001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

How to set up non-interactive apps using the client credentials grant and Auth0 to perform IoT device, CLI tool, and more machine to machine API authorization.



Many times, a secure, authorized communication channel between different parts of an autonomous system is required. Think of two backend services from different companies communicating through the internet. For these cases, OAuth 2.0 provides the [client credentials grant](https://tools.ietf.org/html/rfc6749#section-4.4) flow. In this post, we will take a look at how the client credentials grant from [OAuth 2.0](https://tools.ietf.org/html/rfc6749) can be used with Auth0 for [machine to machine (M2M) communications](https://auth0.com/machine-to-machine).

<include src="TweetQuote" quoteText="Learn to use machine to machine authorization with Auth0!"/>

[Get the code](https://github.com/auth0-samples/auth0-api-auth-samples) for the sample in this post.

---

<AmpContent>
<amp-youtube
    data-videoid="9ivMf15wl1A"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/9ivMf15wl1A' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

## Machine to Machine Communications
There are many parts of a system where machine to machine communications make sense: service to service, daemon to backend, CLI client to internal service, [IoT](https://auth0.com/blog/javascript-for-microcontrollers-and-iot-part-1/) tools. The key aspect of these communications lies on the fact that the element to establish trust in the system is the _client_. What does this mean? In contrast to usual systems where an authorization process attempts to establish trust by authorizing _a user_, in this case what must be authorized and trusted is the client. In other words, there is no need for a user to interact with the system to authenticate, rather the system must authenticate and authorize the _client_. To be clear, in this case, the client is simply an application, process or even an autonomous system. For these scenarios, typical authentication schemes like username + password, social logins, etc. don't make sense.

The [client credentials grant] from OAuth 2.0 attempts to fulfill the need for these scenarios. In the client credentials grant, the client holds two pieces of information: the client ID and the client secret. With this information, the client can request an access token for a protected resource.

![Client Credentials Grant](https://images.ctfassets.net/23aumh6u8s0i/3bJ99s5VK6bB85bS9eiBOf/26c0da9d6918894b66e44a87c9b5edf2/client-credentials-grant)

1. The client makes a request to the authorization server sending the `client ID`, the `client secret`, along with the `audience` and other claims claims.
2. The authorization server validates the request, and, if successful, sends a response with an access token.
3. The client can now use the access token to request the protected resource from the resource server.

Since the client must always hold the client secret, this grant is only meant to be used in _trusted_ clients. In other words, clients that hold the _client secret_ must always be used in places where there is no risk of that secret being misused. For example, while it may be a good idea to use the client credentials grant in an internal daemon that sends reports across the web to a different part of your system, it cannot be used for a public tool that any external user can download from GitHub.

## Client Credentials Grant
The client credentials grant is very simple to use. The following are the relevant HTTP requests:

```
POST https://<YOUR_AUTH0_DOMAIN>/oauth/token
Content-Type: application/json
{
  "audience": "<API_IDENTIFIER>",
  "grant_type": "client_credentials",
  "client_id": "<YOUR_CLIENT_ID>",
  "client_secret": "<YOUR_CLIENT_SECRET>"
}
```

A successful authorization request results in a response like the following:

```
HTTP/1.1 200 OK
Content-Type: application/json
{
  "access_token": "eyJz93a...k4laUWw",
  "token_type": "Bearer",
  "expires_in": 86400
}
```

In Auth0, to use the client credentials grant, you can [create a new "machine to machine" application from the dashboard:](https://auth0.com/docs/applications/machine-to-machine)

![Machine to Machine in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/77BJOc4RrLIp07FLtdX5SV/491323d54c787864e5ce322c225bd6b8/2-create)

A machine to machine application requires the selection of at least one API. This is the API that gets selected through the `audience` claim in the HTTP request above.

![Select API in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4TEwKo6fti1umT59Ui5fHp/c4da3c10ee49b6c2784e731b9d25ea91/3-select-api)

You can create audiences for your APIs and protected resources in the [API](https://manage.auth0.com/#/apis) section of the Auth0 Dashboard. You can enable or disable these APIs in the `APIs` tab of your application.

### Granular Permissions in Auth0
Thanks to the use of [Hooks in Auth0](https://auth0.com/docs/hooks), it is very easy to have granular permissions for [machine to machine communications](https://auth0.com/machine-to-machine). Using Node.js code, you are able to customize the actions of Auth0 and extend the functionality of the Auth0 base platform.

<include src="TweetQuote" quoteText="With Auth0 Hooks, you can have powerful granular permissions even for machine to machine authorization!"/>

The Auth0 utility (auth0) is part of `wt-cli`. More information on `wt-cli` can be [found here](https://webtask.io/docs/wt-cli) and configuring the wt-cli for use can be [found here](https://manage.auth0.com/#/tenant/webtasks).

If you wanted to create a Hook, this is how the CLI process would go:

Scaffold the sample code from Auth0:

```bash
auth0 scaffold -t pre-user-registration > file.js
```

Then create the Hook:

```bash
auth0 create -t pre-user-registration --name my-extension-1 -p auth0-default file.js
```

Along with this process, the [Auth0 Management Dashboard](https://auth0.com/docs/hooks/dashboard) also provides an interface for managing your Hooks. This dashboard can do any of the CLI functions except for the "Identify and get log data from a Hook".

If you don't need the flexibility of Hooks, you can still achieve a level of granularity with scopes. These can be enabled on a per API and per application/client basis.

## Common Use Cases for M2M Communications
In this section, we will take a look at common scenarios where M2M communications might make sense.

### Backend-to-Backend (Services/Daemons)
This is one of the most common scenarios. Let's say you have different internal services that produce data in the form of logs. You are storing those logs locally in your own data warehouse. However, as part of your policies, you also want those logs to be stored offsite in a cold storage solution. You send those logs over the internet to the cold storage service in a different cloud provider. To authorize log storage from different services in your network, you use the client credentials grant, giving each client a client ID and a client secret.

![Machine to Machine Logging](https://images.ctfassets.net/23aumh6u8s0i/yAy6yj6lBIkpSajKLnNdM/3d9c1f1aeffc1c33e20a5a982dc43e7d/3-backend-to-backend)

What about other common services like job schedulers, daemons, continuous processes? These are also great scenarios where machine to machine authorization makes sense. Say you have a job scheduler that lives in your network but on a different cloud provider that offers a great deal for GPU processing. You only want your authorized clients to make use of the service. For this reason, you use the client credentials grant and only authorize those client IDs that you want to allow.

### Internet of Things Devices
The rise of [Internet of Things devices](https://auth0.com/blog/javascript-for-microcontrollers-and-iot-part-1/) makes a great case for machine to machine solutions. Many (if not most) of IoT devices are small, autonomous, specialized devices that collect and send data to a server. Let's say you have a fleet of small IoT devices that you use to collect data on the number of cars that are parked in your parking lot. You have many devices that are continuously reporting data to a central server. These devices communicate over WiFi. To avoid intrusions, and even though your WiFi network is password protected, you use the client credentials grant, giving each IoT device its own client ID and client secret. These devices are trusted: you set them up and no-one else can interact with them.

### CLI clients
When systems become big, automation starts to make more and more sense. Many tasks that are repetitive, but that still require an administrator to supervise them, start to become scripts. These scripts are run when administrators need to run them. Since these scripts interact with sensitive parts of a company's architecture, they usually have some sort of protection. In these cases, administrators may choose to create CLI apps that have the necessary rights to perform the actions, but that are only available in certain computers, like their own, or in mainframes. In these cases, the client credentials grant also makes sense. These CLI apps are trusted, but they also need access to sensitive parts of a system. Protecting access to sensitive parts of the system by requiring the client ID and client secret can be a solution.

## Code Example: Gift Deliveries App
If you are interested in seeing code that can apply to a real-world scenario, we have a sample app just for that purpose. The [Gift Deliveries app](https://github.com/auth0-samples/auth0-api-auth-samples/tree/master/machine-to-machine) shows how two backend services from the same company can interact securely with the use of the client credentials grant.

In this app, one service, the [World Mappers API](https://github.com/auth0-samples/auth0-api-auth-samples/tree/master/machine-to-machine/worldmappers-api-nodejs) exposes an API that can be used to find coordinates, addresses, and directions; while another service, the [Gift Deliveries Service](https://github.com/auth0-samples/auth0-api-auth-samples/tree/master/machine-to-machine/giftdeliveries-nodejs), uses the `World Mappers API` to get directions from one point to the destination address (to send a gift).

![Gift Deliveries App](https://images.ctfassets.net/23aumh6u8s0i/3cGGMA4TtCldPmX8vPe2j9/96f1aedf84c2eab44a86b783d5e74823/4-gift-deliveries-app)

Both of these services run in the internal network of an online shop, therefore, the `Gift Deliveries` client is a trusted client, which allows it to use the client credentials grant.

If you take a look at the `giftdeliveries-nodejs/index.js` file you will see the code that gets an access token using the client credentials grant:

```javascript
var getAccessToken = function(callback) {
  if (!env('AUTH0_DOMAIN')) {
    callback(new Error('The AUTH0_DOMAIN is required in order to get an access token (verify your configuration).'));
  }

  logger.debug('Fetching access token from https://' + env('AUTH0_DOMAIN') + '/oauth/token');

  var options = {
    method: 'POST',
    url: 'https://' + env('AUTH0_DOMAIN') + '/oauth/token',
    headers: {
      'cache-control': 'no-cache',
      'content-type': 'application/json'
    },
    body: {
      audience: env('RESOURCE_SERVER'),
      grant_type: 'client_credentials',
      client_id: env('AUTH0_CLIENT_ID'),
      client_secret: env('AUTH0_CLIENT_SECRET')
    },
    json: true
  };

  request(options, function(err, res, body) {
    if (err || res.statusCode < 200 || res.statusCode >= 300) {
      return callback(res && res.body || err);
    }

    callback(null, body.access_token);
  });
}
```

If you want to run this app, <a href="https://a0.to/blog_signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a>, clone the [repository](https://github.com/auth0-samples/auth0-api-auth-samples) and follow the [README](https://github.com/auth0-samples/auth0-api-auth-samples/blob/master/machine-to-machine/README.md).

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## Conclusion

[Machine to machine communications](https://auth0.com/machine-to-machine) are part of almost any modern architecture. OAuth 2.0 and Auth0 provide the necessary building blocks to make its use in your architectures a breeze. From backend-to-backend, services, daemons, IoT devices, and even CLI tools, the client credentials grant remains a simple yet useful approach to the problem of authorization between autonomous and semi-autonomous system. This grant, augmented with the power of hooks, can cover all common use cases while remaining flexible for more granular security needs in the future. If you are using, or interested in using, machine to machine communications in your products, leave us a comment below. If you are unsure how any of this can apply to your architecture, [hit the "talk to sales" button in our homepage](https://auth0.com/), we can help you out!


Using Machine to Machine (M2M) Authorization

liz-rivera

At Auth0 I'm responsible for clearly and concisely communicating the value of our CIAM platform. What a great role to be in as digital technologies and applications increasingly become ingrained in our everyday lives. I also oversee the Healthcare vertical, which I'm super passionate about, as digital advances are already recreating the way we receive care.

Senior Product Marketing Manager, CIAM

Liz Rivera

SMART on FHIR is poised to transform data interoperability — here's how it will improve healthcare.

Most health systems know that seamless omnichannel customer engagement (a “digital front door”) is essential in order to deliver the personalized, value-based [healthcare today’s consumers expect](https://www2.deloitte.com/us/en/insights/industry/health-care/consumer-health-trends.html). In practice, however, implementing this digital front door strategy is challenging for [most healthcare systems](https://www.healthit.gov/sites/default/files/page/2021-02/Use-of-Certified-Health-IT-and-Methods-to-Enable-Interoperability-by-U.S.-Non-Federal-Acute-Care-Hospitals-2019.pdf), due to the [fragmented nature](https://www.chiefhealthcareexecutive.com/view/consequences-of-fragmented-healthcare-information-systems) of healthcare information.

The Substitutable Medical Applications and Reusable Technologies (SMART) platform promises to solve these data fragmentation challenges by standardizing how patient data is accessed and shared. And given SMART’s inclusion in the [21st Century Cures Act](https://www.federalregister.gov/documents/2020/05/01/2020-07419/21st-century-cures-act-interoperability-information-blocking-and-the-onc-health-it-certification), the platform will become the standard protocol for accessing electronic health records (EHRs) in the near future.

Below, we explain what SMART means for the healthcare ecosystem and how it will improve both health data interoperability and the value of healthcare technology as a whole.

