API Security and Management Best Practices
Download as PPTX, PDF5 likes4,530 views
The document discusses best practices for API security and management, emphasizing the importance of trust, equality, and cultural understanding between API users and developers. It outlines multiple key practices such as separating security roles, utilizing SSL, and managing access control to mitigate security risks. The document also highlights the evolving landscape of APIs and the need for secure and well-managed API development.
API Security and Management Best Practices
- 1. API Security and Management Best Practices K Scott Morrison CTO & Chief Architect Feb 26, 2012
- 2. Researchers have discovered that the national divorce rate has been falling since 2006…
- 3. 2007: 3.6 divorces per 1000 people 2008: 3.5 divorces per 1000 people 2009: 3.4 divorces per 1000 people So, does this mean people are getting better at relationships? Source: Slate http://slate.me/wGf9et
- 4. No.
- 5. It’s because of the recession.
- 6. APIs are like a relationship
- 7. They require ^ maintenance. very high high
- 8. This talk is about how to have a successful API relationship.
- 9. Piece of Advice #1
- 10. Best Practice #1 It takes two to tango.
- 11. The Web wasn’t a relationship
- 12. Successful relationships are built on trust and equality
- 14. BP #2 Understand and respect the cultural differences.
- 15. Client Server
- 16. Inside Outside
- 17. Us Them
- 18. Contractor Regular
- 19. Partner Contractor Regular
- 20. Partner No Affiliation Regular
- 21. The New Identity Management API Users API Developers External Internal
- 22. APIs change composition of internal teams Product API CFO Manager Developer Business Security Manager Officer
- 23. BP #3 Memorize this simple equation.
- 24. API Development != Web Development
- 25. Beware of habits
- 26. BP #4 Take security away from developers.
- 27. Separation of Concerns API Server API Expert API Proxy Security Expert
- 28. BP #5 Trust, but verify.
- 29. SQL Injection (courtesy XKCD) Exploits of a Mom Source: https://xkcd.com/327/
- 31. BP #6 SSL everywhere.
- 32. It’s Cheap
- 33. BP #7 It’s still all about access control.
- 34. But think hard about tokens
- 35. BP #8 Don’t roll your own.
- 36. Security is hard to get right
- 37. BP #9 Manage misconfiguration risk with appliances.
- 38. Protect the Servers API Client Firewall API Proxy DMZ API Server Secure Zone Enterprise Network
- 39. BP #10 Engage the developers.
- 40. The New Governance Old New Documentation WSDL Wiki/Blog Discovery Reg/Rep Search Approval G10 Platform Email Enforcement Gateway Gateway User Provisioning IAM Portal Community What’s that? Forum
- 41. The Layer 7 API Developer Portal API Client Firewall iPhone API Developer Proxy API API Server Portal Enterprise Network
- 42. To Summarize: The game has changed Clients need attention The security problems are the same But the names have changed Don’t just build APIs Build secure and managed APIs
- 43. Don’t Miss @RSA Conference 2012 ASEC-402: Hacking’s Gilded Age: How APIs Will Increase IT Risk K. Scott Morrison Friday, March 02 10:10 a.m. Room 302 STAR-402: Enterprise Access Control Patterns for REST and Web API Francois Lascelles Friday, March 02 10:10 a.m. Room 304 Yes, they are at the same time. You must choose…
- 44. Picture Credits Antelope Canyon 4 by klsmith– stock.exchg Band silhouettes by mr_basmt– stock.exchg
- 45. For further information: K. Scott Morrison Chief Technology Officer & Chief Architect Layer 7 Technologies 1100 Melville St, Suite 405 Vancouver, B.C. V6E 4A6 Canada (800) 681-9377 [email protected] http://www.layer7tech.com February 2012
Editor's Notes
- #3: Everyone here needs to choose.Ignore the middle groundAre you fearfulOr are you confident?
- #5: Everyone here needs to choose.Ignore the middle groundAre you fearfulOr are you confident?
- #6: Everyone here needs to choose.Ignore the middle groundAre you fearfulOr are you confident?
- #26: Token protection, SSL, etc.
- #39: The new enterprise web is about integration
- #42: The new enterprise web is about integration