SlideShare a Scribd company logo
Reinforcing Your Enterprise With
Security Architectures
S.Uthaiyashankar
VP Engineering, WSO2
shankar@wso2.com
The Problem

‱ Security is a non-functional requirements
‱ Very easy to make security holes
‱ Knowledge on security is less
– Often people feel secure through obscurity
‱ Too much of security will reduce usability
‱ Security Patterns might help to reduce the risk
Image Source: http://cdn.c.photoshelter.com/img-get/I0000WglLK9YvkQM/s/750/750/gmat-matyasi-14.jpg
Security
‱ Authentication
‱ Authorization
‱ Confidentiality
‱ Integrity
‱ Non-repudiation
‱ Auditing
‱ Availability
Image source: http://coranet.com/images/network-security.png
Authentication
‱ Direct Authentication
– Basic Authentication
– Digest Authentication
– TLS Mutual Authentication
– OAuth : Client Credentials
Service Providers
Authentication
Service Consumption
Image Source : http://www.densodynamics.com/wp-content/uploads/2016/01/gandalf.jpg
Authentication
‱ Brokered Authentication
– SAML
– OAuth : SAML2/JWT grant type
– OpenID
Service Providers
Service Providers
Service Providers
Identity Provider
Service Providers
Authentication
Service Consumption
Trust
Image source: http://savepic.ru/6463149.gif
Authentication
‱ Single Sign On
‱ Multi-factor Authentication
Service Providers
Service Providers
Service Providers
Identity Provider
Service Providers
Authentication
Service Consumption
Trust
Image source : https://upload.wikimedia.org/wikipedia/commons/e/ef/CryptoCard_two_factor.jpg
Authentication
‱ Identity Federation Pattern and Token Exchange
Authentication
‱ Identity Federation Pattern and Token Exchange
Authentication
‱ Identity Bus
Authentication
‱ Trusted Subsystem Pattern
Source: https://i-msdn.sec.s-msft.com/dynimg/IC2296.gif
Authentication
‱ Multiple User stores
Image Source: https://malalanayake.files.wordpress.com/2013/01/multiple-user-stores1.png?w=645&h=385
Provisioning
Authorization
‱ Principle of Least Privilege
‱ Role based Access Control
‱ Attribute based Access Control
– Policy based Access Control
Image source : http://cdn.meme.am/instances/500x/48651236.jpg
Authorization
‱ eXtensible Access Control Markup Language (XACML)
Image Source : https://nadeesha678.wordpress.com/2015/09/29/xacml-reference-architecture/
Confidentiality : Encryption
Transport Level Security vs
Message Level Security
‱ Transport Level
‱ Message Level
‱ Symmetric Encryption
‱ Asymmetric Encryption
‱ Session key based Encryption
Image Source: http://www.thetimes.co.uk/tto/multimedia/archive/00727/cartoon-web_727821c.jpg
Integrity : Digital Signatures
‱ Transport Level
‱ Message Level
‱ Symmetric Signature
‱ Asymmetric Signature
‱ Session key based Signature
Image Source : http://memegenerator.net/instance2/4350097
Non-repudiation: Digital Signatures
‱ Message Level
‱ Asymmetric Signature
Image Source: http://www.demotivation.us/media/demotivators/demotivation.us_DENIAL-What-ever-it-is...-I-DIDNT-DO-IT_133423312332.jpg
Auditing
‱ However secure you are,
people might make mistake
‱ Collect the (audit) logs and
analyze for
– Anomaly
– Fraud
Source: https://745515a37222097b0902-74ef300a2b2b2d9e236c9459912aaf20.ssl.cf2.rackcdn.com/f33df70e3ffd92d1f68827dd559aa82c.jpeg
Availability
‱ Network Level Measures
‱ Throttling
‱ Heart beat and hot pooling
Image Source: https://www.corero.com/img/blog/thumb/62327%207%20365.jpg
Secure Deployment Pattern
Red Zone (Internet)
Firewall
Yellow Zone (DMZ)
Firewall
Green Zone (Internal)
Services, Database
API Gateway, Integration
Client Application
Secure Deployment Pattern : More restricted
Red Zone (Internet)
Firewall
Yellow Zone (DMZ)
Firewall
Green Zone (Internal)
Services, Database
API Gateway, Integration, Message Broker
Client Application
Thank You