## What is SMART on FHIR?

[SMART](https://smarthealthit.org/) is an open-source, standards-based [API](https://auth0.com/blog/what-is-an-api-how-apis-work-for-non-developers/) that leverages the [OAuth 2.0](https://auth0.com/intro-to-iam/what-is-oauth-2/) standard to provide secure, universal access to EHRs. The SMART platform builds on the existing Fast Health Interoperability Resources (hence the name "SMART on FHIR").

Together, these two standards contain everything developers need to build applications that will work anywhere within the healthcare ecosystem:

1. **Open standards** for protocols for authentication, authorization, and UI integration that define how to build applications with universal access to EHRs
2. **Open-source tools and libraries** for developers that make it easier to use SMART standards during application development. The platform also offers a free sandbox that helps developers test their apps before deployment
3. **An application gallery** that highlights all of the existing healthcare applications and software that currently uses SMART on FHIR's platform

<br>
The original idea behind SMART was first introduced in [an article](https://www.nejm.org/doi/full/10.1056/NEJMp0900411) in the New England Journal of Medicine back in 2009. With the help of federal funding in 2010, SMART developed into the platform it is today, which is currently used by both [Microsoft Azure](https://azure.microsoft.com/en-us/blog/azure-api-for-fhir-moves-to-general-availability/) and [Apple](https://www.apple.com/ios/health/).

## How SMART Improves Healthcare Interoperability and Delivery

SMART improves healthcare interoperability in the same way standard electrical sockets and plugs simplify the process of powering different devices in your home.

Today, most EHR databases use a proprietary API (their own unique plug and socket configuration). As a result, tech companies have to build a custom connection to each database in order to access medical data. Not only is this costly, but it also hinders the ability of healthcare providers and patients to access their data with the technology that works best for them.

SMART, on the other hand, provides a standard, universal API for accessing EHRs. Any technology built with SMART works with any EHR database that uses SMART as well. As a result, healthcare technology becomes interchangeable, allowing health systems and patients to access medical data on the applications that best suit their needs, rather than only the ones that work with the EHR database they use.

## How Improved Interoperability Improves The Value of Healthcare Technology

Interoperability is valuable for healthcare tech companies because it "ensures \[their\] innovations can be broadly understood and developed," as Dave Pickles, Founder and CTO of The Trade Desk, tells [Forbes](https://www.forbes.com/sites/forbestechcouncil/2019/08/08/interoperability-and-the-future-of-software-development/?sh=2b59504d4767). And since SMART improves interoperability, it also encourages healthcare technology innovation.

For example, SMART decouples the protocols for accessing EHRs from a piece of software itself. So it allows healthcare technology companies to improve their products and services without worrying about how it will impact the way patients and providers access their data. The result is faster development of healthcare applications, which improves the quality of the entire marketplace (and care for consumers) as a whole.

SMART also simplifies app development for tech companies. Developers no longer need to build custom connections to each EHR database — they can develop their apps once using SMART, and those apps will work with any EHR databases built with SMART. As a result, their apps become more useful to a broader audience of health organizations and consumers.

## What SMART's Inclusion in the 21st Century Cures Act Means

The 21st Century Cures Act (passed in 2016) called for the adoption of a universal API that would "allow individuals to securely and easily access structured electronic health information using smartphone applications." The Office of the National Coordinator for Health Information Technology’s (ONC’s) [Final Rule on Interoperability](https://www.healthit.gov/curesrule/) (published in 2020) later named SMART as that universal API.

For [ONC-certified health IT](https://www.healthit.gov/topic/certification-ehrs/about-onc-health-it-certification-program) (primarily government applications), this means SMART's API is now a requirement. However, since the ONC certification program is voluntary for the private sector, SMART's API isn't legally required for companies whose technologies are not used in government applications.

The Centers For Medicare and Medicaid Services (CMS) also includes policies in their regulations “which require or encourage payers to implement Application Programming Interfaces (APIs) to improve the electronic exchange of health care data.” SMART on FHIR is [named as the preferred technical standard](https://www.cms.gov/Regulations-and-Guidance/Guidance/Interoperability/index) for doing so, meaning any health system that accepts Medicare or Medicaid must also adopt SMART.

## SMART on FHIR is a Must For Healthcare Providers

Given the benefits, as well as its inclusion in the Cures Act, adopting SMART is practically a necessity for any health system. For this reason, major EHR players like [Epic, Cerner, and Allscripts](https://smarthealthit.org/an-app-platform-for-healthcare/who-is-using-smart/) are already using SMART.

However, there are only 58 apps listed on [SMART's App Gallery](https://apps.smarthealthit.org/apps/featured) as of the writing of this article, meaning few companies have incorporated the standard into their tech at this time. As a result, SMART adoption could be a sales advantage for some tech companies.

Outside of mandates, early adoption of SMART could also help healthcare tech companies ensure their applications become more widely adopted in the long run. Learn more about utilizing SMART on FHIR's platform, tools, and API [here](https://smarthealthit.org/developer-resources/).

What SMART on FHIR Means for the Future of Healthcare

liam-hampton

Liam is the Lead Developer Advocate within the IBM Hybrid Cloud Build Team UKI. He uses his wealth of technical knowledge to create fun and engaging developer content, blogs, workshops, events and speaking engagements. He has professional experience as a Software Developer working on and contributing to open source projects and language performance analysis. Liam now focuses his work on microservices, specialising in containerisation, serverless computing and DevOps.

IBM Lead Developer Advocate UKI

Liam Hampton

A beginners guide into the world of IoT with TinyGo.

**TL;DR:** The concept of coding for IoT devices, CLIs and WebAssembly is not a new concept. However, what if I told you that it is possible to use Golang for all three. [TinyGo](https://tinygo.org/) is a specialized project specifically designed and used for development in small places. This article explains the benefits of TinyGo, what it is, and how you can use it. It also provides you with a Golang IoT code example for you to see TinyGo in action.

## What Is TinyGo?

TinyGo is Golang's baby brother. It is a compiler that allows a user to write the Golang code they are familiar with and run it in places people wouldn't have thought were possible. What this means is that the barriers to entry into some tech spaces are being gradually lowered. I say this because I am writing through experience.

## How Is TinyGo Different from Golang?

Out of the box, Golang is a feature-rich, highly-performant, compiled language, which means that Golang is compiled to machine-readable code (those funky `1` 's and `0` 's everyone talks about).

In turn, being compiled to machine code allows it to run directly on the hardware &mdash; all that CPU/RAM power! Another really cool feature of Golang is that when building a binary of the written program, it includes extensive cross-compatibility for a wide from of different system architectures.

Once a binary has been built, it can be run on any compatible distribution/architecture, providing it has been specified during the build process. To find the list of supported architectures (after installing Go on your machine), run this command into your terminal: `go tool dist list`.

The output will look something like this:

```bash
aix/ppc64
android/386
android/amd64
android/arm
android/arm64
darwin/amd64
darwin/arm64
dragonfly/amd64
freebsd/386
...
```

So, how is TinyGo different? Well, it's the same Golang you know and love, but TinyGo is a smaller compiler based on [LLVM](https://llvm.org/) technologies. It has essentially cherry-picked a number of important and available libraries and trimmed a lot of the fat from the core language.

By doing that, TinyGo becomes an even more powerful and efficient language that you can run in unexpected places. As an example of fat that's been trimmed, the library `html/template` cannot be imported by TinyGo as it relies upon other dependencies, which in turn are not able to be imported.

> To read up on the packages supported by TinyGo, visit the [documentation pages](https://tinygo.org/docs/reference/lang-support/stdlib/).

## Where Can You Use TinyGo?

### Use TinyGo with WebAssembly

#### What is WebAssembly?

Web development might usually be associated with JavaScript, but this isn't always the case. WebAssembly is an official W3C standard and allows people to develop applications for the web without using JavaScript.

I first must stress, WebAssembly is not a replacement for JavaScript but can be an excellent complement. The two technologies can work well together to deliver web content. In one small sentence, WebAssembly is a format for writing code for the web. WebAssembly is designed to be highly performant, which is why a language with a small overhead is preferable.

WebAssembly allows developers to write code in a familiar language and run it through a web browser for end-users. Through this method, near-native performance is achieved, and the required support is already in your modern browser.

In essence, you can write your code in TinyGo and pass it through the WASM compiler, which turns that Golang code into machine-readable code. Then, you can run the application through a web browser easily.

![WebAssembly diagram](https://images.ctfassets.net/23aumh6u8s0i/A4oW5u3cr5j5St4Z1bA0o/7714e2411c109a2e74347557be305cc1/01_tiny.png)

### Use TinyGo to build a CLI

#### What is a CLI?

A Command Line Interface (CLI) is a standardized way for a user to interact textually with a system or application. The first primary use cases of CLIs were back in the 1960's where users could use a terminal to interact with the operating system. This was a continuous trend throughout the following decades which enabled systems to become more complex and give users more freedom on the computer they are using.

#### Why does a CLI need to be small?

Some CLIs interact with the operating system directly, which in turn means they will need some low-level permissions and a secure library set. Initially, people might think of a C language or Python to accomplish that task. They are established, low-level languages that have been used in some high-profile CLIs in the past.

*Golang enters the room*.

However, for those that don't know, Go is derived from C. In fact, it's so close that you can call C code from within a Go program &mdash; it's called Cgo.

In recent years, Go has been the go-to language to create CLIs. Some of the most popular and most used CLIs are written in Go: Docker CLI, Kubernetes CLI (`kubectl`), GitHub CLI, just to name a few. This has been made possible by the creation of third-party libraries and imports that take care of the complex tasks developers would otherwise have to take care of themselves. 

Second to this is the power hidden under the hood of the language. Go has concurrency in the form of go-routines making asynchronous programming simplistic and a garbage collector helping with memory management. All of these features (and more) help reduce the size and space taken up by an integral program, all working towards keeping programs as performant as possible.

However, if a small project needs a CLI to be written for it or the CLI is only performing some basic tasks, sometimes these large libraries and imports can be overkill. Unless the end goal is to write a complex, multi-functional CLI like the ones mentioned before, a great number of the available libraries may not even be used, resulting in overhead the project could do without. To keep a CLI small and precise, reducing waste is a top priority. This makes TinyGo a great choice for small CLIs.

### TinyGo can power microcontrollers

#### What is a microcontroller?

A microcontroller is usually a single chip on a small circuit board that allows input and output (I/O). A common and well-known example is an Arduino, which is fantastic for home automation and other smaller projects around the house.

With the IoT boom in recent years, Arduinos have also seen a rise in popularity. The trouble with this is that Arduinos are usually coded in C++. To some, this can be seen as a barrier to entry as it is a complex language, and not everyone wants to learn or use it when alternatives are available.

When I began to play with IoT, I purchased a bunch of Arduinos, thinking I could do some cool projects. Then I was personally struck with the C++ barrier. Most of my work is either in Node.js or Golang. With this being the case, I took a seat and thought about how I could write the code I know and love to create these cool projects I had in mind. This is where I came across TinyGo.

#### How many boards does TinyGo support?

TinyGo is a growing project. At the time of writing, TinyGo supports over 60 microcontroller boards. These range from [Espressif boards (ESP's)](https://www.espressif.com/) to [Adafruits](https://www.adafruit.com/category/851) and as previously mentioned, Arduinos, opening so many doors for people to begin their journey into IoT whilst coding in a familiar language.

> Check the [documentation for each microcontroller board supported by TinyGo](https://tinygo.org/docs/reference/microcontrollers/) for more details.

## Why Is TinyGo a Great Alternative to C++ and MicroPython?

I am not going to the language bash. C, Python, and Go are all great languages in their own way. With that being said, there is plenty of room for this project to grow and come to fruition with the right support.

Golang has significantly grown in popularity over the past few years. It is quickly becoming the de facto choice of language for cloud-native development due to its "first-class" support. In the [Stack Overflow Developer Survey 2017 for Most popular technologies]( https://insights.stackoverflow.com/survey/2017#most-popular-technologies), Go entered the list for the first time and only scored 4.4%. In contrast to 2020, only 3 years later, it scored [8.8%](https://insights.stackoverflow.com/survey/2020#technology-programming-scripting-and-markup-languages-all-respondents). Let's the couple that with Golang being associated with some of the most sought-after skills and top paying salaries worldwide. It is only right to assume this growth will continue.

In addition, looking at the IoT market, we can see yet another upwards trend. In 2017, Garner forecasted 8.4 billion IoT devices to be connected. Fast-track to 2025, and there is a prediction of up to 30 billion devices being connected. This is a huge leap! The growth of Golang and its baby sibling, TinyGo, can help fuel the IoT fire.

## TinyGo in Action

Let's look at how Golang IoT shapes up with some code!

For this blog post, I have created a small program for you to create that turns 4 LEDs on when a phototransistor detects no light. This is essentially how outdoor night lights work.

