigated breaches. The quality of the attacks varies: we can go from the obviously fake, to sophisticated spear phishing campaigns that are fully customized. 

The most effective phishing emails are typically those that tap into strong emotions that drive action. In “[Thinking, Fast and Slow](https://www.amazon.com/dp/B00555X8OA/ref=dp-kindle-redirect?_encoding=UTF8&btkr=1)” Daniel Kahneman, Nobel Prize of Economics, proposed that humans have two modes of thought "System 1" which is fast, instinctive and emotional, and "System 2" which is slower, more deliberative, and more logical. Humans feel before we think. We are emotional beings. 

![phishing-separator-1](https://images.ctfassets.net/23aumh6u8s0i/4fRwjLa60geXQsStXAkFkv/b350326d596f0fdca3a5d650b9e35933/phishing-separator-1)

[Coronavirus presents a wonderful opportunity for cybercriminals to exploit our emotional selves](https://auth0.com/blog/coronavirus-and-cybersecurity-how-your-business-can-stay-safe/), “System 1”, much easier. It’s a situation that’s intrinsically concerning, and that demands a high level of engagement to stay updated with the latest alerts and announcements. Imagine the spectrum of campaigns that would tap into a strong emotion:

* Concern / Fear: Infected near you, new negative effects, tracking apps
* Curiosity: remote work, fake cures or vaccines, meeting requests, refunds, fake package delivery
* Despair / Necessity: Medical equipment, financial aid
* Compassion / Kindness: Charitable contributions

Imagination is the limit. 

## What’s the Landscape as of May 2020?

The [COVID-19 Cyber Threat Coalition](https://www.cyberthreatcoalition.org/about-us/our-mission), a coalition of cybersecurity experts working to protect individuals and organizations from COVID-19-related cyber threats, releases weekly threat advisories. Phishing appears constantly in these posts, as it’s one of the most prominent threats organizations face.

The phishing landscape has changed significantly since the pandemic started. Shortly after COVID-19 was officially declared a pandemic by the [World Health Organization (WHO)](https://www.who.int/) on March 11th, registrars saw a spike in COVID-19 related domain name registrations, with a peak of around 5000 high-risk domains registered per day in the week of March 16th. 

This number has gradually decreased since then, especially after domain registrars were requested to [increase scrutiny around COVID-related sites](https://www.zdnet.com/article/new-york-asks-domain-registrars-to-crack-down-on-sites-used-for-coronavirus-scams/) by the New York Attorney General.

![phishing-graphic](https://images.ctfassets.net/23aumh6u8s0i/3AwdeH8uutY4HUEDiZqn1b/ac8a8ac47f023ab5219a96729b2ae318/phishing-graphic-2)
Source: DomainTools

However, as per the latest [advisory from the Cyber Threat Coalition](https://www.cyberthreatcoalition.org/advisories/2020-05-20-weekly-threat-advisory-domain-trends), it seems that the domain registrations shifted to the latest trend in the pandemic: masks. 

[Google’s threat analysis group reported](https://www.blog.google/technology/safety-security/threat-analysis-group/findings-covid-19-and-online-security-threats/) that they’re detecting 18 million malware and phishing Gmail messages per day related to COVID-19, with health organizations and health agencies becoming targets as a result.

## What Can We Do to Protect Ourselves And/Or Our Companies From This Constant Threat? 

Phishing attacks tend to have one of these three main goals:

1. **Credential Theft**

 Typically involving a link that sends the user to a fake look-alike website that requests credentials to login. 

 If the account is not properly secured with methods like [Multi-Factor Authentication](https://auth0.com/docs/mfa) (MFA), the credentials obtained could result in an account takeover. The compromised account could then be used to access internal systems, which could cause a data breach that could have compliance-related consequences as per the relevant data privacy laws such as [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA).

2. [**Business Email Compromise**](https://shorturl.at/uFRU4)

 Often involving impersonating an executive to trick someone into transferring funds or buying gift cards. This could have a high financial cost to the organization if it succeeds.