More Related Content

PPTX
Planning Your Cloud Strategy
PPTX
Identity and Access Management in the Era of Digital Transformation
PPTX
Federated and fabulous identity
PPTX
IoT mobile app device cloud identity and security architecture
PPTX
IAM Cloud
PPTX
Wif and sl4 (en)
PPTX
The lazy programmer`s way to secure application
PPTX
Trust, Blockchains, and Self-Soveriegn Identity
Planning Your Cloud Strategy
Identity and Access Management in the Era of Digital Transformation
Federated and fabulous identity
IoT mobile app device cloud identity and security architecture
IAM Cloud
Wif and sl4 (en)
The lazy programmer`s way to secure application
Trust, Blockchains, and Self-Soveriegn Identity

What's hot (20)

PDF
Solving problems with authentication
PDF
IT-Security@Contemporary Life
PPTX
Identity Management
PPTX
20150924 Xylos Technology Day - Stay in control of your identity with Azure A...
PDF
Security Considerations for Microservices and Multi cloud
PPTX
Kerberos-PKI-Federated identity
PPTX
Azure active directory
PPTX
Core defense mechanisms against security attacks on web applications
PDF
About Microservices
PDF
Road to Microservices
PDF
Enterprise Collaboration - 4
PDF
Understanding Claim based Authentication
PPTX
SharePoint 2010 Extranets and Authentication: How will SharePoint 2010 connec...
PPT
Authentication Technologies
PDF
Citirx Day 2013: Citrix Enterprise Mobility
PDF
SwellRT: Facilitating decentralized real-time collaboration
PPTX
Securing Access Through a Multi-Purpose Credential and Digital ID
PDF
Duo MFA integration with CoinJar Bitcoin Wallet
PDF
Claim based authentaication
Solving problems with authentication
IT-Security@Contemporary Life
Identity Management
20150924 Xylos Technology Day - Stay in control of your identity with Azure A...
Security Considerations for Microservices and Multi cloud
Kerberos-PKI-Federated identity
Azure active directory
Core defense mechanisms against security attacks on web applications
About Microservices
Road to Microservices
Enterprise Collaboration - 4
Understanding Claim based Authentication
SharePoint 2010 Extranets and Authentication: How will SharePoint 2010 connec...
Authentication Technologies
Citirx Day 2013: Citrix Enterprise Mobility
SwellRT: Facilitating decentralized real-time collaboration
Securing Access Through a Multi-Purpose Credential and Digital ID
Duo MFA integration with CoinJar Bitcoin Wallet
Claim based authentaication
Ad

Viewers also liked (11)

PDF
CIS14: Are the Enterprises Ready for Identity of Everything?
PDF
CIS14: Developing with OAuth and OIDC Connect
PDF
WSO2Con 2013 - WSO2 as a Crypto Platform
PDF
OAuth 2.0 Token Exchange: An STS for the REST of Us
PPTX
Building IAM for OpenStack
PPTX
Ldap intro
PDF
Authorization and Authentication in Microservice Environments
PDF
Introduction to LDAP and Directory Services
PDF
SAML / OpenID Connect / OAuth / SCIM æŠ€èĄ“è§ŁèȘŹ - ID&IT 2014 #idit2014
PPTX
Identity and Access Management - RSA 2017 Security Foundations Seminar
PDF
Visual Design with Data
CIS14: Are the Enterprises Ready for Identity of Everything?
CIS14: Developing with OAuth and OIDC Connect
WSO2Con 2013 - WSO2 as a Crypto Platform
OAuth 2.0 Token Exchange: An STS for the REST of Us
Building IAM for OpenStack
Ldap intro
Authorization and Authentication in Microservice Environments
Introduction to LDAP and Directory Services
SAML / OpenID Connect / OAuth / SCIM æŠ€èĄ“è§ŁèȘŹ - ID&IT 2014 #idit2014
Identity and Access Management - RSA 2017 Security Foundations Seminar
Visual Design with Data
Ad

Similar to Reinforcing Your Enterprise With Security Architectures (20)

PDF
WSO2Con ASIA 2016: Reinforcing Your Enterprise With Security Architectures
 
PDF
Making Security Approachable for Developers and Operators
PDF
Cybersecurity_Security_architecture_2023.pdf
PDF
Governance and Security Solution Patterns
 