To do this, I have used:

- Visual Studio Code + TinyGo plugin
- TinyGo version `0.18.0 darwin/amd64` (using Golang version `1.16` and LLVM version `11.0.0`)
- 1 x Arduino Uno R3
- 1 x  Breadboard
- 8 x Male-Male wires
- 5 x Resistors (1 x 10kΩ / 4 x 220Ω)
- 1 x Phototransistor
- 4 LEDs

### Step 1:

If you haven't already, [install Go]( https://golang.org/doc/install) and then download and [install TinyGo]( https://tinygo.org/getting-started/install/) on your machine.

To check if Go is installed, run the following command:

```bash
go version
```

To check if TinyGo is installed, run the following command:

```bash
tinygo version
```

Next, install the TinyGo Visual Studio Code Plugin.

![install tinygo vscode editor plugin](https://images.ctfassets.net/23aumh6u8s0i/TPJESp0S9pdn3L8uAvDKn/820fe16c173b0ba789be43ad7a7be94c/02_tiny.png)

### Step 2:

Plugin the board with a USB cable (in this example, I am using an Arduino R3) and target it with the editor. Once targeted, the editor will prompt a reload of the window.

![tinygo select the target board](https://images.ctfassets.net/23aumh6u8s0i/3fruuXSiUdJFWW9F3vvqAh/149c1725df6a52ae2e91546e74cc1b18/03_tiny.png)

![reload the vscode editor](https://images.ctfassets.net/23aumh6u8s0i/6QR634B8bipgZAIBUJvdoT/8e89bc62d7c9a858b1995ad732e78e58/04_tiny.png)

> **🚨 Warning 🚨:** The editor might prompt you to update the `go dev` tools within the editor. If you execute the update, you may get an error due to a known bug. Until this is fixed, it is advised to not update the tools.

![vscode update tools notification](https://images.ctfassets.net/23aumh6u8s0i/UgrMtLf7UmXwLxhenjy6X/a6e66e3910ca85f98752fe33234b8c5b/05_tiny.png)


### Step 3:

1. Create a project in the directory `$HOME/go/src/github.com/tinygo`

```bash
$ mkdir light-sensor
```

2. Change into the newly created project directory

```bash
$ cd light-sensor
```

3. Create a new `.go` file for the application within the project directory

```bash
$ touch light-sensor.go
```

4. Create a go mod file if you are using go modules

```bash
$ go mod init
```

5. Finally, open the project in Visual Studio Code


### Step 4:

First, read the code and comments below, and then secondly, write it out. Don't copy and paste!

```go
package main

import (
    "machine"
    "time"
)

func main() {

    // Initialise Analog pins
    machine.InitADC()

    // Set the light sensor to Analog pin 0
    lightSensor := machine.ADC{Pin: machine.ADC0}
    lightSensor.Configure(machine.ADCConfig{})
    // Set the LEDs to the corresponding pins
    leds := []machine.Pin{
        machine.D7,
        machine.D8,
        machine.D9,
        machine.D10,
    }

    // Configure each LED as an output
    for _, led := range leds {
        led.Configure(machine.PinConfig{Mode: machine.PinOutput})
    }

    // Constantly loop to get the light sensor reading every 0.1 seconds
    for {
        // 30000 is the lighting threshold for my environment
        if lightSensor.Get() > 30000 {
            // Turn the LEDs off
            for _, led := range leds {
                led.Set(false)
            }
        } else {
            // Turn the LEDs on
            for _, led := range leds {
                led.Set(true)
            }
        }

        // Time to wait before next light sensor reading is collected
        time.Sleep(time.Millisecond * 100)
    }
}
```

### Step 5:

Connect the components, so they resemble the circuit board shown below.

![circuit board diagram](https://images.ctfassets.net/23aumh6u8s0i/2DfJWFFXVvp38jclNPNH0m/21c2eae0341fc09b98f8daff298063ed/06_tiny.png)


![circuit board](https://images.ctfassets.net/23aumh6u8s0i/5CWIRVVG7BAMXeryu8d1EU/1be865f5accd679cd8ba55ca33576d12/07_tiny_pic.jpg)


### Step 6:

Next, find what port the connected device is running on. To do that, enter the following command into a terminal or navigate to the device manager.

**Mac:**

```bash
$ ls /dev/cu*
```

**Linux:**

```bash
$ ls /dev/tty*
```

**Windows:**

Open Device Manager and expand the Ports (COM & LPT) list. Find your connected device and make a note of the port number. You will need this to flash the device in the next step.

Alternatively, visit [MathWorks]( https://www.mathworks.com/help/supportpkg/arduinoio/ug/find-arduino-port-on-windows-mac-and-linux.html ) website for more information on how to find the port number of your connected device.

### Step 7:

Now you have the port number, the device is connected and targeted through the editor, and you have written the code. The next step is to flash the board. To do this, enter the command below into a terminal.

```bash
tinygo flash -target=<board-you-are-targeting> -port=<device-port-from-step-6> <name-of-file>
```

Example command:

```bash
tinygo flash -target=Arduino -port=/dev/cu.usbmodem143201 light-sensor.go
```

Once you have completed the device flash, it should look like this:


<AmpContent>
<amp-img width="245" height="300" src="https://imgur.com/srh5UM1.gif" alt="an animation" attribution=""></amp-img>
</AmpContent>

<NonAmpContent>
<p align="center"><IMG SRC="https://imgur.com/srh5UM1.gif"></p>
</NonAmpContent>

## Takeaways

1. TinyGo is an excellent alternative for embedded systems and WebAssembly development.
2. Being a smaller compiler for the Go language, existing Go developers can enter the IoT space with their current skills.
3. Adoption is continuously growing, and TinyGo is supported by the most common microcontroller boards already, reducing the barriers to entry for newcomers and hobbyists.

TinyGo is still a very experimental project which has come on leaps and bounds over a short period of time. With Go's impact in the software world continuing to grow, TinyGo could be a project to keep an eye on. Having multiple lightweight alternatives to the main language is needed for IoT and edge computing since there is often limited compute power available and overall needs exploding. TinyGo is just another example of a great slimmed-down alternative to the dominant languages for microcontrollers. I, for one, will certainly be keeping an eye out for a linear adoption pattern and continue to monitor and research exciting projects like this.

TinyGo: Good Things Come in Small Packages

tyler-clark

Tyler works as a developer advocate engineer at Auth0. He's worked as an engineer at small to enterprise level companies and loves everything about tech. You'll frequently find him ether out with his family, playing sports, or coding something. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'><strong><b>egghead.io</b></strong></a>, and his profile is online at <a target='_blank' rel='noopener noreferrer' href='https://tylerclark.dev'><strong><b>tylerclark.dev</b></strong></a>.

Senior Developer Advocate Engineer

Tyler Clark

Easily add custom messages to a two-way mirror, powered by a Raspberry Pi

Dad's in a Meeting... Creating a Raspberry Pi Smart Mirror

stephanie-chamblee

As a Community Engineer, my focus is building the Community and helping others get past blockers when implementing Auth0. My favorite technologies are Python, Node.js, and React. In my free time, I enjoy playing board games, plant-based cooking, and the occasional PS5 game.

Community Engineer II

Stephanie Chamblee

Learn how to build a physical user signup counter for your Auth0 tenant with Arduino

Build a User Signup Counter with Arduino, Part 2

Build a User Signup Counter with Arduino, Part 1

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Auth0 provides global community of 30 million developers, educators, and businesses with simple, secure identity management


**LONDON - July 29, 2019 -** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced it has been selected as the identity management platform of choice for Arduino®, the world's leading open-source hardware and software ecosystem. With a global community of 30 million "makers", [Arduino](https://www.arduino.cc/) will use Auth0 to replace its own Single Sign On solution for all of its public facing web properties, including Arduino Create and community apps.

Arduino is on a mission to enable anyone to innovate by making complex technology simple to use. Its simple and accessible electronic boards, open-source software, and user community have powered thousands of projects, [from everyday objects to complex scientific instruments](https://create.arduino.cc/projecthub). Educational institutions around the world also use Arduino as a resource for STEAM programmes &ndash; integrating Science, Technology, Engineering, Arts, and Math.

Arduino discovered its homegrown authentication solution would not scale to meet the rapidly developing needs of its growing global community, and reached out to Auth0. In addition to Single Sign On, Arduino will take advantage of Auth0's new [Universal Login](https://auth0.com/docs/universal-login), which enables developers to completely customise their branded authentication experiences quickly, and [Device Flow](https://auth0.com/device-flow/) for browserless or input-constrained devices.

"We wanted a robust platform to replace our SSO solution but also give us the flexibility to do cool, new things in the device authentication space. Auth0 is a brand we admire, and their API-based approach makes it easy to migrate our login data in a way that's completely transparent for the customer," said Gianluca Varisco, CISO at Arduino. "We are excited to welcome them to our global community."

Auth0 and Arduino plan to leverage the combined power of their communities and events, and explore a technical partnership in the IoT domain. Auth0 currently secures more than 2.5 billion logins per month for 21 million users.

"I have been using Arduino for years as the brain for my personal projects, so working with them in a business capacity is really rewarding," said Eugenio Pace, CEO and co-founder of Auth0. "When you empower the developer with simple, powerful tools, the whole business benefits. We are excited by the reach of the Arduino community and aligned in our mission to help the developer in their journey to innovate."

<include src="asides/AboutAuth0" />

### Media Contacts:

Mark Fowler<br/>
Racepoint Global for Auth0, EMEA<br/>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br/>
+44 (0) 77 1124 4113


Arduino Selects Auth0 as Standardized Login for Open-Source Ecosystem

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Learn how the OAuth 2.0 Device Flow offers smooth authentication and authorization to limited-input devices.



Tired of wrestling with remote controls and on-screen TV keyboards to enter credentials on your smart TV? You’ve dealt with it too many times, and you can bet your customers have to. What if you could help them get logged in with just a few taps on their cell phone?

![Image of person using TV remote control to enter credentials](https://images.ctfassets.net/23aumh6u8s0i/40YgdeQssI4jVCDkuUFBhK/84a3c8111f80e7c8f1e0c45c0366f7ac/do-not-use-remote-controls-to-enter-credentials)

Hi, Dan from Auth0 here bringing you the [**OAuth 2.0 Device Flow**](https://auth0.com/device-flow/): a fast, easy, and safe way to log into apps on your Smart TV and other input-constrained devices. No keyboard? No browser? No problem!

Ordinary login can be tedious and error-heavy. The OAuth 2.0 Device Flow is lightweight, authenticates you in seconds and not only works with TVs, but also with game consoles, CLIs, printers, and much more!

Auth0 offers developers a fully compliant implementation of the OAuth 2.0 Device Flow to tackle this user experience pain point easily. Let’s learn more about what input-constrained devices are, how this authorization grant works, and how Auth0 can help.

## What Are Internet-Connected, Input-Constrained Devices?

Do you have an internet-connected device that either (1) has no browser or (2) offers impractical ways for you to input text?

If you answered yes, then you have an input-constrained device! What type of devices came to your mind? I am thinking...

- All-in-One printers
- Fitness trackers
- Streaming devices
- Toothbrushes
- Game consoles
- Fridges
- Teddy bears
- Car infotainment systems
- Smart TVs
- Really, anything with the word “smart” in front of it

![Smart TVs, printers, gaming consoles, and other typical input-constrained devices](https://images.ctfassets.net/23aumh6u8s0i/2f4VYWXdICGOnMhmtm0u1G/d847718b30d453a63bd3f4d21c9d0e89/typical-input-constrained-devices)

The Internet of Things (IoT) frenzy has put a lot of devices online. Today or in the future, the software running on these devices may talk to your service APIs to get the data needed to offer your customers a rich user experience across devices and platforms. However, that user experience may not be so rich or secure if a device doesn’t offer a convenient way to authorize external services.

<include src="TweetQuote" quoteText="Granting authorization on input-constrained devices is challenging. But what are input-constrained devices anyway? Learn more in this blog post!"/>

As a competitive business, you don’t want to limit the devices that can use your services by not being able to provide browserless authentication. But, if the device does offer a browser or user interface, you wouldn’t want your customers to enter credentials using the arrows of a TV remote control to select keys from a giant on-screen keyboard. Their credentials could be compromised by someone recording their screen as they slowly input them, for example.

Furthermore, you’ll want to ensure that user credentials are not entered on systems that you don’t control and that may store them for future access, like smart displays that sometimes leverage proprietary systems or third-party clients that access your APIs.

What you do want is a way to authorize third-party applications with controlled access to your APIs on a variety of devices. The OAuth 2.0 Device Flow lets you do exactly that! Even on devices without a browser, you can take advantage of the security and user experience benefits of a standard delegated authorization protocol.

