MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

Security leaders will increase visibility and diversity of thought to meet consumer (and business) expectations

From the Colonial Pipeline attack, which resulted in fuel shortages across much of the East Coast, to the devastating breach on Microsoft Exchange, it’s safe to say 2021 was a tumultuous year for cybersecurity. But what will the next year look like?

I reached out to Auth0’s leading security and privacy experts to hear their predictions for 2022, and to learn how organizations will grapple with a changing threat landscape and the ongoing pandemic.

![Predictions](https://images.ctfassets.net/23aumh6u8s0i/e8LLSbz9kUTIssTNzD33k/1c58e52ea17e0bf67b104322e8ade137/cybersecurity-prediction-sep1)

## 1. The Visibility Challenge

It’s been almost eighteen months since the Covid-19 pandemic forced us to rethink everyday life. The workplace was no exception. States ordered tens of millions to work from home, as they sought to limit the virus’ spread. To accommodate this flood of remote working, IT departments raced against the clock to build the necessary technology infrastructure.

Now, the dust has settled. The pressure has eased slightly. It’s time to take a breath. But don’t get too comfortable.

The next challenge for IT leaders — and CISOs in particular — is in securing the newly acquired devices and services underpinning remote working. Monitoring and threat detection will likely prove to be the biggest headache.

> “Visibility is fundamental to security,” explained Cassio Sampaio, Senior Vice President of Product at Auth0. “You can’t stop attacks you don’t see. It’s always better to see attacks in progress, rather than after they’ve occurred.”

Many workplaces deployed new hardware and software in record time to ensure the continuity of the business, leaving little time to integrate them into existing security workflows. Sampaio says the big priority for 2022 will be to bring this infrastructure into view.

> “With teams working remotely for the foreseeable future, now’s the time for IT teams to start focusing on security, with monitoring and threat detection both high priorities,” Sampaio added. “Hybrid working, as well as the growth of BYOD and cloud computing, has shifted the definition of a security perimeter. It now includes identity systems, as well as firewalls and IPS tools. It’s critical organizations extend their visibility to include these.”

## 2. Secure by Default Becomes the Norm

Security breaches can occur because of simple user errors. In some cases, vendors inadvertently facilitate that by issuing products with insecure default configurations, putting the onus on the customer to harden them.

> “Far too often, security is treated as the user’s responsibility. This approach has arguably contributed to several high-profile incidents,” said Shiven Ramji, Chief Product Officer at Auth0.

In August, researchers at Upguard learned some apps running on a popular infrastructure provider were leaking sensitive customer and business data totaling 39m records. This included Covid-19 contact tracing details, payroll records, and biographical customer data.

UpGuard attributed the issue to a default configuration that allowed unauthorized third parties to remotely query the underlying data source. But instead of considering it a bug, the provider described the issue as a well-documented feature.

In the face of massive data breaches and other unwelcome security lapses, we expect vendors will take a more proactive approach in creating guardrails for their customers. A Secure by Design approach will become the default. This philosophy sees products shipped with the most cautious settings by default, accompanied by other vital protective features, including Multi-Factor Authentication (MFA) and Privileged Access Management (PAM)

## 3. Malicious Actors Will Exploit Supply Chain Woes

Global supply chains are in disarray. The cost of shipping products between continents spiked during the pandemic, with ships and containers both in short supply. Meanwhile, soaring demand for semiconductors has resulted in widespread shortages of graphics cards, games consoles, and cars, with the “chip drought” expected to last until 2023.

Amid this turmoil, we can expect to see malicious actors take advantage of the situation, exploiting the widespread sense of desperation among businesses and consumers. There is evidence this has already started to occur, with the FBI reporting an increase in Business Email Compromise (BEC) attacks at the start of the year.

> “If you’re a school awaiting a shipment of Chromebooks for remote learning, or a retailer expecting stock from overseas, you might not question an unexpected invoice, especially if it comes from someone you know. The urgency may override your skepticism,” said Annybell Villaroel, Security Awareness and Culture Manager at Auth0.

## 4. Diversity of Thought and Skill Becomes Regarded as an Asset

The security landscape continuously evolves. In the past decade alone, we’ve witnessed the emergence of malware-as-a-service (MaaS), threat actors expanding by franchising their brand and technology to others, and attacks upon national infrastructure. Deepfake technology and bulk SMS messaging have been used to devastating effect. 

IT teams now face increasingly sophisticated opponents, with attacks delivered in greater volume over a variety of mediums. Combatting this will require organizations to draw from a wider range of skills when filling cybersecurity roles.