3. **Malware Delivery**

 Usually involving downloading an infected document, or app that can cause a high impact disruption, like what happened with the [WannaCry ransomware attack in 2017](https://www.malwarebytes.com/ransomware/)

These goals can help us categorize the preventive measures we can take: 

![phishing-separator-2](https://images.ctfassets.net/23aumh6u8s0i/7Iis51GXOCFk18pBQBYkAk/dd3f1697da3627feb86af6643a3afc4c/phishing-separator-2)

### Security Awareness 

Empowering users to detect and report phishing attacks helps protect the organization no matter the type of phishing. It also helps the security team react faster thanks to their reports. We’re providing [a free user awareness guide]( https://cdn.auth0.com/blog/phishing/user-awareness-guide.pdf) to help you raise awareness internally, and we’ve released some of our [internal phishing training in our YouTube channel](https://youtu.be/lyF8I-xzZ_k) voiced by someone you would not expect 😉

<iframe width="660" height="315" src="https://www.youtube.com/embed/lyF8I-xzZ_k" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

We wouldn’t recommend doing fake internal phishing campaigns using Coronavirus as bait since it can be too distressing in this situation, and it may hurt trust within your organization. We would recommend rolling out awareness material constantly, explaining what the communication style is in the organization, sending alerts, or sharing examples of real phishing emails transparently, not as a test campaign.

### [Multi-Factor Authentication](https://auth0.com/docs/mfa)(MFA)

MFA protects your employees from an account takeover in the event of credential theft. Implementing it and rolling it out is very easy with Auth0.

### Endpoint Protection

Antivirus solutions can protect your employees in the event of malware. There are plenty of options for the enterprise, so choosing one that fits your organization and culture will boost your defenses with minimal disruption.

### Verification Processes for Payments and Invoices

Establish an internal verification process that requires multiple people to approve a payment or expense before wiring the money, and define specific methods to do so (e.g., no gift cards)

On top of all of this, it’s key to have an easy way for your users to be able to report these attacks to your IT or Security team, such as a dedicated corporate email address, and that the team can [efficiently respond to these reports](https://auth0.com/blog/how-auth0-automates-phishing-response/).

**How can you stay updated on the latest COVID-related phishing trends?**

Here’s where you can more closely monitor the situation as it evolves:

* [FBI alerts](https://www.fbi.gov/coronavirus)
* [Cyber threat coalition](https://www.cyberthreatcoalition.org/): weekly advisory and town hall, IP blocklist, community
* [CISA (US)](https://www.us-cert.gov/ncas/alerts) and [NCSC (UK)](https://www.ncsc.gov.uk/) alerts

Phishing is an ever-evolving threat that’s constantly present for most companies across all industries, and for most end-users alike. Whether it’s a generic bait, or a message adapted to the circumstances of the moment, like COVID-19, tax filing season, or Black Friday, it’s almost guaranteed to be a threat to consider at all times for companies of any size. Rather than being overwhelmed by the challenge, training employees, creating and sharing clear processes, and enabling measures like enforced MFA can be the difference between a bad data breach and creating a resilient organization with the ability to adapt in an evolving threat landscape. 

<include src="asides/AboutAuth0" />

Phishing Goes Viral: COVID-19 Themes in Cybercrime

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Streaming companies must adapt to unprecedented network strain

Everyone is coping with the Coronavirus pandemic in their own ways, yet people around the world seem to share a few rituals: washing our hands, wearing masks, and of course, catching up on our Netflix queue. 

With much of the world’s population stuck at home under social distancing, quarantine, and mandatory lockdowns, consumer spending on streaming has increased [anywhere from 20% to 50%](https://www.nytimes.com/interactive/2020/04/11/business/economy/coronavirus-us-economy-spending.html) depending on the channel. Given this unprecedented surge in demand, it’s not hyperbolic to say the internet is going through the most intense stress test in its history.

The global desire for entertainment and escapism is [creating a windfall for streaming services](https://www.cnn.com/2020/03/02/investing/coronavirus-stay-at-home-stocks/index.html). Netflix, for example, [more than doubled](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown) its projected number of new subscribers since the pandemic began, and [Disney+ added](https://www.theguardian.com/media/2020/apr/09/disney-netflix-rival-doubles-subscriptions-in-virus-lockdown) 22 million subscribers as well. However, a combination of network slowdowns (and failures) and streaming models that don’t monetize increased traffic means that the situation for streaming media companies is more complicated than it first appears.

Media companies are facing new challenges and new opportunities and working to develop technological solutions that help them weather this historic moment.