PPT
Security patterns and model driven architecture
PDF
Security Patterns for Software Development
PDF
Zero Trust Networks Evan Gilman Doug Barth
PDF
Zero Trust Networks Evan Gilman Doug Barth
PDF
network security.pdf
PDF
CyberSecurity101.pdf
PPTX
Week Topic Code Access vs Event Based.pptx
PDF
Network Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. IT
PPT
Intro-2013.pptIntro-2013.pptIntro-2013.ppt
PDF
20071015 Architecting Enterprise Security
PPT
Unit_5 grid and cloud comuting security.pt
 
PPT
ch01.ppt
PPTX
SC-900 Concepts of Security, Compliance, and Identity
PPTX
Architecting for Security Resilience
PDF
Designing Security Architecture Solutions 1st Edition Jay Ramachandran
WSO2Con ASIA 2016: Reinforcing Your Enterprise With Security Architectures
 
Making Security Approachable for Developers and Operators
Cybersecurity_Security_architecture_2023.pdf
Governance and Security Solution Patterns
 
Security patterns and model driven architecture
Security Patterns for Software Development
Zero Trust Networks Evan Gilman Doug Barth
Zero Trust Networks Evan Gilman Doug Barth
network security.pdf
CyberSecurity101.pdf
Week Topic Code Access vs Event Based.pptx
Network Security and Cyber Laws (Complete Notes) for B.Tech/BCA/BSc. IT
Intro-2013.pptIntro-2013.pptIntro-2013.ppt
20071015 Architecting Enterprise Security
Unit_5 grid and cloud comuting security.pt
 
ch01.ppt
SC-900 Concepts of Security, Compliance, and Identity
Architecting for Security Resilience
Designing Security Architecture Solutions 1st Edition Jay Ramachandran

Recently uploaded (20)

PDF
Design an Analysis of Algorithms II-SECS-1021-03
PDF
Wondershare Filmora 15 Crack With Activation Key [2025
PPTX
Introduction to Artificial Intelligence
PPTX
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
PDF
AI in Product Development-omnex systems
PPTX
VVF-Customer-Presentation2025-Ver1.9.pptx
PDF
Internet Downloader Manager (IDM) Crack 6.42 Build 41
PDF
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
PDF
Flood Susceptibility Mapping Using Image-Based 2D-CNN Deep Learnin. Overview ...
PDF
Softaken Excel to vCard Converter Software.pdf
PPTX
L1 - Introduction to python Backend.pptx
PDF
System and Network Administraation Chapter 3
PPT
Introduction Database Management System for Course Database
PDF
How to Choose the Right IT Partner for Your Business in Malaysia
PPTX
ai tools demonstartion for schools and inter college
PDF
Design an Analysis of Algorithms I-SECS-1021-03
PPTX
CHAPTER 2 - PM Management and IT Context
PPTX
CHAPTER 12 - CYBER SECURITY AND FUTURE SKILLS (1) (1).pptx
PPTX
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
PDF
Raksha Bandhan Grocery Pricing Trends in India 2025.pdf
Design an Analysis of Algorithms II-SECS-1021-03
Wondershare Filmora 15 Crack With Activation Key [2025
Introduction to Artificial Intelligence
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
AI in Product Development-omnex systems
VVF-Customer-Presentation2025-Ver1.9.pptx
Internet Downloader Manager (IDM) Crack 6.42 Build 41
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Flood Susceptibility Mapping Using Image-Based 2D-CNN Deep Learnin. Overview ...
Softaken Excel to vCard Converter Software.pdf
L1 - Introduction to python Backend.pptx
System and Network Administraation Chapter 3
Introduction Database Management System for Course Database
How to Choose the Right IT Partner for Your Business in Malaysia
ai tools demonstartion for schools and inter college
Design an Analysis of Algorithms I-SECS-1021-03
CHAPTER 2 - PM Management and IT Context
CHAPTER 12 - CYBER SECURITY AND FUTURE SKILLS (1) (1).pptx
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
Raksha Bandhan Grocery Pricing Trends in India 2025.pdf