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziro/julian-lywood-mulcock-mini.png" name="Julian Lywood-Mulcock" title="Customer Success Architect" team="Customer Success" location="London, United Kingdom" body="With Device Flow, we reduce end-user frustration and we ensure the log-in action is as secure as it can be. <br /><br />By decoupling the log-in experience from input-constrained devices, end-users can benefit from a secure method of authentication while having a frictionless user experience they will tell their friends about."/>

To understand how to go with the Device Flow, it’s better for you to see it at play using a video streaming app as an example.

## OAuth 2.0 Device Flow In Action

Say that you want to watch AuthU TV, _a fictional video platform for techies_, on your television. You start by downloading the AuthU TV app to your smart TV. When you open the app for the first time, you’ll be welcomed by a login screen.

To kick things off, you’ll be asked to visit a URL on another device (like a smartphone or laptop), enter a short code, and then log in to your AuthU account to authenticate yourself.

Completing this process gives the software on your TV access to your AuthU account and lets you use your remote control to navigate AuthU content &mdash; not enter credentials.

![Illustration of OAuth 2.0 Device Flow that connects your devices](https://images.ctfassets.net/23aumh6u8s0i/2fc4mgnGc7TLVmFSyFCEmq/a1a849dbf53cc82ec7c30e6f6ff63b31/device-flow-banner-2)

At a high level, this process is very similar to how YouTube redirects to accounts.google.com to process a user login. With the OAuth 2.0 Device Flow, you manage the authentication process on a centralized login page, using a secondary device to make the input of credentials faster and more secure. By moving authentication off the device and into a browser, you are able to take advantage of more advanced identity and security features, such as MFA, SSO, and Social Login.

But talk is cheap: let’s see the Device Flow in action! Our engineers at Auth0 created an interactive demo that lets you simulate the authorization of the AuthU smart TV app right from your browser.

Start by visiting the [_Device Flow Playground_](https://auth0.github.io/device-flow-playground/). Once there, you can either try the playground with our default demo settings or configure with your Auth0 account settings to try in your own applications.

> Need an Auth0 account? <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get started for free today</a>. You’ll be saying “Wow!” while using everything that Auth0’s free trial has to offer!

You can also select the desired scopes you want to have. Once that’s done, click on “Get Started”.

![Image showing dashboard for how to get started with Auth0 Device Flow](https://images.ctfassets.net/23aumh6u8s0i/2kEgfhvZh84ty2XsEfjDS4/282e39d53d32deef8e381d012bbce385/getting-started)

Next, to stream content from the mock AuthU TV app, you are prompted to authorize the app by clicking on the “Authorize” button.

![Auth0 Device Flow: authorization request](https://images.ctfassets.net/23aumh6u8s0i/YYQyy8IRjr6yMu5bZ2CVK/a1d955489836849e35411d38da360a2e/authorization-request)

Now you are prompted to authorize the device by navigating to the activation URL, [_acme-demo.auth0.com/activate_](https://acme-demo.auth0.com/activate), using another device and entering the code displayed on your smart TV. You can also scan the QR code, which would automatically input the user code. The TV app will be waiting for you to complete the process on your secondary device which would trigger an authorization response it can use to get access to the AuthU TV service.

![Auth0 Device Flow: token request](https://images.ctfassets.net/23aumh6u8s0i/1kbV5mJIgdzqj1zKttXvhx/edefed4de2bfd100c411b0e4192c6892/token-request-2)

Visit the provided link, enter the one-time code, and click “Continue”. You can do this using another browser tab or your smartphone mobile browser.

![Auth0 Device Flow: device activation](https://images.ctfassets.net/23aumh6u8s0i/2DyardhZGZL9dsFkyv1ntI/eeee2eee9563b6c32066c3b5df3223c2/device-activation-enter-code)

![Auth0 Device Flow: device activation code](https://images.ctfassets.net/23aumh6u8s0i/5PUMsCJHIxEqQuqBhec3oC/6b3a2704a91bfd070ac57ad87983d7c9/device-activation-code-entered)

Confirm that the code displayed on the site matches the one shown on the smart TV and click “Continue”.

![Auth0 Device Flow: device confirmation](https://images.ctfassets.net/23aumh6u8s0i/7c5GzgdHLuYt2iPuqDzBhd/c5cd28ea0e35deee1a8648a757fd18d6/device-confirmation)

Next, sign up for an account or log in with an existing one.

![Auth0 Device Flow: user authentication](https://images.ctfassets.net/23aumh6u8s0i/1s4Z8pZ2FknPYkMD3BtcNr/0e46e566969ef95f364bb30afd12bb5e/authentication)

A message will show up on the site confirming that the device is now connected.

![Auth0 Device Flow: device connection](https://images.ctfassets.net/23aumh6u8s0i/6rJnFfbuz2vv0gn5Du3ivY/3df5ee90405b34ebe7816149d8777d7f/your-device-is-now-connected)

Back on the smart TV, the AuthU app is ready to start streaming content. The TV app has the authorization to fetch additional information about you to customize the UI.

![Auth0 Device Flow: activation completion](https://images.ctfassets.net/23aumh6u8s0i/01qheEW2pvdEikaQlCUq2l/12338b0c904089d2d86eace3f955cff7/activation-complete)

That’s it for a high-level technical overview of the OAuth 2.0 Device Flow. Let’s peek under the hood at how using Auth0 as your identity platform facilitates this process.

## OAuth 2.0 Device Flow Made Easy with Auth0

When your input-constrained device needs to fetch user data from your API, the following process takes place:

![Overview of OAuth 2.0 Device Flow with API calls](https://images.ctfassets.net/23aumh6u8s0i/2Ykjsm2pB8MBDiqWLTq6RQ/e80d6aa8ab913d990107e81b2aa41dbc/overview-flow-call-api-device-app)

1. If the device application is not already authorized, your device application calls your Auth0 Authorization Server to retrieve a device code.

2. Auth0 responds with a URL and user code. Your device app asks the user to visit a specific URL on a secondary device (like a laptop or smartphone) and provide the activation code.

3. Your device app begins to poll your Auth0 Authorization Server for an Access Token and a Refresh Token.

4. The user authenticates with Auth0 on the secondary device using one of your already configured authentication methods. Auth0 is an identity hub that supports many [_Identity Providers using various protocols_](https://auth0.com/docs/identityproviders) (like OpenID Connect, SAML, WS-Federation, and more).

5. Once authentication is complete, Auth0 responds to your device app with an Access Token and a Refresh Token, which lets you refresh the Access Token without having to request permission from the user again.

6. The Access Token can be used to call your API and retrieve requested data.

<include src="TweetQuote" quoteText="With access tokens and refresh tokens, you make authentication fast and make it last! Learn more about how tokens work in the OAuth 2.0 Device Flow."/>

## Recap

Today, you learned what internet-connected, input-constrained devices are, the challenges that these devices present to developers and customers alike, and how Auth0 along with OAuth 2.0 let you tackle those challenges through the implementation of the Device Flow.

The best part of the OAuth 2.0 Device Flow is that it lets you extend your existing authentication solutions to smart device platforms. This authorization grants simply lets your customers authenticate and authorize applications running on one device through another.

You may be curious about how you or your development team can implement this through code. We'll provide you with a detailed tutorial on Device Flow soon. Stay tuned! In the meantime, check the following resources for more information:

- [Introducing Device Flow](https://auth0.com/device-flow/)

- [Auth0 Device Authorization Flow Documentation](https://auth0.com/docs/flows/concepts/device-auth)

- [Calling an API Using the Device Authorization Flow](https://auth0.com/docs/flows/guides/device-auth/call-api-device-auth)

- [OAuth 2.0 Device Authorization Grant, Draft 15](https://tools.ietf.org/html/draft-ietf-oauth-device-flow-15)

<include src="TweetQuote" quoteText="The OAuth 2.0 Device Flow is designed for applications executed on internet-connected devices that either don’t have a browser or are input-constrained. It enables end-users to authorize device applications to access service APIs."/>

<include src="asides/AboutAuth0" />


OAuth 2.0 Device Flow, No Hassle Authentication - As Seen On TV

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

A proliferation of devices brings new security concerns near the holidays



Home security used to be as simple as locking your doors and windows, but the proliferation of smart home devices and home automation has given each house many more digital doors to check. The [use of these _devices in botnets_](https://auth0.com/blog/security-risk-20-plus-billion-iot-devices-by-2020/) has stirred anxiety about smart home device security. Users are trying to determine how best to ensure the privacy of their data and the sanctity of their homes in this challenging environment.

End users want to map the functionalities of their homes onto phone taps and voice commands. Even if they’re miles away, they still want to monitor their heat, lock their doors, and check for intruders, all while balancing [_security and convenience_](https://auth0.com/blog/security-vs-convenience/).

## Users Want Smart Homes, but Smart Home Device Security Isn’t Inviting

As a consumer, it’s a challenge to know if a smart home device will be a good investment. With so many hyped products, it’s hard to know where to begin. *We at Auth0 firmly believe security should be the key differentiator.*

According to a recent [_*Consumer Reports* study_](https://www.consumerreports.org/privacy/d-link-camera-poses-data-security-risk--consumer-reports-finds/), 87% of Americans worry about smart home device security issues. Meanwhile, Gartner believes security is the biggest [_impediment to IoT success_](https://www.gartner.com/newsroom/id/3869181). Vendors with tight security are the ones you should stick with, particularly at a time of escalating risk.

To help get started, we’ve outlined the major categories and brands of smart home devices below, including their security successes and flaws.

## A New Leader in Top-Selling Smart Home Systems

A smart home system, as opposed to a smart home device, is a product that offers end users an interface to control and orchestrate the rest of their devices. The three leaders in this space are Google’s Assistant, Amazon’s Alexa, and Apple’s Siri — all of which offer voice-controlled integration with a variety of smart home devices.

Each of these companies offers a hub that centralizes end-user interactions, primarily through voice. Google offers Google Home and Google Home Mini; Amazon offers Echo, Echo Show, Echo Spot, and Echo Dot; and Apple offers HomePod.

Smart home systems and hubs are important from a security perspective because if any of them are compromised, the rest of the interfaced devices may face similar compromise.

In 2018, [_Google beat Amazon_](https://www.canalys.com/newsroom/google-beats-amazon-to-first-place-in-smart-speaker-market) in smart speaker adoption, shipping 3.2 million Google Home and Home Mini devices versus Amazon’s 2.5 million Echo devices. One study found that Google Assistant is [_five times more accurate than Alexa_](http://blog.360i.com/reports/alexa-siri-google-how-do-we-know-what-they-know), which may have contributed to Google’s present and, potentially, future success.

![Amazon Echo smart devices and speaker images](https://images.ctfassets.net/23aumh6u8s0i/4PUZ2qDR6gw269rhZEYjcv/c744a3ad48b9df17d672722a3e2f3111/echo-buttons)

[Echo Image Source: [Amazon](https://press.aboutamazon.com/images-videos/devices-accessories/product-images-amazon-echo-buttons?c=176060&p=irol-accessories1)]

Amazon’s devices have also suffered more prominent security failures than other devices. This year, researchers created an applet, or “skill,” that appeared to be a calculator but in fact forced the mic to continue listening after an initial command and then [_transmit the transcribed audio_](https://www.wired.com/story/amazon-echo-alexa-skill-spying/).

Outside of research, Amazon also endured a [_viral eavesdropping story_](https://www.businessinsider.com/amazon-echo-eavesdropping-incident-undermining-smart-speaker-market-2018-5) this year when the Amazon Echo misunderstood a family’s unrelated conversation as a series of commands, started listening and recording, and then sent the audio to someone in the owner’s contact list. Amazon confirmed the narrative but deemed it unlikely. This is cold comfort to the user, who said she’d never plug it in again —as might many others who heard about the story.

The Apple HomePod, a relative latecomer to the smart speaker market, offers similar features differentiated by a higher-fidelity speaker. Apple, the rare company with a [_reputation for privacy protection_](https://www.computerworld.com/article/3253957/apple-ios/why-apple-needs-homepod-to-be-as-safe-as-houses.html), promises the HomePod will share only as much personal information — all of which is encrypted-as necessary to fulfill a user’s request.

## Smart Security Cameras

One of the top-selling smart home devices in the security camera category is Amazon’s Cloud Cam. The Cloud Cam promises users the ability to monitor the inside of their homes 24/7 and two-way audio. Amazon stores the footage from the Cloud Cam in its corporate servers, and videos travel through [_secure, encrypted connections_](https://www.consumerreports.org/privacy/d-link-camera-poses-data-security-risk--consumer-reports-finds/). End users can [watch videos on an app](https://www.voicesage.com/blog/digital-customer-experience-how-api-technology-enhances-cx-strategy/) or access them through a password-protected web page.