## Quarantined Nations Increase Their Streaming Time

We can see the effects of COVID-19 on streaming services by watching how currently quarantined countries (those hits hardest by the virus) have been behaving. Even without a full-blown quarantine, the rise of voluntary social distancing and enforced isolation creates at least a comparable situation.

Though China [is showing signs of recovery](https://www.cnn.com/2020/03/19/asia/coronavirus-covid-19-update-china-intl-hnk/index.html), they implemented mass quarantine first and can give us useful data on streaming behavior. Chinese Nielsen [data shows a significant rise](https://mp.weixin.qq.com/s/vxKFJOFeXLWuasuvtu7kBw) in TV viewing, but people are also streaming less conventional content. Quarantined Chinese citizens are getting creative with streaming entertainment, [streaming concerts](https://www.nytimes.com/2020/03/04/arts/music/arts-coronavirus.html), and [setting up digital clubbing and digital gyms](https://www.bbc.com/news/world-asia-china-51628693) in their living rooms.

Italy, still in quarantine, has seen a similar rise in streaming content, with an average viewing-time increase of [11% nationally with highs of 17%](https://www.corriere.it/spettacoli/20_febbraio_29/effetto-coronavirus-volano-ascolti-telegiornali-talk-9399464c-5afe-11ea-8b1a-b76251361796.shtml?refresh_ce-cp) in the Lombardy region. During the nationwide quarantine, the Italian telecoms giant Telecom Italian SpA has reported an overall [70% increase in internet traffic](https://www.bloomberg.com/news/articles/2020-03-12/housebound-italian-kids-strain-network-with-fortnite-marathon) from work-from-home traffic and daytime online gaming.

**The spread of the novel coronavirus is also forcing studios and streaming services to rethink how they create and distribute content**, jumping release dates forward, skipping the box office, and closing down production. This will all lead to greater strain on streaming services and the larger internet.

The outbreak is closing theaters [across the United States and across the world](https://www.npr.org/2020/03/17/817136846/as-coronavirus-shuts-down-theaters-universal-shifts-some-films-to-on-demand), which has been linked to a [13% rise in streaming in the US that could rise up to 60%](https://time.com/5806060/coronavirus-movie-theaters-streaming/) based on prior crises. Production companies are fighting this by streaming [first-run movies straight to home services](https://www.vulture.com/2020/03/coronavirus-is-pushing-movies-online-faster-than-ever-before.html): Universal released _Emma_ and other new movies to streaming services, the new Pixar movie _Onward_ is going right to Disney+, and huge films like _Frozen 2_, _Birds of Prey_, and _The Invisible Man_ are coming much sooner than their prior release date.

While these first-run movies popping up on streaming services does create a large viewership base at home, it may not lead to the massive streaming profits being predicted.

<include src="TweetQuote" quoteText="Consumer spending on streaming media is up 20-50%. What streaming media companies can do to make sure they can withstand the quarantine-driven stress test."/>

## Streaming Services Are Doing Better Than Expected

It seems like a simple, logical equation: more time at home equals more streaming, which means greater profits for streaming services. But many streaming services, like Netflix, aren’t modeled to reap more profits from an increase in individual streaming time - which is why some were predicting that Netflix might not see a huge boost in profits.

 “If you have to decide between food and your Netflix subscription, it seems to me like you disconnect your Netflix. You’re probably not going to add another $13 a month if you don’t know when your next paycheck’s going to come in.” — Laura Martin, the senior entertainment analyst at Needham & Company, [told the Guardian](https://www.theguardian.com/film/2020/mar/12/coronavirus-binge-watching-netflix-streamers-viral).

**Netflix doesn’t monetize volume**. They make their money [from subscriptions](https://www.vox.com/2019/12/17/21025154/netflix-global-growth-numbers-sec-streaming-investors) ([and some product placement](https://www.cnbc.com/2017/07/27/bill-gates-ben-does-product-placement-in-netflix-and-amazon-shows.html)). The stock market reflects this uncertainty — Netflix has seen [less than a quarter of a percent of growth](https://www.cnbc.com/quotes/?symbol=NFLX) in the last month.

