Kondo-ing API Authorization
Download as PPTX, PDF0 likes212 views
The document discusses the challenges and complexities of API authorization, emphasizing the need for a 'tidying layer' to simplify management and enhance security. It highlights various data obstacles, the importance of fine-grained access control, and the implications of consumer data regulations. The proposal advocates for decoupling authorization from individual API implementations to better streamline security processes and protect user data.
![DECOUPLING AUTHZ FROM IMPLEMENTATION
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.18
Marie Kondo API
Layer
Driver/Obstacle Benefits (How it Helps)
1.
Fine-grained
authorization
policy engine
Diff layers of authz
decisions
Remove developers from managing authz at the individual API level, and remove
clients from filtering data themselves at the individual API level
Reduce top API
security risk
Centralize authorization decisions, regardless of authorization data sources, and re-
use authorization policies across multiple APIs
Privacy Preferences &
Consents
Policies can enable delegated consent to data access & preference lookups and
enforce data access decision based on customers’ wishes.
Consumer Data
Regulations
Policies can enforce compliance with new and changing consumer data protection
legislation; sometimes requiring consents.
Zero Trust Set up micro-segments of data, even down to the data attribute, to enable least
privilege access for sensitive data.
Securing APIs Check and enforce policies and customer consents for data being accessed by a
third party through a customer data API.
Data is detailed Enables granular, attribute-by-attribute access control capabilities
2.
GUI
Trust
Framework
Data is everywhere Real-time connections to policy attributes anywhere (e.g. risk scores)
[All Drivers] Need for ABAC & dynamic authorization
Policies
Many stakeholders Externalizes authorization to users for collaborative policy design
Reconciling reqs Lifts burden on developers, no need to reconcile or write code](https://image.slidesharecdn.com/lyle-nordicsapi2019-191106102050/85/Kondo-ing-API-Authorization-18-320.jpg)
Kondo-ing API Authorization
- 1. Kondo-ing API Authorization Remy Lyle OCT 2019 1 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.
- 2. HI! I’M REMY Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.2 • Global Tech Enablement Team @ Ping Identity • Denver, CO, USA • Convinced that APIs are the next frontier for identity and security • Marie Kondo is a personal hero
- 3. MARIE KONDO Tidying Expert, Bestselling Author, Netflix Hit Show Star NYTimes Best Selling Book, The Life Changing Magic of Tidying Up “Does it spark joy?” Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.3
- 4. BUT… FOR API AUTHORIZATIONS? 4 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved. https://www.wsj.com/articles/kondo-ing-a- guru-of-organizing-becomes-a-verb- 11547745648
- 5. ANATOMY OF AN API Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.5 JSON GET /getData
- 6. ANATOMY OF AN API Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.6 JSON GET /getData Scopes Identity Attributes Privacy Preferences User Consents Data Regulations Zero Trust
- 7. AND HOW MANY DO YOU HAVE? Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.7 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.7
- 8. FOUR DATA OBSTACLES Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.8 1. Data is detailed and complex. 2. It’s everywhere and accessed many ways. 3. Multiple stakeholders, moving targets and ever-changing landscape of data security policies and regulation 4. Data transactions are subjected to different layers of authorization decisions
- 9. THIS IS A REAL PROBLEM OWASP Top API Security Top 10 Risk Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.9 https://www.owasp.org/index.php/OWASP_API_Security_Project
- 10. WITH REAL-LIFE CONSEQUENCES In 2018, a research fellow with Mozilla Foundation scraped nearly 208 million transactions on peer-to-peer payment app Venmo revealing purchase profiles of its users In June 2019, another 7 million transactions were scraped using the company’s developer API over six months Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.10 Sources: https://www.darkreading.com/application-security/apis-get-their-own-top-10-security-list/d/d-id/1335786 https://22-8miles.com/public-by-default/ https://www.wired.com/story/i-scraped-millions-of-venmo-payments-your-data-is-at-risk/
- 11. WHO IS RESPONSIBLE? Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.11 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.11 DEVELOPERS? CLIENTS? X X
- 12. ENTER IN … A TIDYING LAYER Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.12 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.12
- 13. WHAT IF TIDYING WAS APPLIED Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.13 Scopes Identity Attr Privacy Preferences User Consents Data Regulations Zero Trust Business Defined Policies DEVELOPERS CLIENTS
- 14. WHAT IF YOU COULD PULL FROM ANY SOURCE Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved. 14 Scopes Identity Attr Privacy Preferences User Consents Data Regulations Zero Trust DBs Directory Other APIs Any state Any attribute Any authz data source
- 15. WHAT IF THE ARCHITECTS COULD WRITE THE POLICIES Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.15 Business-Derived Policies
- 16. WHAT IF ACCESS CONTROLS WERE APPLIED Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.16 Allow? Block? Filter? Obfuscate? CLIENTS FirstName LastName AccountNumber Balance FirstName LastName AccountNumber Balance OR …
- 17. DECOUPLING AUTHZ FROM IMPLEMENTATION Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.17 API Layer that enforces fine grained access control
- 18. DECOUPLING AUTHZ FROM IMPLEMENTATION Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.18 Marie Kondo API Layer Driver/Obstacle Benefits (How it Helps) 1. Fine-grained authorization policy engine Diff layers of authz decisions Remove developers from managing authz at the individual API level, and remove clients from filtering data themselves at the individual API level Reduce top API security risk Centralize authorization decisions, regardless of authorization data sources, and re- use authorization policies across multiple APIs Privacy Preferences & Consents Policies can enable delegated consent to data access & preference lookups and enforce data access decision based on customers’ wishes. Consumer Data Regulations Policies can enforce compliance with new and changing consumer data protection legislation; sometimes requiring consents. Zero Trust Set up micro-segments of data, even down to the data attribute, to enable least privilege access for sensitive data. Securing APIs Check and enforce policies and customer consents for data being accessed by a third party through a customer data API. Data is detailed Enables granular, attribute-by-attribute access control capabilities 2. GUI Trust Framework Data is everywhere Real-time connections to policy attributes anywhere (e.g. risk scores) [All Drivers] Need for ABAC & dynamic authorization Policies Many stakeholders Externalizes authorization to users for collaborative policy design Reconciling reqs Lifts burden on developers, no need to reconcile or write code
- 19. Does your API authorization model spark joy? 19 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.
- 20. PINGIDENTITY.COM 20 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.