![Amazon’s Cloud Cam home automation Smart Security Camera](https://images.ctfassets.net/23aumh6u8s0i/4m7VunACcZIo86a74kk4IE/0ef23235491f0d1c87b06d1a9d7b2fea/smart-security-cameras)

Source: [_CNET_](https://www.cnet.com/pictures/amazons-cloud-cam-makes-diy-home-security-so-simple/4/)

Another popular line of smart secure cameras comes from Netgear. The Arlo Q Plus, which focuses on business contexts, features night vision, local backups, and integrations with Google Assistant and Amazon Alexa and offers enough cloud storage to keep seven days of recordings.

Netgear acknowledged that, in specific circumstances, users can expose their devices with weak passwords generated by factory resets, but it fixed this gap with a [_firmware update_](https://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-Vulnerability).

Log-in issues [_afflicted other Arlo users this year_](https://www.theverge.com/2018/5/30/17408650/netgear-arlo-security-camera-app), some of which kept users locked out of their accounts while the app displayed a variety of connectivity and authentication errors. For some devices, this might be a minor blip, but it’s debilitating for a device that promises continuous security. Companies have much to risk if they convince users their devices offer security and then pull that security away without notice.

## Smart Lighting

Philips Hue is a leading device in smart bulbs and smart lighting systems. Hue offers a variety of kits that enable users to control and automate lights remotely. In 2018, Hue added further Siri integration to make this even more efficient for iPhone users.

![Smart Lighting home automation Siri keynote with iPhone](https://images.ctfassets.net/23aumh6u8s0i/4TwYLZjo3pJp4SHvXLvEku/e181c685a62b5a6b14ca2bc90d84fccb/smart-lighting)

Source: [_Ry Crist_](https://twitter.com/rycrist/status/1035122403557498886/photo/1?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1035122403557498886&ref_url=https%3A%2F%2Fwww.cnet.com%2Fnews%2Fphilips-hue-smart-lights-will-work-with-siri-shorcuts-this-fall%2F)

In terms of smart home device security, it’s easy to assume Philips Hue might be the safest purely because access doesn’t appear as valuable to intruders as other devices. Smart home device security, however, is as much about comfort as protection.

Security researchers have demonstrated the ability to remotely hack Hue smart bulbs from hundreds of feet away by forcing a malicious firmware update. The [_researchers warned_](https://www.cnet.com/news/new-study-details-a-security-flaw-with-philips-hue-smart-bulbs) that beyond the single home context, such technology could damage a city’s power grid if the hack operated at larger scales. Philips Hue quietly and efficiently patched this flaw once they became aware of it.

In 2017, other testers encountered communication and authentication issues that left local communication between the app and the Hue bridge [_unsecured and unencrypted_](https://www.iot-tests.org/2017/06/hue-let-there-be-light). Smart home device security is often based on the assumption that local networks are secure, but that’s not always true.

These issues worsen when users don’t have the ability to verify and boot users, which [_one blogger learned in 2018_](https://char.gd/blog/2018/how-secure-are-your-light-bulbs). He found that without the technical API knowledge he had, the average user would be unable to figure out who had the authority to control the Hue system.

## Smart Locks and Doorbells

Smart home device and home automation security can’t be a more obvious issue when it comes to smart locks.

The August Smart Lock offers a continuous activity feed as well as the ability to lock and unlock doors remotely.

August also offers users the convenience of automatic guest access that users can distribute through temporary, digital keys. One hacker showed how an intruder could [_leverage guest access_](https://www.cnet.com/news/august-smart-lock-hacked/) to create new keys and control the August Smart Lock even after a user removed guest access. August eventually patched the issue, but some users were left concerned about August’s lack of transparency.

Ring, the smart doorbell company Amazon acquired this year, features instant alerts when guests press the doorbell and streams video that enables users to see visitors as well as communicate via two-way audio.

In May, Ring [_disclosed a security flaw_](https://www.marketwatch.com/story/people-are-using-this-smart-doorbell-to-spy-on-each-other-2018-05-18) that allowed people who had once had access to Ring maintain that access after the password was changed. In a nightmare scenario many smart home device manufacturers likely fear, a user discovered this after an ex-boyfriend used the Ring app to spy on him. Ring claimed it had fixed the flaw months previously but eventually admitted it hadn’t. As of this writing, the flaw remains unfixed. 

## The Future of Smart Home Device Security Requires Trust

It's likely that smart home device vulnerabilities will always exist, and enterprising hackers will always discover new ways to find them. Smart home device vendors will need to prove their willingness to be transparent and responsive when threats and breaches arise. 

Consumers should also do their research on a vendor’s security commitment before deciding to buy. In particular, they should focus on devices that have [strong _authentication procedures_](https://auth0.com/blog/go-beyond-username-password-with-modern-auth/). Authentication is the primary protective measure in the [UK’s literature review for IoT principles and best practices](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686090/PETRAS_Literature_Review_of_Industry_Recommendations_and_International_Developments_on_IoT_Security.pdf). Ensuring that a vendor doesn't lean on unencrypted credentials will go a long way towards keeping its users safe from a botnet like Mirai. In addition, companies that support [multifactor authentication](https://auth0.com/multifactor-authentication) (MFA) will add an extra layer of protection against weak passwords.

Smart home devices are as much interfaces as they are tools. As such, some of the worst vulnerabilities lie in the connections between them and the networks they integrate with. Organizations that hope to create lasting success in the smart home market must, as a baseline, be able to establish security through [_capable authentication procedures_](https://auth0.com/blog/go-beyond-username-password-with-modern-auth/).

<include src="asides/AboutAuth0" />


Security for Smart Home Devices

Unprotected IoT devices can make it easy for malicious actors to cause global damage. Botnets increased 140% last year. Auth0 can help safeguard your IoT devices.



## Is the UK’s ‘Secure By Design’ the Answer?

If 2017 was the year of the cyberattack, 2018 could be the year when IoT attacks make you feel like you’re living through a personal version of [Taken](https://www.youtube.com/watch?v=uPJVJBm9TPA&feature=youtu.be).

<include src="TweetQuote" quoteText="Unprotected IoT devices can make it easy malicious actors to cause global damage — botnets increased 140% last year. Auth0 can help safeguard your IoT devices"/>

Accessing vulnerable IoT devices, cybercriminals can grab photos of your kid; drain your bank account; alter your health records; hold your coffee maker, thermostat or vehicle hostage; and stop your heart (if you have a pacemaker).

On the business side, they can attack virtually every industry where rapid adoption of low-cost, easily-installed IoT devices has led Gartner analysts to predict that [more than 20 billion connected things](https://www.gartner.com/newsroom/id/3598917) will be in use by 2020.

## Yes, Your Wearable Could be Involved in a Global Threat

In addition to personal and business vulnerability where devices can be held hostage for ransom or more directly nefarious intent, unprotected IoT devices can provide easy ways for malicious actors to cause global damage, as can the apps that support them.

Just this week, [Under Armour announced that a data breach had affected 150 million users](https://www.cnbc.com/2018/03/29/under-armour-stock-falls-after-company-admits-data-breach.html) of its fitness and nutrition site, MyFitnessPal, which can sync with wearables like Fitbit, Misfit, and LumoLift, as well as IoT-linked scales and cardio machines.

![MyFitnessPal Data Breach](https://images.ctfassets.net/23aumh6u8s0i/3jjLYQZLu72oDrX2RYAkgy/e720f072cde3386f0605923dedf7c15f/myfitnesspall-breach)

Using malware, they can gain control of the IoT devices and group them together to create a botnet with the IoT devices acting as “zombies” tasked with fulfilling the hackers’ desires. Dark Reading reported that [botnet controllers increased by 140% in 2017](https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924).

What’s especially shocking about that rise is how fast these troubles can spread.

## How Minecraft Accidentally Inspired Network Takedowns

Starting in 2016, three guys in a dorm room created Mirai, an IoT botnet targeting devices with one of [60 popular default passwords](https://www.grahamcluley.com/mirai-botnet-password/), hijacking them without the owner’s knowledge.

Their exploits targeted French cloud computing company OVH, internet services company Dyn, and knocked out major platforms like Netflix, Amazon, Twitter, and Github.

While the FBI lay honeypot traps and worried Mirai was a sign of potential U.S. presidential election interference from Russia or China, Mirai’s creators realized they could also run a click-fraud scheme in addition to the original goal of [getting an advantage in the online game Minecraft](https://www.wired.com/story/mirai-botnet-minecraft-scam-brought-down-the-internet/).

Eventually, all three guys plead guilty, facing up to five years in prison, $250,000 each in fines, and five years of supervised release.

When Netlab 360 stopped tracking Mirai last summer, [2.7 million devices had been influenced in less than a year](https://www.darkreading.com/perimeter/iot-botnets-by-the-numbers/d/d-id/1330924?image_number=5).

## Billions of Devices at Risk

If you’re still calmly sipping your coffee, you’re not paying attention.

Satori, the IoT botnet that infected more than a quarter million devices within 12 hours of being spotted, [now has a version that can run on ARC processors](https://www.darkreading.com/vulnerabilities---threats/satori-botnet-malware-now-can-infect-even-more-iot-devices/d/d-id/1330875?). Why does that matter? More than [1.9 billion](https://www.synopsys.com/designware-ip/processor-solutions/arc-processors.html) ARC-based systems ship annually, making things run smoother in cars, industrial settings, homes, mobile, and IoT, including hearing aids and fitness bands.

Reaper, an IoT botnet built from Mirai’s code, had already [infected a million networks](https://www.wired.com/story/reaper-iot-botnet-infected-million-networks/) by October of 2017. Rather than exploit a single vulnerability, Reaper is a multi-vector opportunist. Written for on-the-fly updates, the malware can run fresh attacks as soon as they become available. As of the first week of March, The Hindu reports that WiFi cameras have proven most vulnerable to Reaper, with a [nearly four-fold increase in attacks over a three-month period](http://www.thehindu.com/todays-paper/tp-miscellaneous/tp-others/iot-botnets-attack-multiple-vulnerabilities/article22938435.ece).

Meanwhile, attacks are growing in complexity and sophistication, with one of the most recent botnets, Hide N Seek, developing the ability to have devices communicate directly with each other in peer-to-peer communication, which means it can spread via web and internal networks.

Botnets are rapidly becoming more mature and automated. With [400K-device botnets available for rent online](https://www.bleepingcomputer.com/news/security/you-can-now-rent-a-mirai-botnet-of-400-000-bots/) and others being [given away as Christmas gifts](http://www.zdnet.com/article/satori-malware-code-given-away-for-christmas/), IT departments are feeling the heat.

## What’s A Breach Going to Cost your Organization?

So how likely is it that your company is going to get hit with an IoT breach?
In the U.S., a 2017 [Altman Vilandrie & Company survey](http://www.altvil.com/wp-content/uploads/2017/06/AVCo.-IoT-Security-White-Paper-June-2017.pdf) of 397 U.S. executives across 19 industries revealed that 48% of businesses had already suffered an IoT breach.

Okay, so you’re breached. What’s the impact?

Breaches in that survey were found to cost 13.4% of the total revenues for companies with revenues of under $5 million annually. Of larger companies with revenues of $5 billion or more, 44% reported losses of more than 20 million.

For a more global perspective, Cisco’s [2018 Annual Cybersecurity Report](https://www.cisco.com/c/dam/m/digital/elq-cmcglobal/witb/acr2018/acr2018final.pdf?dtid=odicdc000016&ccid=cc000160&oid=anrsc005679&ecid=8196&elqTrackId=686210143d34494fa27ff73da9690a5b&elqaid=9452&elqat=2) found that by the time victims added up lost revenues, customers, opportunities, and out-of-pocket costs more than
50% of attacks results in damages of $500,000 or more. Nearly 40% of surveyed companies reported that attacks resulted in costs of more than a million.

When [GDPR](https://auth0.com/gdpr) comes into force in May, breached companies serving EU customers could also find themselves faced with additional fines, as well as greater public outcry that they should have been prepared.

## Why the World is Not Ready

If we know all of this is happening why aren’t we better prepared?

The answer is two-part. One having to deal with corner-cutting that happens when technologies are rushed to market. The other has to do with clear gaps in cybersecurity readiness which caused Cisco’s report to label IoT a “serious threat vector.”

IT teams are strained with burgeoning cloud responsibilities while also managing the proliferation of IT devices. After surveying 3,600 international security officers and security operations managers and conducting tech partner research, Cisco’s report also concluded that:

* 83% of devices in their partner sample displayed vulnerabilities
* IoT devices are called into action without security planning
* Organizations are unaware of the total the number of devices on their network
* Patching, a prime defense, happens slowly, if at all
* When patching does occur, the prior best-practice of patching within 30 days now only leaves you open to additional attacks.