However, despite a [majority of consumers being aware of Netflix](https://morningconsult.com/2019/09/19/in-tvs-content-war-netflixs-shows-capture-biggest-share-of-viewer-awareness/) before lockdown and quarantine conditions, Netflix has seen a surprising surge in subscriptions. In fact, they’ve doubled their estimates: from an estimated 7 million new subscribers [to 15.77 million new subscribers](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown). 

This may be a temporary situation however: considering the shutdown of television and movie production across the board, time will tell if new subscribers will stick around for old content.

**A la carte streaming services like Amazon Prime may see a boost in revenue**. An Amazon Prime subscription [nets users a variety of shows and movies](https://www.businessinsider.com/amazon-prime-benefits-what-is-included) for “free,” like Netflix, but the newest releases must be rented or purchased.

Then again, despite the [rush of online ordering](https://blog.aboutamazon.com/company-news/amazons-actions-to-help-employees-communities-and-customers-affected-by-covid-19) and their strong grip on streaming media, [Amazon stock isn’t seeing much of a surge either](https://www.cnbc.com/quotes/?symbol=AMZN). Though the entire stock market has taken a hit, [early predictions that streaming company stock would be safe refuges](https://nypost.com/2020/02/28/how-coronavirus-benefits-netflix-and-other-in-home-services/) may have been premature.

Meanwhile, Twitch — the [most popular streaming service](https://www.nytimes.com/2019/12/15/business/tech-video-game-streaming-twitch.html) for gaming videos and livestreams — [has seen a 10% growth](https://www.theverge.com/2020/3/18/21185114/twitch-youtube-livestreaming-streamelements-coronavirus-quarantine-viewership-numbers) in viewership as of March 18. Unlike Netflix or Amazon Prime, Twitch monetizes through ads and will likely see a commensurate rise in revenue.

But differing monetization methods don’t tell the whole story. These potential revenue boosts or profit stagnation trends are dependent on network architecture surviving the sudden swell of usage, which may not be a guarantee.

## Strained Network Architecture Will Need Relief

Social distancing and quarantine [are closing schools](https://www.npr.org/sections/health-shots/2020/03/16/816428320/coronavirus-u-s-enters-quarantine-life-as-many-schools-and-businesses-close) and [workplaces](https://www.washingtonpost.com/national/coronavirus-outbreak-shutdown-america/2020/03/13/d8589434-6550-11ea-acca-80c22bbee96f_story.html), which means a glut of people at home streaming media for entertainment, work, and educational purposes placing unprecedented strain on the internet. Some websites are [even taking bets](https://www.sportsbettingdime.com/news/odds-global-netflix-outage-playstation-network-xbox-live-crash/) on which streaming or web service will go down next.

[Microsoft Teams crashed](https://www.independent.co.uk/life-style/gadgets-and-tech/news/microsoft-teams-service-status-crashes-outage-issues-today-work-home-down-a9404771.html) under the increased load of remote video conferences, and YouTube and Netflix have started [throttling quality on their videos](https://edition.cnn.com/2020/03/19/tech/netflix-internet-overload-eu/index.html) in order to reduce bandwidth in the face of the surge. Hulu [users reported a widespread outage](https://www.cnet.com/news/hulu-is-down-as-users-complain-of-videos-not-loading/) on March 20, one that seemed to affect multiple devices:

![hulu-activity-03-20-2020](https://images.ctfassets.net/23aumh6u8s0i/6Gp4ntk7M1cxNGwTHZxD3k/049ae9a357782e60896684ff437b7297/hulu-activity-march-20-2020)
[DownDetector.com](http://DownDetector.com) - Hulu - March 20, 2020

Many companies [suspended their data caps](https://www.cnet.com/news/carriers-are-suspending-internet-data-caps-during-coronavirus/) and [increased streaming limits](https://www.pcgamer.com/discord-ups-streaming-viewer-limit-while-coronavirus-keeps-people-at-home/) in order to help people stay entertained and in contact during isolation and quarantine. However, these acts of generosity may increase the amount of simultaneous traffic online.

Streaming services may need to try new network solutions to stay ahead of this bloom of potentially network-crashing traffic.

## Private Cloud Boosts Streaming Infrastructure

In the face of this inflating audience and inflating screen time, streaming services using a public cloud may want to consider other options to bolster their network architecture.

There’s nothing wrong with choosing a public cloud; it’s a perfectly reasonable option for a smaller streaming service. Larger streaming services, however, can increase their bandwidth and reduce their downtime and slowdowns with a private cloud solution.

