apidays LIVE New York - API Lifecycle Management - Avoiding Breaches By Securing the Development Process by Rod Cope
•Transferir como PPTX, PDF•
1 gostou•2,426 visualizações
The document discusses securing the API development lifecycle process. It describes how new APIs are originated through new business needs, applications, or customer requirements. It then discusses how the Akana API management platform addresses this issue through automated validation and approval workflows integrated with CI/CD pipelines. This ensures security policies are followed before APIs move from development to testing and production environments. It provides an example demo of how Akana enforces approval from solution architects before an API can be promoted between stages.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a apidays LIVE New York - API Lifecycle Management - Avoiding Breaches By Securing the Development Process by Rod Cope
Semelhante a apidays LIVE New York - API Lifecycle Management - Avoiding Breaches By Securing the Development Process by Rod Cope (20)
Mais de apidays
Mais de apidays (20)
Último
Último (20)
apidays LIVE New York - API Lifecycle Management - Avoiding Breaches By Securing the Development Process by Rod Cope
- 1. Akana by Perforce © 2019 Perforce Software, Inc. API Lifecycle Management AVOIDING BREACHES BY SECURING THE DEVELOPMENT PROCESS
- 2. akana.com2 | Akana by Perforce © 2020 Perforce Software, Inc. Overview Not only do you need to secure your APIs, you also need to secure the API lifecycle. Today’s discussion: • How new APIs originate • Securing the API development process • Structuring API delivery workflows • Integrating with CI/CD/DevOps for automation 45% of respondents aren’t confident in their security organization's ability to detect whether a bad actor is accessing their APIs. In fact, 51% aren't even confident their security team knows about all of the APIs that exist in the organization. - Ping Identity Survey
- 3. akana.com3 | Akana by Perforce © 2020 Perforce Software, Inc. Rod Cope CTO, Perforce Software • CTO for Rogue Wave Software (now Perforce) and the Founder and CTO of OpenLogic • 25+ year software career includes IBM, IBM Global Services, General Electric, and Anthem Blue Cross/Blue Shield. • Worldwide event speaker, including: APIdays, OSCON, Embedded World, ApacheCon, JavaOne, Strata/Big Data, LinuxCon, and API World.
- 4. How Do New APIs Originate?
- 5. akana.com5 | Akana by Perforce © 2020 Perforce Software, Inc. How Do New APIs Originate? • New business channels • New web/mobile applications • Customer needs
- 6. The Importance of a Security-First API Management Strategy (Or, Why “OK” Security Isn’t Good Enough)
- 7. akana.com7 | Akana by Perforce © 2020 Perforce Software, Inc. API Security Matters "Hackers Swipe Data On 2 Million T-Mobile Subscribers"… "Hackers managed to breach a database by exploiting a vulnerable API..." "Salesforce Security Alert: API Error Exposed Marketing Data" "2018 Sees API Breaches Surge With No Relief in Sight" "Fitness app Strava showed the world how even seemingly innocuous APIs can have damaging consequences when not securely designed." "Google announced that an additional bug in a Google+ API had exposed user data from 52.5 million accounts."
- 8. akana.com8 | Akana by Perforce © 2020 Perforce Software, Inc. Setting the Stage for Disruption
- 9. How do you prevent rogue services from getting deployed? How do you secure processes? How do you integrate with CI/CD?
- 10. akana.com10 | Akana by Perforce © 2020 Perforce Software, Inc. Akana API Lifecycle Management
- 11. akana.com11 | Akana by Perforce © 2020 Perforce Software, Inc. Lifecycle Management Components Lifecycle Manager • Automate machine and role-based validations and signoffs across the software development lifecycle. Lifecycle Coordinator • Automated API configuration and promotion through runtime staging environments. • Eliminate hands-on actions as much as possible. Lifecycle Repository • Add extensible metadata for APIs, apps, and users
- 12. akana.com12 | Akana by Perforce © 2020 Perforce Software, Inc. API Lifecycle Review/Approval Process REQUIREMENTS DESIGN DEVELOP API CREATION PROCESS – DEMO SCENARIO Developer Submitter Lifecycle Manager Automation Architect Approver Lifecycle Manager Automation API Submitted API Updated and Submitted API Updated and Submitted Process API Process API Architect Approved? API Published API Not Published API Published API Not Published API Published API Not Published Yes YesNoNo YesNo Architect Approved? Architect Approved?
