5 Reasons Why APIs Must be Part of Your Mobile Strategy - Scott Morrison, Distinguished Engineer, CA

•Download as PPTX, PDF•

0 likes•1,295 views

This document discusses why APIs must be part of a mobile strategy and provides 5 reasons: 1) Firewalls make accessing APIs difficult due to changing clients and back-end systems, 2) Authentication, authorization, and single sign-on are important for mobile access but challenging, 3) Local app single sign-on is desirable without the negatives of a VPN, 4) Mobile OS isolation silos data and prevents sharing credentials, 5) Users need a way to logout if their device is lost or stolen. It then describes a solution of a native single sign-on SDK for mobile developers to address these problems using OAuth, OpenID Connect, and managing users, apps, and devices securely.

Technology

5 Reasons Why APIs Must Be A
Part Of Your Mobile Strategy

K. Scott Morrison
Senior Vice President and Distinguished Engineer
February 2014

© 2014 CA. All rights reserved.

5 reasons why APIs
must be part of your
mobile strategy

Layer 7 SecureSpan Gateway
Secure and Manage Enterprise APIs
Gateway Cluster at Edge of Network

API/Service
Servers

 DMZ deployment
 Hardware appliance, virtual appliance
or software

Firewall 2

Firewall 1

…

Enterprise
Network

Cloud

SSG
Cluster

Mobile Devices

API/Service
Client
Partners

3

Directory

Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

The MAG SDK

4

Copyright © 2013 CA. All 2013 CA. All rights reserved.
© rights reserved. No unauthorized copying or distribution permitted

The Essence of the Problem:
Secure Mobile Access to Apps and Data
API/Service
Servers

How Do We Make APIs Available?
 Firewall mazes

Firewall 2

 Diversity of clients and back end systems
 Clients and servers change at different
rates
Firewall 1
Directory

Enterprise
Network

Internet

Of Particular Interest:
 Authentication, Authorization & SSO
 Secure Transmission
API/Service
Client
5

Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

But We Also Want Local App SSO
API/Service
Servers

“Like a VPN… but without all
of the negatives”
Single Sign On App Group
(these apps will share
sign-on sessions)

A

B

C

So now it’s getting
interesting…

7

Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

Mobile OS Isolation is an issue

App layer

Persistence layer
Silos
8

Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

Self Service: User should be able to log out if device
is lost or stolen

9

Copyright 2013 CA. CA. reserved. No unauthorized copying or
Copyright ©©2012All rights All rights reserved. distribution permitted

Solution: Native Single Sign-On SDK For Mobile
Developers
Strong Security for Mobile Apps

API Servers

 Cross-platform and built for a consumer or BYOD world
 100% Standards-based using OAuth+OpenID Connect
 X-app SSO with multi-factor auth & secure channel
 X.509 Certificate provisioning for strong auth and transaction signing
One time PIN
SMS, APNS, call

Enterprise
Network
iPhone

App-sharable Secure
Key Store

Android

10

iPad

Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

Client Deployment Strategy
 Don’t make me work hard
– But give me a strong and extensible security model

 Transfer of security responsibility
– Let developers do what they do best

 Simple SDK
– Align with common development time environments
 iOS, Android, Javascript, etc

 Mirror REST frameworks
 Future
– Aspects, wrapping, etc.

11

Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

Three Important Entities
All three are managed by the SDK+MAG

User

Apps

Devices

12

Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

Protocol Strategy
OAuth + OpenID Connect
 Profiled for mobile
 Clear distinction between device, user and app
Authorization
Server

username/password

A

B

ID Token

C
Per app

13

Access
Token/Refresh
Token

Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

K. Scott Morrison
Distinguished Engineer
Scott.Morrison@ca.com
@KScottMorrison

slideshare.net/CAinc
linkedin.com/KScottMorrison

ca.com

Simplify secure mobile app access to enterprise resources When mobile apps access enterprise data and services, the risk of security being compromised is increased. Layer 7’s solution for mobile Single Sign-On simplifies the process through which apps require users to sign in to the enterprise in order to secure this access. The solution leverages the underlying security in a device’s operating system to effectively create a secure sign-on container for apps. Layer 7 offers a complete end-to-end, standards-based and proven security solution for mobile SSO. This solution uses OAuth 2.0, OpenID Connect and JWT standards. Communication is secured through Layer 7’s SecureSpan Mobile Access Gateway and SSO libraries that abstract out all the complex OAuth and OpenID Connect protocol handshakes between mobile device and Gateway.