Even when organizations do actively patch, they can run into troubles created by device design.

After [WannaCry](https://www.helpnetsecurity.com/2017/05/17/wannacry-iot/), spread globally via a combination of infected computers and IoT zombies to take down everything from hospitals in England and a telecom provider in Spain to computers in the Russian Ministry of Internal Affairs, IT departmartments all over the world were spurred into action. Patching did work for many of the Microsoft computers affected, but not for legacy IoT products that can’t be patched.

In a world where neither hackers nor botnets respect borders, no country offers safe haven, which is why the UK is suggesting a more global solution.

## UK Drafts Code of Best Practices, Calls for Input

“IoT security is a global challenge requiring global collaboration.”
—UK Government’s [Secure by Design Report](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686089/Secure_by_Design_Report_.pdf)

After researching serious global threats for several days, encountering the UK’s hope to create a “free, open, peaceful and secure cyberspace” proved remarkably soothing. Part of the conception of this cyberspace means that we’re all participating in a global digital economy. This is part of why the UK reached out to the public and private sectors and academia, and “like-minded countries” for ways to fight this IoT-driven threat.

The UK government’s recent examinations and explorations of best practices could allow us to better protect ourselves. The [Secure by Design Report](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686089/Secure_by_Design_Report_.pdf) makes it clear that no one country, organization, or individual can fix this situation by themselves. We’re going to have to do this together.

For businesses creating IoT devices and supporting apps, this will mean re-addressing the entire product life cycle with an emphasis on security. For organizations employing IoT devices, it will mean having a methodical approach to their security. Consumers, who are showing interest in purchasing an ever-increasing number of IoT devices, will be protected by security being built in into products from conception — “secure by design.”
The UK government is hoping the market will right itself, but given the urgency of the situation, they’ve also warned that they will consider regulatory action if change doesn’t happen naturally, noting that they will continue monitoring through the remainder of 2018.

In addition to outlining the gravity of mounting threats and suggesting best practices, the report also cites 5 key principles to help shift IoT thinking: Reducing burden (on consumers and others in the supply chain), Transparency, Measurability, Facilitating Dialogue, and Resilience.
With an emphasis on sharing best practices and encouraging dialogue, the UK government is seeking input from all areas of interest. To contribute to the conversation, send comments to [securebydesign@culture.gov.uk](mailto:securebydesign@culture.gov.uk) by the 25th April 2018.

## How Auth0 Can Help You Immediately Secure IoT

Justice from captured hackers is notoriously thin. Organizations and individuals currently receive little compensation for their losses and/or harm to their reputation. Remember those three guys that created Mirai? Together they paid only $750,000 in fines — and that money didn’t go to the victims.

<include src="TweetQuote" quoteText="Will the UK’s call for IoT standards help protect organizations from the rapid rise of botnets?"/>

Government efforts like the UK’s or even the one of multiple U.S. bills to secure the Internet of Things could lead to real change, but they’re going to take time. Meanwhile, the hackers are evolving their attacks at frightening rates. What can you do to protect yourself right now?

In the [UK’s literature review for IoT principles and best practices](https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/686090/PETRAS_Literature_Review_of_Industry_Recommendations_and_International_Developments_on_IoT_Security.pdf), authentication was the first protective measure listed. Reliance on common credentials without encryption is part of what made it so easy for Mirai to sweep through all those IoT devices. Securing the devices you have now and devices coming online with well-encrypted (hashed and salted) passwords can provide a strong line of defense. [Multifactor authentication](https://auth0.com/multifactor-authentication) (MFA) also offers the possibility of securing devices with other factors like geographic location or time.

Auth0 can help you put all of these things into use quickly and efficiently. We support IoT authentication with the most advanced password hashing algorithms. Our code is regularly submitted to independent penetration and black box testing and we also perform continuous vulnerability assessments. And because hackers are always evolving, we have a team of 12 engineers dedicated to full-time work on security, lead by Auth0 CISO Joan Pepin, former CISO for both Nike and Sumo Logic.

If you’d like to learn more about how Auth0 can help you secure your IoT devices and streamline your identity solution, reach out to [sales@auth0.com](mailto:sales@auth0.com).

<include src="asides/AboutAuth0" />


Security Risk: 20+ Billion IoT Devices by 2020

With 93% of breaches found to be preventable in Q3 of 2017, Auth0 offers concrete ways to protect patients against rising cyberattacks.



## Block Medical Identity Thieves with Cyber Hygiene

Cybersecurity attacks increased in number and sophistication in 2017. But the Online Trust Alliance (OTA), a global nonprofit dedicated to promoting online innovation and trust, found that [93% of breaches through Q3 could have been prevented](https://otalliance.org/system/files/files/initiative/documents/ota_cyber_incident_trends_report_jan2018.pdf). Only 52% of those breaches were caused by actual hacks. Internal issues that resulted in accidental or malicious events instigated by employees accounted for another 11%.

This is good news for healthcare organizations charged with protecting large quantities of personal health information (PHI) attracting data thieves.

Medical identity theft brings more than standard identity theft horrors. It allows criminals to pose as patients, securing prescription drugs or even medical treatment.

Victims of medical identity theft can even find themselves paying the thieves’ deductibles. An [Accenture study](https://www.accenture.com/us-en/insight-accenture-health-2017-consumer-survey) found half of U.S. victims were stuck with an average of $2,500 in out-of-pocket costs after an attack. Plus they have to clean up a medical history that can lead to serious treatment errors.

That kind of patient experience can send a customer doctor shopping. A [2018 PwC report](https://www.pwc.com/us/en/health-industries/assets/pwc-health-research-institute-top-health-industry-issues-of-2018-report.pdf) noted that 26% of consumers would change doctors, hospitals, insurers, or medical organizations after a hack.

<include src="TweetQuote" quoteText="26% of consumers said they would change healthcare providers after a hack. Cyberattacks may be rising, but 93% of hacks are preventable. Auth0 offers concrete ways to keep your patients safe."/>

"Healthcare organizations are just starting to realize that cybersecurity is not a cost center,” says Auth0 CISO Joan Pepin, speaking from more than twenty years experience handling cybersecurity, “It's actually adding value by placing the focus on the well-being of their end customers."

<include src="TweetQuote" quoteText="Healthcare organizations are just starting to realize that cybersecurity is adding value by placing the focus on the well-being of their end customers. —Auth0 CISO Joan Pepin"/>

And 2018 is already laying out challenges and consequences.
Half of Norway’s entire population — 3 million people — was already exposed in a [professional healthcare hack](https://www.scmagazineuk.com/half-of-norways-population-have-medical-data-leaked/article/738079/) in January. Although swift by current standards, breach notification fell well outside GDPR’s 72-hour requirement. After May, that lag will mean stiff fines.

Even outside the EU, breaches can have expensive consequences. Last year U.S. health insurer [Anthem paid a $115 million settlement](https://www.nbcnews.com/news/us-news/anthem-pay-record-115m-settle-lawsuits-over-data-breach-n776246) on over 100 consolidated lawsuits due to a 2015 cyber attack.

![Healthcare cybersecurity](https://images.ctfassets.net/23aumh6u8s0i/73bOR9hNS3ww9qRI6yTIjS/847eb9ef2e2b53769fabf1c7fc508053/med)

## Creating Your Cyber Hygiene Protocol

There is no such thing as a 100% vaccination against cyber attacks, but there are several steps you can take to protect your patients and your organization.

Pepin often mentions the protective strength of regular cyber hygiene. Like asking healthcare professionals and visitors to scrub in before visiting intensive care units, regularly following a set of logical protocols and actions can reduce cyber-attack risk.

### 1. Backup and Patch

Backups, regular patching, and third-party risk assessments can provide insights into areas in need of attention.

### 2. Instill Screen Locking

For situations where patients could access monitors, its best for healthcare professionals to follow the practice of locking the screen whenever they need to leave the room.

### 3. Retire Unsupported Devices and Applications

Making the argument to retire an older device can be challenging, especially when the device appears fully functional, but a device that runs on software that’s no longer updated leaves your entire network open to attack.

Unsupported applications and operating systems offer similar points of entry for hackers. Part of good cyber hygiene is putting together an end-of-life plan for these devices and applications.

### 4. Educate Your Staff In Social Engineering

Educating staff to recognize increasingly sophisticated spoofing, spear-phishing, and malware attempts can help stave off ransomware attacks and their potential economic impacts.
The FBI rates Business-Email Compromise (BEC) attacks as a “serious threat on a global scale.” Since 2015, the FBI’s Internet Complaint Center (IC3) has seen a [1,300% increase in identified exposed losses totalling more than $3 billion](https://www.fbi.gov/news/stories/business-e-mail-compromise-on-the-rise).

Pepin points out the need for regular maintenance and backups so you have the option of rebuildingand restoring rather than suffering a cessation of services in the case of a ransomware attack — and it means you retain access to your data. As [one in three Australian companies](https://www.theguardian.com/technology/2017/may/15/dont-pay-ransomware-demands-cybersecurity-experts-say-wannacry) surveyed by Telestra in 2017 discovered, paying the ransom doesn’t automatically get it back.

### 5. IoHT Devices: Inventory, Authorize, and Authenticate

Thousands of internet of health things (IoHT) devices are already in use in the form of patient monitors, imaging and x-ray devices.

Part of the draw is a large ROI. According to Aruba’s [2017 State of IoT study](http://www.arubanetworks.com/assets/infographic/Aruba_IoT_Healthcare_Infographic.pdf), healthcare organizations expect to a see a 40% ROI on the devices, despite the fact that 89% say they’ve already experienced a breach because of an IoT device.

But that ROI could be at risk. Reported medical device cybersecurity vulnerabilities in the U.S. climbed by [525%](https://www.pwc.com/us/en/health-industries/assets/pwc-health-research-institute-top-health-industry-issues-of-2018-report.pdf)  in 2017 according to PwC. Increasing vulnerabilities combined with heavy adoption rates has [IDC](https://www.brighttalk.com/webcast/15909/275931) expecting the world’s first USD $100 million lawsuit as the result of a cyber security attack on a medical device by 2021. Given regulatory trends like GDPR that lay responsibility for third-party vendor compliance at the feet of hiring organizations, the device manufacturer wouldn’t be the only one facing fines and possible lawsuits.

In an effort to reduce vulnerabilities, regulatory organizations like the FDA and ENISA are offering guidelines, hoping to increase interoperability, but the truth is that decreasing manufacturing costs have already lead to a proliferation of IoHT devices running on different protocols. It’s not unlikely that a single hospital must manage hundreds of varying protocols from its IoHT devices.

Inventorying devices in use makes it easier to recognize what to keep and what to retire, especially since most older IoHT devices lack the ability to be patched.

According to Component’s healthcare forecast, the IoHT global market is expected to grow from [$41.22 billion to $158.07 billion by 2022](https://www.marketsandmarkets.com/PressReleases/iot-healthcare.asp), which means more devices will come online. Getting a handle on what you have in place and understanding security vulnerabilities now will save on headaches later. Auth0 offers secure IoHT authentication and authorization protocols that can further secure vulnerable PHI and protect the rest of your system.

### 6. Eliminate System Siloes with a 360 Degree Patient View

Siloed systems provide hackers with multiple points of entry and make it harder to manage cyber-hygiene updates. Consolidating databases also makes it easier to identify care gaps and limit avoidable care errors. Auth0’s consolidated patient view means you can quickly authenticate and authorize patient access, understand if your patient is interacting with IoHT devices, and take advantage of API security — all of which reduces user friction, improving your patient’s overall experience and reducing risk.

### 7. Step-Up Authentication

One of your best deterrents is making sure your patients are who they say they are. Authenticating identity often happens only at login. Auth0 gives you the opportunity to add step-up authentication at any time during the patient journey. For example, if your patient normally logs in from his or her home address, but suddenly logs in from a different country, the patient might be traveling. Or they might be a hacker. Activating Auth0’s step-up authentication allows you to push out a request for additional information to a sanctioned device, like your patient’s phone. In a well-designed flow, this is handled easily, without disrupting your patient’s journey, ensuring the security of your patient and your system.

### 8. Perform Reasonable Triage

Despite the real threats, you can’t do all of these things at once. Identifying your areas of greatest risk can help you recognize which tasks to handle in-house and which are best handled by a trusted-third party vendor.

Cybersecurity can be easy to get wrong. In 2017, Molina Healthcare, a major Medicaid and Affordable Care Act provider, was [forced to shut down its patient portal](http://www.healthcareitnews.com/news/molina-healthcare-breached-exposed-patient-data-over-month) after discovering a “security 101” flaw, impacting 4.8 million patients.

