NYC Identity Summit Tech Day: Best Practices for API Security
Download as PPTX, PDF1 like302 views
The document discusses best practices for API security, including using OAuth2 tokens that are issued and managed centrally, protecting communications with TLS, throttling incoming traffic to APIs, enforcing centralized policies at an enforcement point, and monitoring and auditing APIs. It provides ForgeRock Identity Gateway as an example of a solution that implements these practices.
NYC Identity Summit Tech Day: Best Practices for API Security
- 1. © 2016 ForgeRock. All rights reserved. Best Practices for API Security Ludovic Poitou, Product Management Director
- 2. © 2016 ForgeRock. All rights reserved. API Security ?
- 3. © 2016 ForgeRock. All rights reserved. API Security
- 4. © 2016 ForgeRock. All rights reserved. Example: ForgeRock Identity Gateway APIs ForgeRock Access Management Throttling Authorization
- 5. © 2016 ForgeRock. All rights reserved. API Key • Use OAuth2 Tokens • Issued & managed centrally • Standard based • Access tokens are short-lived and revocable • Scopes for finer permissions
- 6. © 2016 ForgeRock. All rights reserved. Protecting against Disclosure • Secure End to End • Between Client and Gateway • Between Gateway and API • TLS • Certificate based Authentication
- 7. © 2016 ForgeRock. All rights reserved. Protect Against Misuse and DOS • Throttle the incoming traffic • Overall • Per API • Per Client • Also a monetization strategy! https://www.flickr.com/photos/telstar/
- 8. © 2016 ForgeRock. All rights reserved. Policy Decision and Enforcement Point • Centralized policy management • Introspect Token • Call ForgeRock Access Management PDP • Border enforcement • Specific rules and conditions • Not Found vs Forbidden https://www.flickr.com/photos/yannickgar/
- 9. © 2016 ForgeRock. All rights reserved. Monitoring and Auditing • Monitoring • Status • Throughput and Response Times statistics • Auditing • Logs • Reporting • Billing
- 10. © 2016 ForgeRock. All rights reserved. Summary
- 11. © 2016 ForgeRock. All rights reserved. Throttling Message Transformation Monitoring Session Management Token Exchange SSO Scripting Relying Party Authentication Authorization Federation (SAML / OIDC) Password Capture & Replay Protected Resources Identity Providers Data Stores Web Applications APIs Services Layer Access Layer HTTP / HTTPS OAuth2.0 | OpenID Connect | SAMLv2 External Layer Databases Directories Files Audit ForgeRock Identity Platform: Identity Gateway
- 12. © 2016 ForgeRock. All rights reserved. 12
- 13. © 2016 ForgeRock. All rights reserved. Best Practices for API Security Ludovic Poitou – Product Management Director Ludovic.Poitou@ForgeRock.com @ludomp