CA API Management: A DevOps Enabler

Rajat Vijayvargiya

With APIs gaining momentum as the building blocks of Application Economy, an agile API platform architecture is key to aligning API based 'Dev with DevOps'. A platform that can either quickly adapt to incorporate disruptive changes and new architecture patterns like micro services/containerization on the back end or be extended to create seamless yet secure Apps and connected mobile experiences (IoT) on the front end is the foundation of a successful and complete DevOps strategy. It is also a competitive differentiators from time to market standpoint.

Enable Secure Mobile & Web Access to Microsoft SharePoint

CA API Management

Empower employees with external access to SharePoint and other intranet resources Microsoft SharePoint authorizes user access based on a Microsoft domain session using Kerberos or similar technologies. An external user without a direct domain session cannot access SharePoint directly using common Single Sign-On (SSO) solutions deployed at the perimeter of the enterprise. Requiring VPN access to the enterprise for accessing SharePoint and other intranet resources is not practical and widens the attack surface of the enterprise. Layer 7 delivers a simple solution for brokering access to Microsoft-based Web applications and APIs. By deploying Layer 7’s SecureSpan Gateway in the DMZ, the enterprise can enable and control access to Microsoft SharePoint without the need for VPN connections. The enterprise can leverage the same SecureSpan Gateway to control access to any Web applications and APIs that need to be consumed by mobile applications.

Balancing Security & Developer Enablement in Enterprise Mobility - Jaime Ryan...

CA API Management

Today’s enterprise mobility solutions emphasize heavy-handed IT governance of devices and applications that impose a burden on developers and/or users. However, managing data and applications using high performance mobile-optimized infrastructure can enable secure, scalable apps while minimizing the effort required by developers and allowing them to focus on their strengths. Come learn how to facilitate the best of both worlds – multi-layer mobile security using modern standards and a fantastic user experience.

OAuth in the Real World featuring Webshell

CA API Management

Find out how today’s authorization experts are getting maximum value from OAuth OAuth has quickly become the key standard for authorization across mobile apps and the Web. But are you getting the most out of OAuth? Join Mehdi Medjaoul, Co-Founder & Executive Director of Webshell – the company behind OAuth.io – and Scott Morrison, former CTO of Layer 7 and now Distinguished Engineer at CA Technologies, as they discuss how authorization experts are really using OAuth today.

Drones, Phones & Pwns the Promise & Dangers of IoT APIs: Use APIs to Securely...

CA API Management

The Internet of Things (IoT) promises to improve our productivity and day-to-day lives by connecting a vast range of devices – from cell phones, to cars, to domestic appliances and even to drones. APIs represent the key technology that will make it possible to integrate and leverage information from all these “things”. There are obvious security and privacy concerns associated with using APIs to expose data and functionality from one device to many others. So, how can we make sure hackers cannot exploit the unprecedented connectivity created by IoT? This webinar will explore key IoT use cases and explain how to address the API security requirements for these use cases.

CA API Gateway

James Farley-Sutton

The document summarizes the CA API Gateway, which provides a single solution for enterprises to securely manage APIs and open up internal systems to mobile devices, cloud services, and third-party developers. It combines policy management with runtime enforcement to control access no matter where users are located. Key benefits include centralized security and control over assets, traffic prioritization to ensure API performance, and translation between legacy and new applications and data.

How to Choose the Right API Management Solution

CA API Management

Deploy a system that will empower you to expose APIs in a secure, manageable way Choosing the right API Management solution can make implementing a successful API strategy much easier and help to ensure your APIs are exposed in a secure, manageable way. Join this Layer 7 webinar to learn the key criteria for selecting an API Management solution and to get a solid understanding of the factors that will impact the success of your API strategy. Everyone who registers for the webinar will receive a complimentary copy of The Forrester Wave: API Management Platforms, Q1 2013.

Identity on the Internet is changing. Social networking has kicked off a massive change in how we integrate identity across applications. This is much more than a simple redesign of security tokens and protocols; instead it is a radical redistribution of power and control over entitlements, shifting it away from the centralized control of a cabal of directory engineers and out to the users themselves. There are compelling reasons for this shift: it enables scaling of identity administration, and it promotes rapid and agile integration of applications. These are goals shared by the enterprise, but this change has significant implications on infrastructure, people and process. Join us to learn how you can bring modern identity management into the enterprise.