- 13. akana.com13 | Akana by Perforce © 2020 Perforce Software, Inc. promote promote promote Akana and CI/CD Lifecycle Coordinator API Platform Dev API Platform Test API Platform Staging API Platform Production CI/CD Platform (e.g., Jenkins) DevOps Stakeholder Dev CI/CD
- 14. akana.com14 | Akana by Perforce © 2020 Perforce Software, Inc. Secure Cloud Architecture PRODUCTION STAGING DEVELOPMENT TEST
- 15. akana.com15 | Akana by Perforce © 2020 Perforce Software, Inc. How Akana Fits Into Your Existing Architecture DEVELOPER SERVICES MGMT. SERVICES SECURITY SERVICES ANALYTICS SERVICES
- 16. akana.com16 | Akana by Perforce © 2020 Perforce Software, Inc. Key API Security Policy Examples Protect against vulnerabilities presented in OWASP API Security Top 10, such as: • Broken Object Level Authorization • Broken Authentication • Lack of Resources and Rate Limiting • Broken Function Level Authorization • Improper Assets Management
- 17. akana.com17 | Akana by Perforce © 2020 Perforce Software, Inc. Security Policy Example - Malicious Pattern Detection • Inspects HTTP for dangerous content • If dangerous, rejects and returns a fault
- 18. What Does Security-First Lifecycle Management Look Like?
- 19. akana.com19 | Akana by Perforce © 2020 Perforce Software, Inc. Demo Scenario • Three stage environment – Dev, Test, and Acc (Staging) • Solution Architect approval required to exit Dev • Enterprise Architect and IT Security notified for optional comment • Solution Architect approval required to promote from Test to Acc • API Owner initiates minor version (non-breaking) update to promoted API from Dev portal
- 20. akana.com20 | Akana by Perforce © 2020 Perforce Software, Inc. 1 - API in Dev with Metadata (Tags)
- 21. akana.com21 | Akana by Perforce © 2020 Perforce Software, Inc. 2 - API Owner Requests Dev Approval
- 22. akana.com22 | Akana by Perforce © 2020 Perforce Software, Inc. 3 - Solution Architect Approves API
- 23. akana.com23 | Akana by Perforce © 2020 Perforce Software, Inc. 4 - Workflow Initiates Auto-Promotion
- 24. akana.com24 | Akana by Perforce © 2020 Perforce Software, Inc. 5 - API Promoted to Test
- 25. akana.com25 | Akana by Perforce © 2020 Perforce Software, Inc. 6 - API Promotion to Acc Pending
- 26. akana.com26 | Akana by Perforce © 2020 Perforce Software, Inc. 7 - Solution Architect Approves API
- 27. akana.com27 | Akana by Perforce © 2020 Perforce Software, Inc. 8 - API Promoted to Acc (Staging)
- 28. akana.com28 | Akana by Perforce © 2020 Perforce Software, Inc. 9 - API Status in Dev Tenant Auto-Updated
- 29. akana.com29 | Akana by Perforce © 2020 Perforce Software, Inc. 10 - API Owner Initiates Reversion for Minor Version Update
- 30. akana.com30 | Akana by Perforce © 2020 Perforce Software, Inc. Regardless of your size, you still have the same tech requirements. The new Akana SaaS Club gives you our full-featured enterprise API management solution – without the investment or implementation time. QuickStart packages are right-sized to your needs. As you grow, we’ll grow with you! Get started with Akana API Management faster and more affordably than ever before. Akana QuickStart S U G G E S T E D P A C K A G E : 250 Gb/month Total bandwidth in/out of the gateway Learn more at akana.com/akana-quickstart
- 31. Q&A
Notas do Editor
- Abstract: In the race to unlock new business channels and create more value, there is always a push to develop new APIs. But how do they get from idea to value? And how do you ensure that they are developed not only swiftly, but securely? Strict top-down control destroys speed, but no governance puts you at major risk of regulatory and compliance violations. Any phase of your API lifecycle - from strategy and design to deployment and optimization – can be the source of vulnerabilities that enable malicious attacks and allow unauthorized access, unapproved APIs, and exposed data. In this webinar, we explore the API development process: where it originates, how to secure it, and how to maximize automation while preserving developer creativity and speed. Join Rod Cope, CTO of Perforce Software, and guest speaker Randy Heffner, VP and Principal Analyst from Forrester Research, Inc., as they discuss: How new APIs originate from new business channels and new web and mobile applications Infusing security throughout the API development process Structuring API delivery workflows to both meet compliance demands and speed development Integrating with CI/CD/DevOps to automate and harden the API lifecycle