If cyber-security is not your IT team’s area of expertise, it could be time to hire expert help. Auth0 authenticates and secures more than 50 million logins each day for customers in 70+ countries. Sophisticated data encryption algorithms are best left in the hands of those who regularly beat hackers and assume responsibility for upgrades and maintenance.

## Find Out How Auth0 Can Help Healthcare Organizations

Auth0 is trusted by healthcare organizations like Healthgrades, Clinica Alemana, Green Cross Health, IntegraMed, the Seattle Cancer Care Alliance and more. If you’d like to learn more about how Auth0 can help you securely put your patients at the center of their healthcare experience, reach out to [sales@auth0.com](mailto:sales@auth0.com).


8 Ways to Avoid Healthcare Breaches

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Here are 5 trends that will help you keep your organization secure in 2018.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

**TL;DR:**  It's easy to predict the security threat for 2018 (Hint: It will be bigger and more sophisticated than 2017). It's another thing to prepare for what lies ahead. Here are 5 trends that will help you keep your organization secure in 2018.

<include src="TweetQuote" quoteText="Here are 5 trends that will help you keep your organization secure in 2018"/>

[GDPR compliance](https://auth0.com/gdpr) is dominating the 2018 security discussion. With the May 25th deadline quickly approaching, the first half of 2018 will likely be consumed with making the necessary changes for compliance, which is an enormous task for any size company.

While GDPR is extremely important and failure to comply comes with [stiff penalties](https://resources.auth0.com/whitepaper/gdpr-fine-determination/), don't let it distract you from anticipating the security threats that await your organization. If you thought 2017 was a massive year of cyber attacks, there are unfortunately no signs of slowing down in 2018.

Here are our 5 security predictions to help you prepare for 2018.

### 1. Customers Are Fed Up With Passwords

The weaknesses of traditional credentials are well documented, yet most organizations continue to use them as the primary security method. Customers have had enough.

The Equifax breach was the straw that broke the camel's back. While security experts have known of the vulnerabilities of password reliance, the high-profile breaches of 2017 have brought a higher level of awareness to the general public.

People want security alternatives. A recent [survey](https://www.csoonline.com/article/3242866/security/our-top-7-cyber-security-predictions-for-2018.html) showed that people are now more concerned with someone stealing their personal data than they are with a home break-in. A company's reluctance to add stronger authentication will have to deal with fierce customer demand for additional security beyond the password.

The first logical step to strengthening traditional credentials is to implement [multifactor authentication](https://auth0.com/docs/multifactor-authentication) (MFA).

![Multi-factor Auth](https://images.ctfassets.net/23aumh6u8s0i/4n9ZcXraMMRDtcmRwG04bn/5aee12138b7dee3679d1ec18cdb246e4/Multifactor-Authentication)

MFA is a method used to verify a user's identity when they are trying to access an application. In addition to a password, MFA requires you to provide additional information such as an SMS code or a fingerprint to confirm your identity.

Consumer-oriented companies like Google, Apple, and PayPal have made MFA a standard feature and the trend will continue in 2018 with both consumer and enterprise accounts.

### 2. Preventing Aftershock Breaches

Companies that are breathing a sigh of relief that they weren't hit by a cyber attack in 2017 need to worry about a different type of threat — the aftershock breach.

The millions of compromised credentials taken from previous breaches now pose a liability for every company that uses passwords for security (which is everyone). Most people use the same credentials for all of their accounts, which heightens this risk of an aftershock breach, where hackers use the stolen credentials to access other accounts.

Experian's recent Data Breach [Report](https://www.experian.com/assets/data-breach/white-papers/2017-experian-data-breach-industry-forecast.pdf) notes:

> Given the continued success of aftershock breaches involving username and passwords, we predict that attackers are going to take the same approach with other types of attacks involving even more personal information, such as social security numbers or medical information.

Aftershock breaches can be minimized by using risk-based authentication, such as[ anomaly detection](https://auth0.com/docs/anomaly-detection) which monitors user behavior data to determine suspicious activity. By[ collecting signals](https://auth0.com/university/1/4/how-to-use-auth0-s-rules-feature) such as an IP address or the location of a user, anomaly detection can compare previously established behavior in order to spot inconsistencies.

![Password Breach Block](https://images.ctfassets.net/23aumh6u8s0i/3UQfTsXEnWW38EvMxQ7VvM/881ab7f175259a79750d7aafd6837fd3/breached-pass-lock)

Auth0's anomaly detection also tracks [password breaches](https://auth0.com/breached-passwords) of major third-party sites to help keep your users and systems secure. When a company like Equifax is breached, you can block your users from logging into your accounts until they go through a new authentication protocol.

When combined with MFA, anomaly detection makes it really hard for hackers to leverage their stolen credentials and initiate an aftershock breach.

### 3. Weaponizing Data Rather Than Stealing It

A few years ago, someone hacked into the Associated Press' Twitter account and tweeted a false report that President Obama had been injured in an explosion. The news caused a 150-point drop in the stock market.

![Source](https://images.ctfassets.net/23aumh6u8s0i/4Z7i4HQDeGCtb9UE1oVoKg/edc28deb72bca4907cd0af23e55c8b53/67201644_ap)

This type of data manipulation, known as a data integrity attack, will become more prevalent in 2018. While stealing millions of credit card numbers might seem like a huge score, it only works if you have a buyer on the other end. Hackers are realizing that it is much easier to capitalize on the data itself.

For example, an attacker could doctor a bank's routing numbers for a large financial gain. Or, one could erode public confidence by shutting down electrical grids. Regardless of the intention, the new target is in using the data, not stealing it.

Integrity attacks are hard to detect, which could leave companies defenseless with their current monitoring systems. The immediate solution to this threat is [data encryption](https://digitalguardian.com/blog/what-data-encryption). Most companies have an encryption policy that protects their most sensitive data, but the definition of sensitive data must be expanded to protect all potential attacks.

![Source](https://images.ctfassets.net/23aumh6u8s0i/1L5kShBmyTcdpOSeANibPA/161401f1ab2aa62f9563ce6668e6cabd/data-encryption)

The idea behind data encryption is to make your data incoherent to outsiders without the decryption key. **Why does this matter?**

The breaches in the past five years have shown that hackers can infiltrate the most sophisticated cyber security systems in the world. Traditional security like firewalls, intrusion monitoring and antivirus software are not very effective once hackers get inside. The last line of defense is to encrypt your data.

### 4. Rise of the Bots Against IoT

Bots are supposed to be our friends. They take care of the tedious, repetitive tasks so we can focus on the more important work. **But what happens when bots turn to the dark side?**

In 2016, a [botnet](https://www.csoonline.com/article/3240364/hacking/what-is-a-botnet-and-why-they-arent-going-away-anytime-soon.html) of more than 500,000 devices [attacked ](https://en.wikipedia.org/wiki/2016_Dyn_cyberattack) Dyn, a domain name service providers, crippling the internet and impacting huge websites like Amazon, Spotify, and Netflix. These types of attacks are often executed through internet-connected devices, and the threat for 2018 has never been greater.

![Source](https://images.ctfassets.net/23aumh6u8s0i/2XSmrlVo479am1wBxhs8PQ/b6429c8a47e75c0c1c6dc646fde06a9c/botnet2_1238990)

IoT is expected to surpass 10 billion devices in 2018 and over [22 billion by 2021](http://uk.businessinsider.com/the-internet-of-things-2017-report-2017-1?r=DE&IR=T). Every one of these devices poses a security risk as the surface area for an attack expands well beyond what current security measures can handle. In fact, [HP](http://www8.hp.com/de/de/hp-news/press-release.html?id=1744676#.WMFmT1XyiUk) found that at least 70 percent of IoT devices are vulnerable to an attack.

Hackers can simply buy a botnet kit, which gives them everything they need to launch an attack. The three most popular kits—Andromeda, Gamarue, and Wauchos—have already helped attackers infiltrate millions of devices. Once inside, the bots are capable of a myriad of debilitating tasks from taking down networks to compromising data or even controlling a device. **It will make you think twice about who is driving your self-driving car.**

### 5. Phishing is Still King

Major data breaches, ransomware attacks, and identity theft often start the same way—with a simple phishing scheme.

Phishing is still the most effective method for attackers to infiltrate a system, mainly because it relies on human error, which renders technical security useless. The only real defense is to train people to identify schemes and remain aware at all times.

While awareness will help prevent traditional phishing, attackers are creating more sophisticated techniques to outsmart the uneducated. They've also found success with other channels beyond email like phishing with SMS, also known as smishing.

![https://images.ctfassets.net/23aumh6u8s0i/6CsaSx8Zo8BWwel3zXoo5V/e4e81b69fc9360fd19c5471d3d439482/phishing-bank](https://images.ctfassets.net/23aumh6u8s0i/6CsaSx8Zo8BWwel3zXoo5V/e4e81b69fc9360fd19c5471d3d439482/phishing-bank)

Smishing scams are harder to detect because they take advantage of people's sense of urgency. Let's say you receive a text that appears to be an important message from your credit card company. An urgent message can catch you off guard and before you know it, you've compromised your information.

Awareness training becomes more difficult with smishing because of its heightened nature. You can't always prevent someone from being tricked by phishing, but you can anticipate it and secure your accounts beyond credentials. Password managers like [1Password](https://1password.com/) can be useful, but adding more layers of defense with MFA will help keep your accounts safe.

## Security in 2018 is About Proactive Prevention

Sadly, many of the breaches in 2017 could have been prevented with stronger security measures, especially around identity access management. Archaic methods like passwords and unprotected data made it easy for hackers to pull off some of the biggest heists of 2017 including corporate giants like Equifax and Deloitte.

The attack tactics might evolve, but at the end of the day, taking proactive measures will help deter the majority of attempts. By understanding the different threats, you can get ahead of them before they occur.

**_READ MORE:_**  [How Poor Identity Access Management Equals Security Breaches](https://auth0.com/blog/how-poor-identity-access-management-equals-security-breaches/)


Security Predictions for 2018 That Go Beyond GDPR Compliance

Find out how to add TLS to the Particle Photon to secure your communications.

JavaScript for Microcontrollers and IoT: SSL/TLS

Find out how Espruino's JavaScript engine works on top of the popular ESP8266 microcontroller.

JavaScript for Microcontrollers and IoT: Espruino and the ESP8266

Up the ante using JavaScript to build a simple web server with a microcontroller.

JavaScript for Microcontrollers and IoT: A Web Server

Build a sensor hub using JavaScript and the Particle Photon

JavaScript for Microcontrollers and IoT: Building a Sensor Hub

Learn about the different options for running JavaScript on microcontrollers and IoT platforms

JavaScript for Microcontrollers and IoT: Part 1

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Learn how the Dyn attack was perpetrated, how it could have been prevented and how to avoid similar attacks in the future



---

**TL;DR:** Last week, one of the biggest attacks in the internet history was perpetrated via a group of hackers during which popular websites like **Twitter**, **Netflix**, **GitHub**, **Amazon**, **Spotify** were knocked offline. These web sites were not accessible for the period the attacks lasted. A Distributed Denial of Service (DDOS) attack on Dyn - a domain name server company -  affected the online availability of these popular platforms.

---

## How did it happen?

Investigations about the recent DDOS attacks primarily revolved around **Internet of Things(IoT)**. It was revealed that several cameras, digital video recorders(DVRs) were hacked to create a massive botnet that struck Dyn with lots of traffic, about a trillion bits of data per second. These cameras and devices were vulnerable because they used default and common guessable passwords.

The attack on Dyn came from tens of millions of IP addresses according to the formal statement that was released on Dyn's website. The botnet that invoked the attack looks for smart home and **Internet of things** devices and transforms them into bots to use in cyberattacks. It was also discovered that one of the reasons this was so easily done was that most IoT devices still use the default username and password combination that they were shipped with. An example of a common username is `root`. These credentials are easy to find on the Internet, and were probably used to compromise thousands of devices with minimal effort.

## How could it have been prevented?

It is not new that in the **Internet of things** world, a lot of default and guessable passwords are used for these devices. In short, it's been a thing of concern for a long time that a lot of these devices are not well secured. For instance, several security cameras such as the one produced by Hangzhou XiongMai Technologies (XM) have a web app which requires a username and password to gain access to. But according to Wikholm, it's actually possible to bypass the login process by providing the IP address of a target device and adding "DVR.htm" to the end. These simple steps shown below will go a long way in preventing a lot of the cyber attacks happening frequently.