> “Bad actors have already diversified their thinking. Businesses must do the same,” said Jameeka Aaron, CISO at Auth0. 
> “I’ve always argued for a holistic approach to information security,” she added. “Technical skills are important, but so are the soft skills.”

To find candidates with these skills, organizations will have to broaden their hiring criteria and recruit from places they didn’t previously.

> “To respond to this new threat landscape, businesses will have to shift their focus away from GPAs and certifications. You need people who can build bridges within the organization and evangelize good security practices. And going forward, I can imagine hiring managers will recognize communication and language skills as assets, too,” said Aaron.

## 5. Consumer patience wanes over privacy breaches

Five years ago, Have I Been Pwned — a service that allows members of the public to check whether their personal credentials have been leaked — held records on 1.4 billion accounts. Today, that figure is almost 11.5 billion.

Coinciding with that almost tenfold rise is a greater awareness of security breaches among the general public, and signs their patience has begun to wane. According to Auth0’s latest CIAM survey, 92% of consumers expect businesses to keep their personal information safe.

> “A decade ago, security breaches were smaller and less likely to be headline news,” said Sampaio. “Now, they’re front-page news, and they’ve ensnared some of the largest brands in the world. People are tired and scared, and they want businesses to raise their game.”

Perhaps surprisingly, the survey showed that a larger percentage of businesses, 97%, believe they are obligated to protect their customers’ personal information.

> “This figure likely has its roots in many places. Security breaches are bad PR and are hugely costly for the company involved,” said Sampaio.
> “Recent legislation, most notably GDPR, LGPD, and APPI, introduces significant monetary penalties for organizations that experience a security breach. That raises the pressure further.”

## 6. Consumers Begin Expecting Data Portability & Interoperability

From healthcare and financial services to social networks, consumers increasingly recognize the value of data interoperability and portability. It allows you to seamlessly share medical records between practitioners, to see your banking and credit card information from a single central hub, and port your playlist between streaming services.

> “One of the most popular apps in the App Store is Mint, which lets users track spending across their accounts. In the US, FHIR (Fast Healthcare Interoperability Resources) is making it easier for doctors to see the information held on their patients by other medical professionals. From a consumer’s perspective, interoperability is something that makes their lives easier, and data portability allows them to make real choices about who they do business with,” said Lucy McGrath, VP of Privacy at Auth0.

![Interoperability](https://images.ctfassets.net/23aumh6u8s0i/11v4gylcGVWijlKWnhibFw/f7e091c1883197d00af99737574c649d/cybersecurity-prediction-sep2)

Data portability is already a consumer right in Europe thanks in part to GDPR and a number of global sectoral laws - particularly in finance and banking. McGrath expects demand for both portability and interoperability to increase in 2021 and beyond. The OECD has outlined the detailed benefits and challenges in its report _Data portability, interoperability and digital platform competition, OECD Competition Committee Discussion Paper,_ [here](https://www.oecd.org/daf/competition/data-portability-interoperability-and-digital-platform-competition-2021.pdf).

> “It’s likely that we’ll see consumers’ expectation for choice - data portability and interoperability - enshrined in more global laws. It’s an exciting space that is spurring innovation - it’s essential the technology supporting the choice continues to protect the privacy of consumers and security of their data in these complex ecosystems” McGrath said.

Top 6 Cybersecurity Predictions for 2022

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Former DEI and employee engagement lead at Nike and Target to guide company’s DEI efforts

**BELLEVUE, Wash. – May 24, 2021 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Natalie Hausia-Haugen](https://www.linkedin.com/in/natalie-hausia-haugen-she-her-3869a4114/) has joined the company as Head of Diversity, Equity, and Inclusion (DEI). Hausia-Haugen brings more than 15 years of industry experience and will be responsible for accelerating Auth0’s DEI vision, policies and processes, and further developing Auth0’s culture of inclusion and belonging.

Prior to joining Auth0, Hausia-Haugen worked at Nike, where she held senior employee engagement, diversity and inclusion, and people-related roles. She was a leader on Nike’s diversity and inclusion employee council and the co-chair of Nike’s employee resources group for teammates of color with roots in Asia, the Middle East, and the Pacific Islands. Before Nike, Natalie worked for Target, Inc. leading both local and national diversity and inclusion strategies. 

“Since Auth0’s inception, we have aimed to create a safe workplace and culture where every person can show up as their authentic self, speak their truth, learn, develop, and grow—at a global scale—and Natalie will play a key role in strengthening our efforts,” said Carolyn Moore, SVP of People at Auth0. “DEI is a top priority for Auth0, and we are honored to have Natalie join our team in this newly-created role to help us continue to make a meaningful difference.”