A private cloud service like Auth0 offers scalability and can provide a [greater request-per-second](https://auth0.com/blog/how-finservs-can-reduce-risk-increase-innovation-with-private-cloud/) (rps) baseline — one that can add capacity as needed. It also has enhanced uptime over a public cloud, with a guaranteed 99.99% uptime.

<include src="TweetQuote" quoteText="How private cloud can help streaming companies withstand quarantine streaming pressures."/>

A private cloud doesn’t share resources or bandwidth with other companies, which is where a public cloud can sometimes struggle. Public cloud services like AWS do create server instances as needed, but they’re doing that for every business or individual using the service. COVID-19 isolation causes internet traffic to increase through every channel — streaming media, [communication](https://www.voicesage.com/blog/communication-best-practices-for-organisations-working-to-contain-covid-19/), [education](https://nypost.com/2020/03/17/coronavirus-in-ny-teachers-prepare-for-unprecedented-challenges-of-remote-learning/), and more — public cloud services are going to be hit from multiple angles at increasing speeds.

A private cloud can help streaming companies with servers dedicated to their businesses. Moreover, a private cloud can be managed or unmanaged, depending on whether you have the time and dedicated staff to maintain it.

## Getting Through This Together, Apart

The COVID-19 pandemic is a situation without precedent, creating entire nations of at-home workers, students, and entertainment-seekers all jumping on the internet at the same time. And with isolation and [lockdown orders](https://www.wsj.com/articles/china-reports-no-new-domestic-coronavirus-infections-for-the-first-time-since-outbreak-started-11584611233) coming [faster every day](https://www.washingtonpost.com/world/2020/03/20/coronavirus-latest-news/), this isn’t a situation [likely to change in the immediate future](https://www.washingtonpost.com/health/2020/03/16/social-distancing-coronavirus/).

Keeping streaming services going is a necessity for education, entertainment, and the economy. After a discussion with Netflix CEO Reed Hastings, the Internal Market Commissioner of Brussels, Thierry Breton, had this to say in [a statement to Politico](https://www.politico.eu/article/brussels-in-talks-with-netflix-about-reducing-internet-congestion/):

 “We all have a joint responsibility to take steps to ensure the smooth functioning of the internet during the battle against the virus propagation.”

With scalable network solutions such as a private cloud, we can deploy and use more servers to keep everyone entertained, educated, in shape, and in contact with one another until the situation is resolved. And, hopefully, we can all get back to business — and life — as usual.

<include src="asides/AboutAuth0" />

The (Surprisingly Complex) Impact of COVID-19 on Streaming Media

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

Insights from giving our business continuity plan a COVID-19-induced update

What are the critical things your company needs to keep its doors open? 

Many companies have a Business Continuity Plan (BCP) in place that covers loss of facilities during things like floods and earthquakes, but it's primarily the really big companies (or those who provide critical services for health care) who’ve done more than download a pandemic plan template off the internet and call it good.

[Only 62% of 500 U.S. companies surveyed](https://www.techrepublic.com/article/business-continuity-plans-and-tech-are-lacking-during-the-coronavirus-pandemic/) by SaaS-based accounts payable vendor _AvidXchange_ at the beginning of March had business continuity plans – nearly half of those said they covered contingencies for only two to three weeks – and 10% have no plan at all. At Auth0, we’ve had a BCP in place for years, but [COVID-19](https://auth0.com/blog/business-continuity-at-auth0-our-response-to-covid-19/) prompted an immediate review. The process proved both necessary and revealing. And because we believe it can help other companies, we’re sharing our approach here.

## Ask Yourselves How Do You ‘Degrade Gracefully’?

The first time I heard of a Pandemic Plan was during the [Bird Flu Outbreak](https://en.wikipedia.org/wiki/Avian_influenza) in 1997, while working for the main security company. A large pharmaceutical company was a major vendor, so they required a plan. Unlike our current situation with COVID-19, the plan remained largely theoretical. That’s not the case now. Even if you have a theoretical pandemic response plan, now is the time to make it real. What are you actually going to do?

In computer science, if hardware or a network has been partially destroyed or rendered inoperative, there’s a limited function necessary to keep it going. That process of how the machine or system shuts down is called “graceful degradation.” So, in a pandemic where your people could be out due to illness or permanently gone, you can apply the same question to your business: How do you degrade gracefully? 

