A look at the high-level considerations for controlling, metering and monitoring APIs from test through to production.

1. API Security and Management
Best Practices
K Scott Morrison
CTO & Chief Architect
Feb 26, 2012

2. Researchers have discovered
that the national divorce rate
has been falling since 2006…

3. 2007: 3.6 divorces per 1000 people
2008: 3.5 divorces per 1000 people
2009: 3.4 divorces per 1000 people
So, does this mean people are getting better at relationships?
Source: Slate http://slate.me/wGf9et

4. No.

5. It’s because of the recession.

6. APIs are like a
relationship

7. They require
^
maintenance.
very high
high

8. This talk is about how to
have a successful
API relationship.

9. Piece of Advice #1

10. Best Practice #1
It takes two to tango.

11. The Web wasn’t a
relationship

12. Successful
relationships
are built on
trust and
equality

13. Equal, but different

14. BP #2
Understand and
respect the cultural
differences.

15. Client Server

16. Inside Outside

17. Us Them

18. Contractor Regular

19. Partner
Contractor Regular

20. Partner
No Affiliation Regular

21. The New Identity Management
API Users API Developers
External Internal

22. APIs change composition
of internal teams
Product API
CFO
Manager Developer
Business Security
Manager Officer

23. BP #3
Memorize this
simple equation.

24. API Development !=
Web Development

25. Beware of habits

26. BP #4
Take security away
from developers.

27. Separation of
Concerns
API
Server
API
Expert
API
Proxy
Security
Expert

28. BP #5
Trust, but verify.

29. SQL Injection (courtesy
XKCD)
Exploits of a Mom
Source: https://xkcd.com/327/

31. BP #6
SSL everywhere.

32. It’s Cheap

33. BP #7
It’s still all about
access control.

34. But think hard
about tokens

35. BP #8
Don’t roll your own.

36. Security is hard
to get right

37. BP #9
Manage
misconfiguration risk
with appliances.

38. Protect the
Servers API
Client
Firewall
API
Proxy
DMZ
API
Server Secure
Zone Enterprise
Network

39. BP #10
Engage the developers.

40. The New Governance
Old New
Documentation WSDL Wiki/Blog
Discovery Reg/Rep Search
Approval G10 Platform Email
Enforcement Gateway Gateway
User Provisioning IAM Portal
Community What’s that? Forum

41. The Layer 7 API
Developer Portal
API
Client
Firewall
iPhone
API
Developer
Proxy
API API
Server Portal
Enterprise
Network

42. To Summarize:
 The game has changed
Clients need attention
 The security problems are the same
But the names have changed
 Don’t just build APIs
Build secure and managed APIs

43. Don’t Miss @RSA Conference
2012
 ASEC-402: Hacking’s Gilded Age: How APIs Will
Increase IT Risk
K. Scott Morrison
Friday, March 02 10:10 a.m.
Room 302
 STAR-402: Enterprise Access Control Patterns for
REST and Web API
Francois Lascelles
Friday, March 02 10:10 a.m.
Room 304
Yes, they are at the same time. You
must choose…

44. Picture Credits
 Antelope Canyon 4 by klsmith– stock.exchg
 Band silhouettes by mr_basmt– stock.exchg

45. For further information:
K. Scott Morrison
Chief Technology Officer & Chief Architect
Layer 7 Technologies
1100 Melville St, Suite 405
Vancouver, B.C. V6E 4A6
Canada
(800) 681-9377
smorrison@layer7tech.com
http://www.layer7tech.com
February 2012