Auth0’s DEI initiatives are shaped by the belief that there is value and power in hiring and nurturing teams of people from diverse backgrounds, beliefs, and human experiences. Auth0, [recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), was recognized by Forbes as one of [America’s Best Startup Employers 2021 List](https://www.forbes.com/americas-best-startup-employers/#3ea4dc906527) (ranked #11 out of 500) and by Fortune as one of the [30 Best Small and Medium Workplaces in Technology](https://fortune.com/best-small-workplaces-technology/2021/auth0/) (ranked #7 out of 30), as well as by [Best Companies](https://www.b.co.uk/), and [Great Place to Work](https://www.greatplacetowork.com/certified-company/7018610) for its company culture, leadership, and commitment to its people.

“Auth0’s belief in and commitment to the importance of diversity, equity, and inclusion is truly remarkable and has been core to the company since day one—the team deeply cares and strives to create new standards, strengthen existing practices, and embolden others,” said Hausia-Haugen. “I’m proud to join a team that is dedicated to its talented people and culture and passionate about fostering a space where courage, real freedom, and our shared humanity meet.” 

To learn more about Hausia-Haugen and Auth0’s DEI efforts, visit [Auth0’s blog](https://auth0.com/blog/auth0-welcomes-natalie-hausia-haugen-to-the-team).

## About Auth0

The Auth0 Identity Platform, a product unit within Okta, takes a modern approach to identity and enables organizations to provide secure access to any application, for any user. Auth0 is a highly customizable platform that is as simple as development teams want, and as flexible as they need. Safeguarding billions of login transactions each month, Auth0 delivers convenience, privacy, and security so customers can focus on innovation. For more information, visit [https://auth0.com](https://auth0.com).

### Media Contacts
Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Natalie Hausia-Haugen Joins Auth0 as First Head of Diversity, Equity, and Inclusion

carolyn-moore

Carolyn Moore is the Senior Vice President of People, responsible for all people and human resources (HR) teams including global recruiting, HR operations, HR business partnership, employee experience, culture, and internal communications. Carolyn has spent the last three decades in global human resources roles helping fast growing startups, medium-sized companies, and Fortune 500 organizations—including Mercedes-Benz, Apple, Samsung, mSpot, and R2 Technology—form effective people strategies and build great cultures. Carolyn lives in Redwood City, CA and enjoys international travel and cooking, and is currently studying wine with the goal of passing the sommelier exam.

Senior Vice President of People

Carolyn Moore

Auth0’s SVP of People sits down with the team’s First Head of Diversity, Equity, and Inclusion for a Q&A.

_We believe that there is value and power in hiring and nurturing teams of people from diverse backgrounds, beliefs, and human experiences._

Since Auth0’s inception, we have aimed to create a safe workplace and culture where every person can show up as their authentic self, speak their truth, learn, develop, and grow—at a global scale. And today, we are honored to welcome [Natalie Hausia-Haugen](https://auth0.com/blog/natalie-hausia-haugen-joins-auth0-as-first-head-of-dei), Auth0’s first Head of Diversity, Equity, and Inclusion (DEI), who will be integral in further developing Auth0’s culture of inclusion and belonging.

**Welcome to Auth0, Natalie! We are so excited to have you.**

![DEI](https://images.ctfassets.net/23aumh6u8s0i/5NGrCGgHuJ1Z55IzVzVv07/56120695792fc3c55b27fb4cb0253985/Natalie_HH_Appointment_3X_Separator_01.jpg)

### What led you to a career in DEI?

I have always been inspired by people and have spent most of my career focused on the employee experience. And as the daughter of an immigrant and interracial marriage who was raised in the U.S. military and a woman of color who is “ambiguously ethnic” (i.e., wherever I am in the world, I get some of the blessings and challenges of whatever box people put me in), diversity and inclusion has just always been part of being in this world. 

Over the past 20 plus years, the success I have had in every role has been rooted in helping others thrive, especially the underrepresented and the misunderstood. The goal of DEI is to help people thrive and teaching them to help each other thrive. This goal, combined with my personal background, are why I have always been drawn to DEI leadership roles. 

Aside from this pull, there are three specific things I love most about this work:

1. **The tie to our shared humanity:** you must help people better understand themselves just as much as you help them understand others. 
2. **The ability to practice systems thinking:** doing this work well also requires you to assess, develop, and improve the systems that impact a person’s ability to thrive.
3. **Being at the frontlines:** this work often puts you on the frontlines of uncharted territory where there is no room for B.S. There is no place I would rather work than on the frontlines of DEI with people who are ready for the truth and to do the hard things.

