This document discusses security considerations for cloud and mobile architectures. It notes that internet and mobile device usage has grown dramatically in the past decade. However, many mobile users do not password protect their devices and multi-factor authentication is often not used for mobile apps. The document then discusses issues like mobile device management, OAuth usage for APIs, and approaches for single sign-on for native mobile apps. It advocates for secure data channels and API management to help address vulnerabilities in an increasingly mobile and cloud-centric landscape.

1. Securing
Cloud
and
Mobile
Pragma&c
Enterprise
Security
Architecture
Prabath
Siriwardena
(@prabath)
WSO2
Director,
Security
Architecture

2. Within
the
first
decade
of
the
21st
century
–
internet
worldwide
increased
from
350
million
to
more
than
2
billion.

3. Mobile
phone
subscribers
increased
from
750
million
to
5
billion
Today
it’s
around
6
billion

4. Only
30%
of
mobile
users,
password
protect
their
mobile
devices

5. Many
SaaS
providers
ignore
mulJfactor
authenJcaJon
for
mobile
applicaJons

6. 113
cell
phones
are
lost
or
stolen
every
minute
in
the
U.S
and
$7
million
worth
of
smartphones
are
lost
daily

7. 62%
of
mobile
workers
currently
use
their
personal
smartphones
for
work

8. hAp://www.websense.com/assets/reports/websense-­‐2013-­‐threat-­‐report.pdf

9. Mobile
Device
Management
systems
need
to
be
an
integral
part
of
the
corporate
IdenJty
Management

10. Cloud
service
providers
are
becoming
mobile
friendly
with
REST/JSON
APIs

11. OAuth
2.0
dominates
Mobile
and
API
security

12. Avoid
using
Resource
Owner
Password
OAuth
grant
type

13. Mobile
applicaJons
secured
with
OAuth
can
be
vulnerable
to
phishing

14. Your
Facebook
or
TwiYer
account
credenJals
can
be
quite
easily
phished
through
your
mobile
phone
-­‐
than
from
a
laptop
computer

15. The
need
to
bake-­‐in
client
key
and
the
secret
key
into
the
mobile
app
itself
is
an
issue
yet
to
solve

16. OAuth
has
given
a
beYer
failover
capability
to
mobile
applicaJons
in
case
of
an
aYack

17. It
takes
an
average
of
20
seconds
for
a
user
to
log
into
a
resource

18. Single
Sign
On
increases
user
producJvity

19. Browser
based
Single
Sign
On
Authoriza&on
Server
(IdP)
Mobile
Device
Na&ve
App
Na&ve
Web
Browser

21. NaJve
Single
Sign
On
Mobile
Device
Na&ve
App
Na&ve
IdP
App

23. OpenID
FoundaJon
is
working
on
standardizing
NaJve
Single
Sign
On
based
on
OpenID
Connect

24. SAML2
IdP
SAML2
IdP
Federated
Single
Sign
On
Authoriza&on
Server
(IdP)
Mobile
Device
Na&ve
App
Na&ve
Web
Browser

25. Federated
Single
Sign
On
with
heterogeneous
AuthorizaJon
Servers

26. Secured
/
ConfidenJal
data
channels

27. TLS,
JSON
Web
EncrypJon
(JWE)

28. Managed
Cloud
APIs
Cloud
API
Mobile
App
API
Gateway

29. Thank
You