Reinforcing Your Enterprise With Security Architectures

  • 1. Reinforcing Your Enterprise With Security Architectures S.Uthaiyashankar VP Engineering, WSO2 shankar@wso2.com
  • 2. The Problem
 ‱ Security is a non-functional requirements ‱ Very easy to make security holes ‱ Knowledge on security is less – Often people feel secure through obscurity ‱ Too much of security will reduce usability ‱ Security Patterns might help to reduce the risk Image Source: http://cdn.c.photoshelter.com/img-get/I0000WglLK9YvkQM/s/750/750/gmat-matyasi-14.jpg
  • 3. Security ‱ Authentication ‱ Authorization ‱ Confidentiality ‱ Integrity ‱ Non-repudiation ‱ Auditing ‱ Availability Image source: http://coranet.com/images/network-security.png
  • 4. Authentication ‱ Direct Authentication – Basic Authentication – Digest Authentication – TLS Mutual Authentication – OAuth : Client Credentials Service Providers Authentication Service Consumption Image Source : http://www.densodynamics.com/wp-content/uploads/2016/01/gandalf.jpg
  • 5. Authentication ‱ Brokered Authentication – SAML – OAuth : SAML2/JWT grant type – OpenID Service Providers Service Providers Service Providers Identity Provider Service Providers Authentication Service Consumption Trust Image source: http://savepic.ru/6463149.gif
  • 6. Authentication ‱ Single Sign On ‱ Multi-factor Authentication Service Providers Service Providers Service Providers Identity Provider Service Providers Authentication Service Consumption Trust Image source : https://upload.wikimedia.org/wikipedia/commons/e/ef/CryptoCard_two_factor.jpg
  • 7. Authentication ‱ Identity Federation Pattern and Token Exchange
  • 8. Authentication ‱ Identity Federation Pattern and Token Exchange
  • 10. Authentication ‱ Trusted Subsystem Pattern Source: https://i-msdn.sec.s-msft.com/dynimg/IC2296.gif
  • 11. Authentication ‱ Multiple User stores Image Source: https://malalanayake.files.wordpress.com/2013/01/multiple-user-stores1.png?w=645&h=385
  • 13. Authorization ‱ Principle of Least Privilege ‱ Role based Access Control ‱ Attribute based Access Control – Policy based Access Control Image source : http://cdn.meme.am/instances/500x/48651236.jpg
  • 14. Authorization ‱ eXtensible Access Control Markup Language (XACML) Image Source : https://nadeesha678.wordpress.com/2015/09/29/xacml-reference-architecture/
  • 15. Confidentiality : Encryption Transport Level Security vs Message Level Security ‱ Transport Level ‱ Message Level ‱ Symmetric Encryption ‱ Asymmetric Encryption ‱ Session key based Encryption Image Source: http://www.thetimes.co.uk/tto/multimedia/archive/00727/cartoon-web_727821c.jpg
  • 16. Integrity : Digital Signatures ‱ Transport Level ‱ Message Level ‱ Symmetric Signature ‱ Asymmetric Signature ‱ Session key based Signature Image Source : http://memegenerator.net/instance2/4350097
  • 17. Non-repudiation: Digital Signatures ‱ Message Level ‱ Asymmetric Signature Image Source: http://www.demotivation.us/media/demotivators/demotivation.us_DENIAL-What-ever-it-is...-I-DIDNT-DO-IT_133423312332.jpg
  • 18. Auditing ‱ However secure you are, people might make mistake ‱ Collect the (audit) logs and analyze for – Anomaly – Fraud Source: https://745515a37222097b0902-74ef300a2b2b2d9e236c9459912aaf20.ssl.cf2.rackcdn.com/f33df70e3ffd92d1f68827dd559aa82c.jpeg
  • 19. Availability ‱ Network Level Measures ‱ Throttling ‱ Heart beat and hot pooling Image Source: https://www.corero.com/img/blog/thumb/62327%207%20365.jpg
  • 20. Secure Deployment Pattern Red Zone (Internet) Firewall Yellow Zone (DMZ) Firewall Green Zone (Internal) Services, Database API Gateway, Integration Client Application
  • 21. Secure Deployment Pattern : More restricted Red Zone (Internet) Firewall Yellow Zone (DMZ) Firewall Green Zone (Internal) Services, Database API Gateway, Integration, Message Broker Client Application