<commit_before>---
layout: post
title: "Security vs. Convenience"
description: "Auth0 CISO Joan Pepin explains how making security easier makes things safer for users, but requires more planning from engineers to render security seamless."
longdescription: "Everybody used to believe that to be secure, something couldn’t be convenient. Making access hard kept info safe. Auth0 Ciso Joan Pepin explains how security experts have failed users by making passwords too complex. Turns out convenience can make things much safer, but it requires more planning from engineers."
date: 2018-03-28 8:30
category: Security
is_non-tech: true
banner:
  text: "Auth0 makes it easy to add authentication to your application."
author:
  name: "<NAME>"
  url: "https://twitter.com/cloudciso_joan"
  mail: "<EMAIL>"
  avatar: "https://cdn.auth0.com/blog/meltdown-spectre/joanpepin.jpg"
design:
  image: 
  bg_color: ""
tags:
- password
- security
- cybersecurity
- multifactor-authentication
- nist
related:
- 
-
---

## Security vs. Convenience: To truly keep info safe you need to pull off both — here’s the why and the how

In the security industry, everybody used to believe that to be secure, something couldn’t be convenient. Security and convenience functioned only in opposition. Making access hard was the best way to keep info safe.

But then we ran up against the human factor.

Since the first password breach — only a year after passwords were invented — we’ve been looking for ways to make passwords safer. First, we made them harder. Which means we added increasing levels of complexity to the the string of characters that served as an access key and made things even worse by demanding that passwords be changed at regular intervals. 
This gave birth to the password on a Post-It Note that gets put up right beside the monitor. 

For people who don’t want Post-Its everywhere, Amazon now sells a password diary. My review, which pointed out the security risks of this product, was voted “unhelpful” by 300 people. Apparently, many silent others disagreed with me. Amazon now carries multiple versions of the password diary, each of them with positive reviews in the hundreds.

{% include tweet_quote.html quote_text="@Auth0 <NAME> explains how making security easier makes it safer. @CloudCISO_Joan" %}

## The Argument for Easy

The proliferation of password diaries on Amazon is an understandable (if unwise) response to a technology landscape that is getting more diverse and more complicated daily. Consumers are demanding more customization and employees want the same kind of experience that they have on their consumer devices. We now have non-technical people accustomed to accessing very technical services throughout the course of their day — and they don’t want to remember five or more different passwords to get everything done.

Security teams can create systems and protocols — that’s a large part of what I do as Auth0’s CISO — but none of this keeps anything safe if people won’t use the systems as intended. So, if we know they are going to go around the procedures and protocols, why not make it easier for them to comply?

## NIST Simplifies Password Guidelines

After watching people try to respond to tortuously complex password requirements, NIST (the National Institute of Standards and Technology) revised [guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) last summer. As a non-regulatory division of the U.S. Dept. of Commerce, NIST only has power over standards for federal sites in the United States, but it exerts deep influence on corporate standards everywhere. Companies often use NIST as a basis for their own policies.

So NIST’s new take to digital identity offered a host of guidelines, including the recommendation to only change your password if you believe you’ve been compromised.
<commit_msg>Added design, related articles<commit_after>---
layout: post
title: "Security vs. Convenience"
description: "Auth0 CISO Joan Pepin explains how making security easier makes things safer for users, but requires more planning from engineers to render security seamless."
longdescription: "Everybody used to believe that to be secure, something couldn’t be convenient. Making access hard kept info safe. Auth0 Ciso Joan Pepin explains how security experts have failed users by making passwords too complex. Turns out convenience can make things much safer, but it requires more planning from engineers."
date: 2018-03-28 8:30
category: Growth, Security
is_non-tech: true
banner:
  text: "Auth0 makes it easy to add authentication to your application."
author:
  name: "<NAME>"
  url: "https://twitter.com/cloudciso_joan"
  mail: "<EMAIL>"
  avatar: "https://cdn.auth0.com/blog/meltdown-spectre/joanpepin.jpg"
design:
  image: https://cdn.auth0.com/blog/security-vs-convenience/logo.png
  bg_color: "#7B6C23"
tags:
- password
- security
- cybersecurity
- multifactor-authentication
- nist
related:
- 2018-02-14-what-is-data-security
- 2018-03-16-identity-as-a-service-in-2018
- 2018-01-26-security-predictions-for-2018-that-go-beyond-gdpr-compliance
---

## Security vs. Convenience: To truly keep info safe you need to pull off both — here’s the why and the how

In the security industry, everybody used to believe that to be secure, something couldn’t be convenient. Security and convenience functioned only in opposition. Making access hard was the best way to keep info safe.

But then we ran up against the human factor.

Since the first password breach — only a year after passwords were invented — we’ve been looking for ways to make passwords safer. First, we made them harder. Which means we added increasing levels of complexity to the the string of characters that served as an access key and made things even worse by demanding that passwords be changed at regular intervals. 
This gave birth to the password on a Post-It Note that gets put up right beside the monitor. 

For people who don’t want Post-Its everywhere, Amazon now sells a password diary. My review, which pointed out the security risks of this product, was voted “unhelpful” by 300 people. Apparently, many silent others disagreed with me. Amazon now carries multiple versions of the password diary, each of them with positive reviews in the hundreds.

{% include tweet_quote.html quote_text="@Auth0 <NAME> explains how making security easier makes it safer. @CloudCISO_Joan" %}

## The Argument for Easy

The proliferation of password diaries on Amazon is an understandable (if unwise) response to a technology landscape that is getting more diverse and more complicated daily. Consumers are demanding more customization and employees want the same kind of experience that they have on their consumer devices. We now have non-technical people accustomed to accessing very technical services throughout the course of their day — and they don’t want to remember five or more different passwords to get everything done.

Security teams can create systems and protocols — that’s a large part of what I do as Auth0’s CISO — but none of this keeps anything safe if people won’t use the systems as intended. So, if we know they are going to go around the procedures and protocols, why not make it easier for them to comply?

## NIST Simplifies Password Guidelines

After watching people try to respond to tortuously complex password requirements, NIST (the National Institute of Standards and Technology) revised [guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) last summer. As a non-regulatory division of the U.S. Dept. of Commerce, NIST only has power over standards for federal sites in the United States, but it exerts deep influence on corporate standards everywhere. Companies often use NIST as a basis for their own policies.

So NIST’s new take to digital identity offered a host of guidelines, including the recommendation to only change your password if you believe you’ve been compromised.

{'fraction_non_alphanumeric': 0.05293527345709985, 'fraction_numerical': 0.009909683893627697, 'mean_word_length': 4.5755244755244755, 'pattern_counts': {'":': 0, '<': 9, '<?xml version=': 0, '>': 9, 'https://': 7, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3742960', 'n_tokens_mistral': 2038, 'n_tokens_neox': 1906, 'n_words': 1147}