### In your opinion, where do you see the biggest challenges and opportunities as it relates to DEI within the industry? How and where can companies start?

In general, most of us know at our core that DEI is important and leads to many internal and external benefits, but we have had to feel out how we explain it, how we do it, how we make and measure progress. Businesses that are ahead of the curve have prioritized a culture of DEI and set it as an actual business goal. 

And for me, it is essential to carve out dedicated teams or roles (that most likely didn’t exist) to provide guidance on DEI in company policies and talent programs. For example, you probably will need to make some fundamental shifts in how you hire, coach, assess, promote—changes to actual programs and processes themselves.

In my opinion, the biggest challenges that exist within the industry are:

1. **Formalizing DEI efforts:** formal DEI efforts are relatively new in the business world, which means we still have a lot to learn, teach, try, and let take root before systemic change can happen. The biggest risk I have seen from this is folks can get discouraged and give up when results are not good the first time or fast enough. Consistency and accountability are key in this work.
2. **Speed:** the speed and pace of startups in tech. Urgency is often the enemy of inclusion. When it feels like there is never enough time and we are moving quickly (especially in tech), it is normal to want the fastest option, even if it means compromising in other ways. How do we get sharp on what we are not willing to compromise short-term because we understand the long-term gain? And streamline and improve processes to decrease that short-term loss? 
3. **DEI is not ‘one size fits all’ or ‘one and done’:** DEI initiatives must be rooted in core values while also free to shift, shed and improve as your company learns and grows. Companies should approach DEI as they do consumer or industry trends, constantly learning how to be more relevant and effective. Not only should DEI programs change over time, but by region as well. As a global company, Auth0 is fortunate to have international elements of DEI. Yes, this makes it more challenging, but it also makes us better, no matter what country we sit in. 

### Why Auth0 and why now?

A more just, equitable, and inclusive world is something a growing majority of the world wants, no matter where you live or what industry you are in. Employees and consumers are no longer satisfied with companies to simply do no harm. Now, we are expecting companies to do good and be involved in the change. 

I believe this makes things prime for the tech industry and Auth0 to step up and make bold moves. Tech, given its distinct cultural traits and integration across everyday life, can push the business world forward. And we at Auth0, given our deep values, experience as leaders, and strong culture, can push the tech industry forward.

My vision is for Auth0 to be DEI pioneers for the tech industry by modeling what it means to embed DEI into our business, talent, and social practices and become more successful because of it. I am grateful I get to do DEI as a job because companies like Auth0 know it is more than a good thing to do—it is necessary for staying relevant, competitive, and ahead in your industry.

What is your advice for organizations that have not prioritized DEI? How can they get started?

* Start now. It is never too late to get started. 
* Be honest about if and how DEI goals can tie to your mission and values. If they are, make that clear to your entire team and measure accordingly. If DEI goals cannot tie to your mission and values, this is a great wake-up call to dig in. Quantify the ways a lack of DEI progress is going to hinder your relevancy, market share, and performance. If you are not ready to focus on DEI, at least you will have visibility to what it costs you.
* Make sure DEI does not feel like an HR-thing. It should feel like an all-of-us thing, led by business leaders who see its value in their business results. 
* Focus on the cultural ingredients that enable inclusivity, like healthy debate, two-way communication, and trust.
* Listen to your employees. Their insights and feedback will clarify opportunities and should guide your priorities. 
* Agree to stop promoting or celebrating people who do not model your DEI goals. This is one of the biggest ways companies lose credibility with their employees.

### How do you encourage a workplace where employees can show up as their authentic self, speak their truth, learn, develop, and grow, especially in a remote environment?

First, you have to define what it means to be inclusive and consistently demonstrate that being anything less than inclusive is not acceptable Period.

You must also acknowledge there are employees who do not feel safe showing up this way, and for a good reason. And this truth must be understood, the experiences of these employees validated by **all** leaders. 

Prioritize building a culture of psychological safety and mutual respect for every single person. Employees must believe (one) they will actually be seen and heard, and (two) they will not be punished for sharing something different or even incorrect. 

Create a habit of asking: “Whose voice have we not heard?” and, “Who is missing from the table?” 

I am a big fan of “When you know better, do better.” Within this is grace and understanding that people need to learn and relearn some things. As impatient as many of us are for change, we will all benefit from helping each other feel safe, saying: “I was wrong. I’m sorry.” “I didn’t get it.” “I’ve changed my mind.” “Now that I know better, I’ll do better.” 