This is not what anyone wants to think about. What if half my staff is sick or permanently gone? But it is much easier to think about it now than when you’re in the middle of it rather than when it’s too late to remediate. Think about it now and you will be doing your future self a big favor. Your future self will be so thankful that your past self documented all these things and you don’t have to think about it while you’re worried about your team. You can just follow the plan that you’ve made.

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/6eWOAZSW8CT2gSGUHYWjix/af815dc9c1ab6e6e4b4036099e423c9b/plan_sep1)

## How to Create a Pandemic Business Continuity Plan
You’re going to start by assessing the most critical functions that need to continue to happen for you to remain in business. Or the way I’ve been thinking about it: what is the absolutely last thing that gets shut off? Then you’re going to work backward. What are the things that are required to make sure that thing keeps working? What are the dependencies?

In our case, maintaining service for our existing customers is our most critical function. (Yes, it’s going to be important to add new customers, but if we’re just talking about the absolute most critical function, that’s it.)

In order to keep our service running for existing customers, we need to continue to pay AWS and the employees who are directly responsible for keeping it running. So for us, that would be the very last thing to go before the end of the world when we put all the chairs on the table, lock the doors, and head for the hills. 

If you’re a consulting company, you’d end up in a different critical place. You need to keep shipping deliverables to your clients. The ability to email or transfer files would be a critical function. The key is to go to the end of the world, find the most critical business process, and then work back. 

At Auth0, we worked ourselves backward to an absolute worst-case scenario where our staff numbers became more and more constrained, taking us from our global staff of 660 to just 10% remaining and created a plan where we could continue serving our customers. You should review your specific needs to understand your minimum number of employees for critical functions.

### Defining ‘Mission-Critical’ Functions
This process isn’t going to be easy for everyone, but it is an opportunity to think about the bigger picture. This is an opportunity to think about what’s best for the whole company and your customers. Try and set any ego aside. It’s not an insult if your department is not a business-critical function. Just because something isn’t “mission-critical” doesn’t mean it’s something the company will stop doing even in a pandemic. 

As CSO, I know that my team's ability to monitor and respond to security incidents is by definition a mission-critical role even in a pandemic. But, I also know that if we're really down to 10% of staff across the company, I'm going to take whatever resources I have to help keep our core service running for our customers. That's how the BCP helps me, my team, and my peers prioritize. In a sense, even as CSO, I know my place in this chain.

Since creating a BCP plan can bring a lot of different priorities and perspectives into conflict across the company, our entire executive leadership team worked closely to define a set of business-critical priorities for their teams to work from when fleshing out the remainder of the BCP update. 

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/N21EflGpHem6FVAnIRzNa/9596f571f0021f037ab387287aac831a/plan_sep2)

Because human beings have egos and there may be disagreement about what your most essential business processes are, this is an exercise that the most senior level of leadership should do and agree on. It should not be up to the C-level to put the plan together, but it is their responsibility to have a unified voice because these are business-critical functions. We broke our functions into four categories:

* **Mission-Critical:** Loss of these functions would result in wide-spread loss of reputation, damage to the business, as well as potential damage to the general public.
* **Business Essential:** Loss of these functions would make it difficult, but not impossible to continue the business. Things like generating revenue, customers, following compliance regulations, and maintaining our external help desk fall under this category for Auth0.
* **Business Core:** Loss of these functions would have an indirect revenue impact. In the COVID-era that includes not attending conferences, which impacts both leads and indirectly, customer satisfaction.
* **Business Supporting:** These functions impact employees, not employee productivity. Auth0 examples include employee reviews, our internal help desk, and business support functions.

As things fail, how do we work from the bottom of the list to protect our mission-critical functions? 

If half of your people could be out at any given time and only two people know how to do a given thing that’s critical, that’s not enough.

Here are three questions to ask:

* What are the tools necessary for each business function?
* Who are the people who know-how and are authorized to perform that function?
* Is the process documented with screengrabs so that a smart person could figure out how to make it happen?

### The Hard-Drive Tolerance Approach to Cross-Training
There isn’t great guidance on how many people are needed for cross-training. If all your finance people are in Seattle and everyone in Seattle gets sick, well, that’s not going to work. So I based our approach on hard drive tolerance.