- Development Governance - ensure you aren't building same functionality multiple times - ties into Portal capabilities, approval processes - Akana can do it and very few others can - authentication, proxying, having a gateway, rate limiting - automating - not leaving a chance that a policy is not applied, not attaching the right policy, ability to attach policies to meta data Can your API platform really do all of this?
- Lifecycle Coordinator highlights: Objective: automated API configuration and promotion through runtime staging environments – eliminate hands-on actions as much as possible and by doing so gain efficiency and reduce potential for error Automated API configuration - API architects can easily define configuration patterns to be automatically applied via extended metadata values Auditable promotion records – Lifecycle Coordinator records all API promotion activities across multiple iterations with full visibility to configuration changes between staging environments Configurable role-based gating – enterprises can easily specify RACI (Responsible/Approver/Commenter/Informed) roles into promotion workflows; these become part of the audit record Integration with CI/CD platforms (e.g., Jenkins) – Lifecycle Coordinator can act as either a master or a slave within an enterprise’s CI/CD architecture When you promote from Dev to Production, can change OAuth domain The keys are: Configurable role-based gating (make gating more generic) RACI - broken down into roles that people have in any governance process -- who is responsible for promoting something into next environment, who approved that, who comments on it / reviews it, who needs to be informed of it -- all of this concept is built into the Akana platform
- This is just a sample – not fixed -- there can be as many tasks/approvals as you want.
- Promotions are being initiated and governed by the Lifecycle Manager, which drives approvals. In each Promotion (gray arrows), you can change appropriate policies for each instance, and change Oauth domains in each stage.
- We typically position this architecture to those who want to be PCI compliant or have a little more security than they are currently doing – i.e. “you need to be doing AT LEAST this much” Advantage of Akana – Lifecycle Manager (pink box) -- managing review/approval side of things before production, so the managers get a notice of a request to do this promotion, and it must be approved before a change is made. Not just about encryption, also about process and architecture.
- Customer wrapped in Akana’s architecture We add gateways on top of interaction layer, add a developer portal, add these security/management services along with our Oauth server, etc.
- The HTTP Malicious Pattern Detection Policy is used to inspect HTTP messages for content that could be considered dangerous to an API or web service. This policy can be attached based on the metadata (previous slide) If the message content matches any of the expressions identified in the policy as potentially dangerous, the policy rejects the message and returns a fault. This policy uses regular expressions to define the content that could be considered dangerous, that would warrant a message being rejected. Typical uses of this policy are for SQL injection detection or JavaScript detection. You don’t need to order your policies, like with other platforms.
- Note: change “Asset Submission” to “API submission” if possible
- Same slide title at step #3. Are they both correct?