Regarding the remote environment, my biggest callouts are to:

* Recognize that it is a different way of working and requires us to deliberately consider if and how we need to adjust to ensure greater inclusivity. Ask the questions.
* Mind the Zoom-factor. Zoom can make it easier for the loudest voices to dominate because the audio will try to hone in on one voice at a time. Zoom can also make it easier for folks to participate because of functionalities like chat and raising a hand to signal a question or point.
* Always consider time zones. Your time zone is not the default.
* Be very deliberate about when/if you use side chat with a select group of people to continue the conversation after the meeting. 

![DEI](https://images.ctfassets.net/23aumh6u8s0i/3OA30zqYmX8fTVmwox9Gj/6258f703663612d9ee05d7d8aacf0d53/Natalie_HH_Appointment_3X_Separator_02.jpg)

To learn more about Auth0’s DEI initiatives and opportunities to join our growing team, visit the [Auth0 careers page](https://auth0.com/careers).

Auth0 Welcomes Natalie Hausia-Haugen to the Team

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

A look at why shaming proved to be a productive strategy

Sometimes shaming works.

[Nearly two years ago](https://www.linkedin.com/pulse/thoughts-rsa-international-womens-day-joan-d-pepin/), I called out the RSA Conference for the lack of keynote speaker diversity at the largest and arguably the most influential Information Security conference in the world, specifically citing their lack of women speakers. In 2018, women made up only 11% of the cybersecurity workforce, but since then that’s improved. According to the (ISC)[^2]’s latest study, pay disparity remains, but women now make up roughly 24% of the cybersecurity workforce.

I wasn’t the only one shaming RSA. 

[Mashable](https://mashable.com/2018/04/18/rsa-conference-tech-diversity/) noted that while Cisco Chief Security and Trust Officer John Stewart was on the RSA 2018 keynote stage saying that diversity in tech is "not about this politically correct thing” 19 of the 20 keynote speakers were men.

After a fair a lot of press and social media response, RSA announced a [Diversity Initiative](https://www.businesswire.com/news/home/20181113005339/en/RSA%C2%AE-Conference-Unveils-New-Diversity-Inclusion-Initiative) that included expanding its advisory board, greater outreach during the call for speakers, and the elimination of all-male panels in the keynotes stages.

<include src="TweetQuote" quoteText="Two years ago @mashable dinged the @RSAConference for lack of keynote speaker diversity. And they changed. Why shaming sometimes works."/>

Since then RSA has vastly improved its keynote ratio. By current count, [17 of their 42 keynote speakers](https://www.rsaconference.com/usa/keynote-speakers/keynotes) for the 2020 conference are women. Still less than half, but an improvement. 

Let’s unpack what had to happen to make that change because it’s not just RSA who holds full responsibility for the level of diversity at their conference.

## Diversity Action Shouldn’t Take Forever

Back in 2015, [RSA banned “booth babes,](https://www.infosecurity-magazine.com/news/rsa-bans-booth-babes/#ftag=YHF87e0214)” publishing a dress code that required booth attendees to wear “business or business casual attire.” While making a gesture in the right direction, the same year, they were still presenting talks [dominated by white males](https://finance.yahoo.com/news/lack-diversity-2015-rsa-security-185602235.html). It took a lot of shaming for things to change. Meanwhile, the research continued to roll in.

<iframe width="560" height="315" src="https://www.youtube.com/embed/e2UIeHW1D-M" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

Countless studies have proven the benefits of diverse teams and leadership, including this recent one from [BCG](https://www.bcg.com/en-us/publications/2018/how-diverse-leadership-teams-boost-innovation.aspx) which found that companies with above-average diverse leadership also brought in a 19% increase in innovation revenue. Real diversity results in diverse thinking, which benefits the bottom line.

## What It Takes to Drive Change

The visibility of these studies may be part of what drove sponsors like Microsoft to send a woman to RSA this year. Or it may be that more women have risen to powerful roles. Or that the shame of negative press just wasn’t worth it. 

But since RSA changed its rules and specifically said that they support diversity, the change is there. That means sponsors were required to meet those standards.

<include src="TweetQuote" quoteText="@CloudCISO_Joan on why speaking opportunities are an easy area to do good. And why @ @RSAConference improved their keynote speaker diversity ratio."/>

Ideally, the male chief architect or senior VP took action as an ally, turning down the opportunity for the exposure they don’t truly need and took the opportunity to say “Hey, no. There is this woman in my team who would be perfect.” 

Companies have a monetary motivator to make changes in-house. But there’s also pragmatic and moral responsibility (which circles back to why shaming works): We need a diverse set of people and perspectives (skills) and since tech is one of the Gold Rushes of our time. We should endeavor to make sure that opportunity is distributed fairly. This is one of those moments where we can do a lot of good easily.

"Diversity"