For a hard drive to be considered fault-tolerant, typically the data is backed up in five copies in different places. That’s what we’re doing with people — five people who understand how to perform the process and have access to simple documentation but aren’t all in the same place. As a globally-distributed company, multiple locations are an easily achieved standard for us. If you’re not able to rely on geographic distance, you might want to cross-train additional staff.

![Pandemic Plan](https://images.ctfassets.net/23aumh6u8s0i/6pUwP72d4UnvgotPIDO5YP/954716e2549c226b4994e733066131fe/plan_sep3)

## Update 2x a Year, More in Crisis
We took five working days to review our plan and put this streamlined approach in place. Compared to other pandemic plans I’ve seen, ours is super-actionable — the kind of thing that leaders can actually lean on to help them make decisions.

Essentially it’s:

* A stack rank of priorities by team
* Documented instructions
* A Confluence page with who does what, down to five levels of people and their status
* And the instructions to print it out and store it

We are going to keep an eye on our plan and update it quite regularly through the evolution of this pandemic, likely on a monthly basis. Once we’re through the pandemic, we’ll dial that back to twice a year.

## Your Plan Will Make You Stronger
Your plan doesn’t have to take weeks. As I mentioned, we got our review done in five working days. Even if you’re starting with no plan at all, the effort is worth it for what you’ll gain. You’ll discover things you didn’t realize about your business like:

* Departments you didn’t realize were critical.
* Areas where you are under-staffed.
* Processes that need to be documented.
* People who need to be cross-trained.


Your teams will gain:

* A clearer understanding of how they function AND how they relate to the company’s overall mission.
* Likely every department will have an “aha” moment by going through this process.
* Clear direction on communication AND actions.
* Relief that they won’t have to make it up as they go along.

Like the 40 pounds of pasta I have in my garage, if this all blows over, it will get eaten, it’s not going to go to waste. And going through this process will make you a stronger team even when this situation disappears.

<include src="asides/AboutAuth0" />

How to Create an Actionable Pandemic Plan

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Deploy SSO and MFA to tackle the challenges being faced by millions of remote employees

<div class="alert alert-info alert-icon">
 
 Make remote work safer and easier today — <a href="https://auth0.com/pricing/">click here</a> to get started.</div>


As many organizations are discovering, remote working does not just mean providing employees with a laptop and expecting business to continue as usual. Instead, organizations are being confronted with new challenges - everything from Zoom etiquette (yes, your colleagues can tell you are reading Twitter) to their employees doubling as stand-in math teachers. 

An important challenge facing organizations now is authentication and authorization. Auth0 knows what it’s like to support a handful, all the way to hundreds, of remote workers. Having the capability and tools to verify that only the right employees are logging on is essential for improving everything from productivity to security. 

![Auth0 offers free workforce authentication](https://images.ctfassets.net/23aumh6u8s0i/1XCJWYdlEpVtx6HwzMCVtb/0374d37fe78ead6932a9d418aad0d3fa/value-transparency)

In addition to the recently announced [free tools for startups battling COVID-19](https://auth0.com/blog/auth0-startup-relief-helping-innovators-battle-covid-19/), Auth0 is doing more to help organizations reduce the stress of authentication and authorization of remote workers by offering internal employee authentication **free until August 31st** (up to 500 users).

As long as your admin email domain is the same as your employee domain, you can set up secure, remote logins for your employees and organization. We’ve got a simple and extensible ID Platform that can be adopted easily [in hours, not weeks](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider), making it suitable for _your_ workforce and _its_ requirements. As part of this free offer, businesses can take advantage of the following features:

* [Single Sign-On](https://auth0.com/single-sign-on) for ease and productivity
* [Multi-factor authentication](https://auth0.com/multifactor-authentication) for peace of mind
* [Connection to most identity providers](https://auth0.com/docs/connections/identity-providers-enterprise) for flexibility
 
 
<a href="https://auth0.com/pricing/">Find out more here about how to get started today</a>

<include src="asides/AboutAuth0" />

Auth0 Makes Workforce Authentication Free Through August 2020

We are offering free services to startups to help innovators tackle the challenges we are all facing

I know how difficult it is to start a business when the world is relatively calm, let alone the one we all find ourselves in now. Nothing is the same as it was. Between scrolling through rolling news channels and worrying about ourselves and loved ones, we are all looking for ways to help one another. For those companies trying to make progress during these times, I know how much harder it must be. 