* Always change default passwords - Most of these devices hardcode the default passwords, so in most cases it would involve a firmware rewrite from the manufacturer. Companies responsible for creating these devices can provide an over-the-air update capability to enable the change from default to a complex username and password combination. In cases where the default passwords can be changed easily, please change it as soon as you purchase the device.
* Brute Force Protection - A certain limit can be set on failed login attempts on a device. If it exceeds a certain number, you can block the user!
* Change passwords frequently - The more devices, apps and systems get hacked, the likelihood that your password is leaked increases. Make a habit of frequently changing your passwords. More details can be found [here](https://auth0.com/blog/avoiding-password-reuse-attacks/)

## How can Auth0 help secure IoT?

Here at Auth0, we conducted a survey about both developer and consumer sentiments when it comes to the state of IoT security and what people think about the future. This very interesting [post](https://auth0.com/blog/surprised-turns-out-consumers-dont-trust-iot-security/) gives full details about the survey.

![Do you believe IoT devices are secure](https://images.ctfassets.net/23aumh6u8s0i/43Z5eryum1VacHZxnch7JM/b89916c018c26d4726c71bbd1bed9eab/do-you-believe-iot-devices-are-secure-2)

![Do you trust your personal data to IoT devices](https://images.ctfassets.net/23aumh6u8s0i/4fzx4Tgxetbu1jwnrfcWET/239b94449039d867270a6cbe611aa7eb/do-you-trust-your-personal-data-to-iot-devices)

You can use **Auth0** to simplify the implementation of your identity security. Auth0 provides the following:

- Can function as your authentication server, providing you with secure Json Web Tokens (JWTs)
- Keeps you up to date on the latest security vulnerabilities
- Provides [passwordless](https://auth0.com/passwordless) authentication, thus removing the vulnerabilities involved with hacked passwords.
- Provides [Anomaly Detection](https://auth0.com/learn/anomaly-detection/)
- Provides [Breached Password](https://auth0.com/breached-passwords) detection

## Conclusion

Cyber attacks are becoming the order of the day and many companies that develop IoT devices constantly think about user experience before security. Experts are concerned about the security of IoT devices for a long time, but nobody took action to improve that. Security should be *first-class* when dealing with connected devices and any type of application. Now that the world witnessed what lack of security in connected devices can do, it is important that manufacturers of IoT devices and users start taking security seriously to prevent similar or even worst attacks in the future.

<include src="TweetQuote" quoteText="Security should be first-class when dealing with connected devices and any type of application!"/>


How was the biggest DDoS attack in Internet history perpetrated?


A new year comes to an end, and it leaves us with several lessons learned in security. 2015 was a year for data breaches: U.S. federal agencies, dating sites, insurance companies, and other technology companies all fell victim to cyber-attacks. These lessons will probably guide security efforts and trends for the year to come. Here are our top 5 predictions for the cyber security world in 2016.

## 1 - IoT
2015 was the year when the **Internet of Things (IoT)** became one of the world’s fastest growing technology sectors, and simultaneously one of the fastest growing sources of security vulnerabilities for both consumers and enterprises. In the rush to release devices, manufacturers did not give them considerable security measures. Devices were designed for convenience, but not engineered with security in mind.

As more and more devices become tied into the Internet, the insufficient security mechanisms will likely expand the security threats in this industry. Consumers are aware of this situation, but it won't stop them from using IoT devices.

Through 2016, the growth of IoT devices will put pressure on manufacturers to implement the necessary security.

> You can read more about IoT security here: [Surprised? Turns out, consumers don’t trust IoT security](https://auth0.com/blog/2015/11/06/surprised-turns-out-consumers-dont-trust-iot-security/).

Moreover, as cars, personal wearable devices, and household appliances become interconnected, the security risk of IoT will only increase.

![Internet of Things](https://images.ctfassets.net/23aumh6u8s0i/3gZPuwCx6tobAsllqZuGmA/70866a34f2778dcd57b7d4ad87124f24/iot)

## 2 - Mobile Devices: App Attack
Nowadays the dependence of people on their smartphones and tablets is huge. These devices contain a lot of personal information due to the huge number of operations that they can perform. People access their bank account, make purchases, and pay bills. We use these devices for everything and that makes them a target for cyber criminals.

Today's mobile apps collect a considerable amount of data, which means that their security must be taken into account to maintain the security of the devices they run on. The vulnerability of a simple mobile application could lead to the compromise of an entire company network.

In the next year, more companies will acknowledge this threat and take action to detect and fix potential security holes in networks and applications.

> Remember that keeping your applications updated can help keep your devices and data secure.

![Mobile Devies](https://images.ctfassets.net/23aumh6u8s0i/2U9PaOPoXqgJ5Jmgf1H2Jh/c633a9cafeb9e92099d61e777e9c215c/mobile)

## 3 - Cyber Extortion
The old criminal methods will continue to evolve to the virtual world. The past few years have seen an increase in reported cases of **cyber extortion** (while many remain unreported), according to the [NYA Cyber Extortion Risk Report](http://www.nyainternational.com/sites/default/files/nya-publications/151027_Cyber_Extortion_Risk_Report_2015_0.pdf). 

Extortion is any kind of payment demanded in exchange for not causing harm, or threatening to cause you harm. It includes **Denial of Service (DoS)**, **Stealing confidential data**,  **Sexortion**, and **Ransomware**, a type of malicious software that infects a victim’s computer and encrypts its data and/or locks the computer until it is released by your payment.

In 2016, online threats will evolve to rely more on mastering the psychological side of the attack rather than the technical aspects of the operation. Attackers will continue to exploit people's fear to coerce victims into paying, as it has proven to be effective in the past. Reputation is essential, and threats that can ruin the reputation of an individual or—even more important—a business will prove to be effective and lucrative to cyber criminals.

Companies can protect themselves and their users agains cyber extortion by developing a strong incident response capability to complement their traditional security measures. As prevention can not be successful everytime, being capable of detecting and responding to incidents faster will be crucial.

![CryptoLocker](https://images.ctfassets.net/23aumh6u8s0i/1IbLCzSxn75PyUL2HTClzy/00e9244251f90b8041499dd7c500aa91/criptolocker)

## 4 - Machine Learning Prediction

**Machine learning** is the study of the construction of algorithms that can learn from and make **predictions** from data. It has seen a lot of growth this year, especially in the many scenarios where it can be applied. In the security arena, it is used for security analytics and anomaly detection to automate, making cyber security less dependent on humans. In this way, enterprises can detect and respond to threats even if they do not have skilled security analysts.

Through the use of machine learning it is possible to build tools that analyze data across multiple threat vectors, allowing for the development of predictive algorithms and a better understanding of the threats that enterprises are exposed to. Nowadays, enterprises consider security as a competitive advantage. That's why 2016 will see companies willing to invest in security, especially on cyber crime prediction.

The question is, will the bad actors start using machine learning for their own purposes, too?

![Marchine Learning Prediction](https://images.ctfassets.net/23aumh6u8s0i/5UtucyeJ62M7GNXsSVSz3V/c271f192f0fd425e3903d6ff51e9a801/machine-learning)

## 5 - Cloud Platforms
Following the high rate of adoption of **Cloud Services platforms**, cyber criminals will increasingly focus on exploiting their customers and stealing valuable and confidential data. Cloud providers have implemented advanced technologies for data protection, network security, privacy, and authentication/authorization management. Many of them have infrastructure capabilities that better block attacks and have better contingency plans and accelerated incident response. Most users trust in the security of the big cloud platforms, and providers will be pressured to maintain high levels of security because they will likely be one of the most important targets of cyber attackers.

![Cloud Platforms](https://images.ctfassets.net/23aumh6u8s0i/71NoY9KCPK0lsSQpENiRmN/6a551f13fd29e8dbc37a31766f0ec843/cloud-platform)

## Conclusions
One of the most important things we have to understand is that _money is no longer the sole motivator for cyber criminals_. Rather than hacking just for financial gain, in 2016 cybercriminals will sneak in to cause physical damage. During 2015 most hacktivist groups have already demonstrated that they are motivated not by money, but by causes that they believe in. When money is no longer the motivator, infrastructures, data, reputation, and more are put at risk.

Enterprises will have to be more careful as the **Internet of Things** expands the attack surface. Any device that is connected to the Internet is prone to compromise. People will soon realize that their smartwatches or their connected home appliances can be used to infiltrate corporate and government networks.

2016 will also see **cyber crime prediction**, powered by machine learning techniques, as a priority of the cybersecurity industry to anticipate where hackers will attack next. Enterprises will complement their prevention and failover strategies with detection technologies to get better visibility on their infrastructure. All of this will focus on maintaining one of their most important assets: **their reputation**.

Security trends for 2016

2ffc83fcccf746c783f921f186d1e619?s=60 avatar

2ffc83fcccf746c783f921f186d1e619?s=60

Kelsey Flittner

What customers and developers think of IoT security



_**TL;DR**: Auth0 recently surveyed both developers and consumers and it turns out everyone has concerns over device and application security when it comes to the Internet of Things._

---------

While IoT is one of the world’s fastest growing technology sectors, it is also poised to become one of the fastest growing sources of security vulnerabilities for both consumers and enterprises. Here at Auth0, we were curious about both developer and consumer sentiment when it comes to the current state of IoT security, and what people think about the future (especially with the upcoming holiday season where folks are more likely to make bigger IoT purchases), so we decided to find out.

We started with consumers that were either familiar with or currently use an IoT connected device. When asked about IoT devices on the market right now, we found that **nearly 52 percent of consumers believe that these products do not have the necessary security in place**.

In a separate survey, we also polled our own network of subscribers (developers) to determine what they thought about the state of IoT security. **When asked if they’ve ever felt pressured to rush an application to market despite security concerns, over 85 percent of developers admitted that they had**.

With data breaches from major companies appearing constantly as headline news, we believe consumers are cognizant that security is a major issue, but they may not have insight into why that is. According to developers we surveyed, one reason for this is because IoT devices are often pushed to market too quickly, forcing developers to cut corners. If adding security components is resulting in a slower time-to-market, the chances are greater that they won’t be implemented at all. The best security measures are the ones you actually deploy, so simplicity in implementing strong security is critical (hint: ***Auth0*** can help with that 😉).

Developers echoed and amplified the consumer concern for better security, with **a majority 90 percent of respondents believing that the IoT devices on the market currently don’t have the necessary security in place**.

![Do you believe that IoT devices are secure?](https://images.ctfassets.net/23aumh6u8s0i/43Z5eryum1VacHZxnch7JM/b89916c018c26d4726c71bbd1bed9eab/do-you-believe-iot-devices-are-secure-2)

What’s most interesting, though, is that we found the concern over security isn’t stopping consumers. We found that **nearly half (49 percent) of respondents don’t trust having their personal and private data tied to IoT applications, but continue to use these devices nonetheless**. Consumers are aware of the general security vulnerabilities that have been associated with this category of products and applications, but are still willing to put their personal data at risk – showcasing how the demand for these technologies is compromising the need for proper security.

Interestingly, millennials (ages 18-34) were nearly split on future use, with **54 percent claiming that they did not plan to purchase or regularly use IoT devices within the next two years**. Participants aged 35-54 were slightly more skeptical, with **nearly 63 percent not interested in buying IoT devices over the next two years**.

Statistics like these would typically slow progress, innovation and growth in the IoT space, with consumers and developers hesitant to use and support these technologies due to the lack of security offered for their personal and private health, home and financial data. However, even the recent breaches that large companies have experienced (e.g., Chrysler, JP Morgan, Ashley Madison, Anthem Health, Target, Home Depot) have not had a massive impact on consumer trust or interest.

**Nearly 35 percent of consumer survey respondents claimed that the breaches of major brands have not had much of an effect on the trust or consumer interest in these brands.**

<include src="TweetQuote" quoteText="The best security measures are the ones you actually deploy"/>

As consumers continue to question the security of Internet of Things devices, developers and CIOs will need to find ways to simplify the implementation of strong identity security (hint: use ***Auth0***! 😉) and be well equipped to stay up to date on the latest security vulnerabilities - keeping their devices, applications and, ultimately, their consumer and enterprise data safe.

![Do you trust your personal data tied to an IoT device?](https://images.ctfassets.net/23aumh6u8s0i/4fzx4Tgxetbu1jwnrfcWET/239b94449039d867270a6cbe611aa7eb/do-you-trust-your-personal-data-to-iot-devices)

## Summary of results from the consumer and developer surveys:

- **52%** of respondents believe that most IoT devices on the market right now DO NOT have the necessary security in place
- **49%** of respondents don’t trust having their personal/private data tied to IoT devices – but still use them
- Only **18%** of people trust having their personal data tied to IoT devices
- **Nearly 35%** claimed that the breaches of major companies have not had much of an effect on the trust or consumer interest in these brands
- **85% of developers** surveyed have felt rushed to get an application to market due to demand/pressure in the last 6 months
- **90% of developers** surveyed do not believe that IoT devices on the market currently have the necessary security in place


"iot"