innovate and integrate – modernising api security

Forum Systems | www.forumsys.com | 888.811.0060 | 199 Wells Ave., Suite 105, Newton, MA 02459

Innovate and IntegrateModernising API Security

Jason Macy, Chief Technology Officer


Discussion Points

• What is an API

• Data externalization and modernization

• Anatomy of API (information border) security

• Secure agility via architecture design


What is an API?


What is an API?

The ServiceMobile, B2B, Portal, Data …

(HTML, XML, SOAP, REST, JSON, …)

API is the access point (interface) to the service or data


APIs are Everywhere

APIsThe Integration Point of Innovation

Externalization Modernization

Cloud | Web ApplicationsExposed and consumed via standards-based technology for rapid integration and adoption

Mobile| AppsUse web services for calls to back-end servers delivering data and logic

Big Data| AnalysisBig data analytic engines expose and monetize results via APIs

Portals| UsersPersonalized experience, seamless and unified access to information resources


Externalization and Modernization

Open new channelsAnd new revenue

Deliver Integration and Service Maintain Security

Services and AssetsClients and Consumers

CreateConsumeInternal APIs

External APIs

• Integrate• Subscribe• Invoke

• Promote• Monitor• Secure


The Agility of API Abstraction

Mobile Device

Web Portal

B2B Partner

Cloud App

Web Site

Sat Link

Company Assets and Services


Anatomy of Modern API Security




Anatomy of Modern API Security

Threat Mitigation• Content-Aware (SOAP, REST, …)• Intrusion Detection and Prevention• Data Leakage • Embedded Malware

Transport Security• SSL/TLS• IP, Port, URL

Data Privacy• Content Encryption• Content Decryption

Attribute Based Access Control• Subject, Object, Environment

Role-Based Access Control• AuthN, AuthZ

Integrity and Trust • Digital Signature• Signature Verification• Schema Validation


Agile API Security – Decouple from Service




API Security Gateway







Role-Based Access Control

Threat Mitigation

Transport Security

Attribute-Based Access Control

Data Privacy

Integrity and Trust The Service

Mobile, B2B, Portal, Data …(HTML, XML, SOAP, REST, JSON, …)


Modernise the IT Security Architecture


WAF

IDS

SIEM

SOAVirtual ESBApps Portals

Endpoint Services and Data

Firewall

Mobile B2B Cloud / 3rd PartyBrowsers

Legacy IT Security Architecture


Firewall

WAF

IDS

SIEM

SOAVirtual ESBApps Portals

Internet / DMZ boundary DMZ / Extranet boundary DMZ / Intranet boundary Extranet / Intranet boundary Intranet / internal-enclave boundary


SECURITY• Protocol-Break Security• Deep Content-Inspection• Data Validation• Threat Analysis• Antivirus Scanning• Accelerated Cryptography

Endpoint Services and Data

IDENTITY• ABAC, RBAC, CBAC• SSO• Integrated SAML & OAuth

Mobile B2B Cloud / 3rd PartyBrowsers

The API Gateway Modern Architecture



Combining Security with Identity

ABAC, RBAC, CBAC


API Gateway – Centralized ABAC, RBAC, CBAC


SOA

Virtual

ESB

Apps

Portals

Publish APIs for Consumption



Content Inspection (CBAC)SOAP, XML, REST, JSON, HTML, URL

client

Virtual API(Protocol break)


SOA

Virtual

ESB

Apps

Portals


SOA

Virtual

ESB

Apps

Portals



client





ID Authentication, Authorization (Role-Based Access Control)OAuth, SAML, WS-Tokens, HTTP Form Post, HTTP Basic, HTTP Digest, NTLM, Kerberos, X509 Mutual, RSA SecureID

client



?#

!

EnvironmentConditions

Subject Attributes

Object Attributes

Attribute Analysis (ABAC)


SOA

Virtual

ESB

Apps

Portals


ID Authentication, Authorization (Role-Based Access Control)OAuth, SAML, WS-Tokens, HTTP Form Post, HTTP Basic, HTTP Digest, NTLM, Kerberos, X509 Mutual, RSA SecureID



client


?#

!

EnvironmentConditions

Subject Attributes

Object Attributes

Attribute Analysis (ABAC)


SOA

Virtual

ESB

Apps

Portals

Broker client request


Authorization (Response RBAC)• Correlate inbound identity with response information• Allow, Filter, or Reject

Deep Content Inspection (Response CBAC)• SOAP, XML, REST, JSON, HTML, URL

client

API Gateway – Centralized RBAC + CBAC + SSO


SOA

Virtual

ESB

Apps

Portals

Broker service response



Key Considerations


API Security Gateway – Key Considerations

Build vs Buy• Remove complexities of interoperability and leverage

purpose-built industry proven security over home-grown coded solutions

Flexible form factors• Virtual and physical to support deployment in any

computing environment

No Code SAML and OAuth• Legacy and modern system enablement of SAML and

OAuth SSO without writing a single line of code


API Security Gateway – Key Considerations

Vendor Agnostic• Enables technology choices that improve agility, rather

than stifle it

Standard-Based• Out of the box support for all modern industry protocol

and messaging standards (SOAP, XML, JSON, etc)

Edge Facing• API Security Gateway built on secure architecture

enables Tier 0 deployment to unify identity with security


Thank You

More Info:www.forumsys.com

innovate and integrate – modernising api security

Technology

api data externalization

data html

servicesforum systems

dataforum systems

monitor secureforum

unified access

servicethe servicemobile

access control subject