We already offer a free tier of service to thousands of customers to help them innovate, but starting today, if you are a startup battling the impact of COVID-19 and meet our program criteria [1] , then you are eligible to get a **year of Auth0 Startup Relief for free**. From Single-Sign-On (SSO) to anomaly detection, we are making it easier to manage all of your users’ identities, however, they access your applications.

The “Auth0 Startup Relief” is designed for those who are doing any one of the following:

* Fighting the virus 
* Helping those who can’t work due to travel restrictions
* Enabling distance learning
* Helping small businesses who are struggling 

We want the best minds thinking about how to make things better, not worrying about authentication or authorization. And we are going to continue finding ways to make our technology available to those who need it most, as well as actively engaging with anyone who wants our help and advice during these times. [We also just announced free workforce authentication for businesses](https://auth0.com/blog/auth0-makes-workforce-authentication-free-through-august-2020/), through to August 31st, for up to 500 employees as well.

We at Auth0 hope this will further help these innovators fight COVID-19; we are rooting for you! 

## How It Works

1. Fill out your information [here](https://auth0.com/contact-us?utm_source=blog&utm_medium=oc&utm_campaign=businesspost&place=blog%20post&type=link&text=here) and don’t forget to include a mention in the message field that your startup is applying to the “Auth0 Startup Relief”
2. Our team will get back to you in less than 2 business days to confirm your eligibility and, assuming you meet the requirements, to help you start using Auth0 services for free for a year.

![Free Auth0 to help innovators fight COVID-19](https://images.ctfassets.net/23aumh6u8s0i/6n2zNChmRNytjOyp58cb0M/502f54c3101011828211819bcbda58d1/value-customer)

[1] In addition to meeting one of the Auth0 Startup Relief criteria, your company must meet these requirements as of the date of your application

* Less than $1M in Annual Recurring Revenue (ARR)
* Less than $2M in raised funding
* Less than 2 years old

<include src="asides/AboutAuth0" />

Auth0 Startup Relief: Helping Innovators Battle COVID-19


At Auth0, we care deeply about ensuring that our employees, customers, partners, and their families are safe. This does not change during times of uncertainty, it only becomes a stronger commitment. We also know that Auth0 provides critical functions for all of our global customers, and we hold our responsibility with the utmost business ethical importance.

In light of COVID-19, Auth0 is taking all necessary precautions to conduct and maintain business-as-usual during this tumultuous time. We are closely following guidelines set forth by national and local government agencies, and have internally put actions into place to ensure our employees limit their risk of exposure. 

Auth0 has maintained a Business Continuity Plan for many years that details steps for comprehensive action in the event of any emergency or crisis – including this pandemic. This plan is reviewed and updated regularly. This pre-planning enables us to be vigilant and focused no matter the circumstances, and provides concrete action to ensure the security of our business and customers. 

One of the biggest disruptions being felt at the moment across the world is the transition to remote working. Thankfully, Auth0 has been designed as a remote-centric company since our inception in 2013 (Matias Woloski and I were building the business while living 7,000 miles apart), and we have a robust and tested infrastructure in place to support a fully-remote workforce for all 650+ Auth0 employees, if need be. This ensures that every employee and team is able to operate at the same level of responsiveness and service that our customers are used to. 

Additionally, intentional cross-training of staff means that there will always be more than one person to handle key tasks or escalations without any disruption to our customers’ business. From an infrastructure perspective, all of our primary services are cloud-based and should not be impacted by COVID-19, ensuring that the same level of performance, innovation, customer support, and partnership will be maintained regardless of how long we are impacted by this virus.

Finally, we have prepared an [FAQ](https://info.auth0.com/coronavirus-customer-FAQ.html) that contains answers to a range of questions. If the answer to your question isn’t included, then please contact us directly at [bcp@auth0.com](mailto:bcp@auth0.com) and we will help find it. We are ready to tackle any challenge with our customers and will always put our extended team first. 

These are not easy times, but that’s why we prepare for them. We are deeply committed to taking care of our employees, customers, and partners, especially in times of uncertainty like these. 


"covid-19"