Adapting to Digital Change: Use APIs to Delight Customers & Win

CA API Management

This document discusses how financial institutions can use APIs to improve the customer experience, drive innovation, and generate new revenue opportunities. It provides examples of how APIs have helped organizations like a utility company improve payment processing, a retail bank ensure system availability for trading, and a healthcare provider enhance field work efficiency. The document advocates that API management platforms can help organizations securely expose APIs, accelerate app development, integrate systems, and monitor API usage to support monetization strategies. Overall, the document argues that APIs allow financial firms to enhance customer loyalty, expand into new business areas, and maintain operational resilience in the digital economy.

5 Steps for End-to-End Mobile Security with Consumer Apps

CA API Management

Overview Delivering services to consumers via mobile apps is essential for differentiation and competitiveness in today’s business climate. But as more services are exposed, more risk is incurred – putting mobile app security at the top of the list for any security professional. While strict BYOD policies, device-level security and application management solutions may fit enterprise requirements, the privacy and usability implications of these approaches are likely to negatively affect the consumer experience. This webinar, presented by Tyson Whitten of CA Technologies and Leif Bildoy of CA Layer 7, will explain how enterprises can secure services exposed by mobile apps in a way that satisfies internal security requirements without impacting the user experience for external consumers.

Mobile Risk Analysis: Take Your Mobile App Security to the Next Level

CA Technologies

The document discusses how mobile risk analysis can help raise the security bar for mobile app authentication. It outlines how mobile devices bring together something you have and something you are for stronger authentication. Risk assessment using behavioral data from a user's mobile device can provide a more secure credential than traditional passwords by analyzing location, device details, and usage history to determine the legitimacy of a login attempt. The document recommends that mobile app authentication adopt this kind of risk-based approach to keep pace with improvements in browser-based authentication security.

API Security and OAuth for the Enterprise

CA API Management

I this presentation enterprises will get a practical overview of what they need to know when approaching APIs and technologies like OAuth. Mobile and Cloud initiatives are driving enterprises to expose data and applications to the outside world. Whether SOAP, REST or JSON, these APIs give enterprises an efficient way to open up information to services running in the Cloud and apps running on mobile devices like the iPad. However, securing and governing the lifecycle and operation of these APIs is not straightforward. It requires new approaches to access, protection and management. This invariably requires adoption of new technologies such as OAuth, which are not yet well understood.

Truth, Lies & APIs - Ross Garrett, Director Product Marketing, CA Layer 7 @ G...

CA API Management

Layer 7: Getting Your SOA to Production Without Cost and Complexity

CA API Management

Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...

CA Technologies

Without security, Digital Transformation cannot be successful. Opening organizational boundaries and providing crucial information to the right people at the right time requires the right controls and a new security model is needed. Identities are at the heart of this transformation. In this presentation, Steve Firestone (GM, CA Security) will show how security is an essential component to the CA strategy for Digital Transformation and how organizations can use the power of Identities to drive their business forward. For more information, please visit http://cainc.to/Nv2VOe

Mastering Digital Channels with APIs

CA API Management

The document discusses a presentation about mastering digital channels through APIs. It begins with an agenda that covers the digital world of CMOs/CDOs, companies that are doing it well using APIs, what to do next, and Q&A. It then provides details on the evolution of the digital world from the first generation web to today's SMAC stack challenges. It also discusses how Amazon has mastered digital channels through vision, focus on data and APIs, agility, and persistence in broadening their offerings.

Enable and Secure Business Growth in the New Application Economy

CA Technologies

Enterprise security used to be about boundaries separating the inside (the data center) from the outside (the Internet). But today, organizations are opening up to connect with customers, partners and even things. This new reality requires a new approach to security. APIs are becoming the universal integration point across the open enterprise, while Identities are becoming the primary control point. In this presentation, Steve Firestone, the GM of CA Security, and Rahim Bhatia, the GM of CA API Management and Security, will show how organizations can (and do) use these technologies to securely move their business forward. For more information on CA Security solutions, please visit: http://bit.ly/10WHYDm

Lessons Learned From Four Years of API Management Implementation Success at Unum

CA Technologies

This document summarizes Unum's experience implementing an API management strategy over four years. It discusses how Unum started with a service-oriented architecture (SOA) to build reusable business services. A key part of the SOA was using an enterprise service bus and API gateway from CA Technologies to mediate access to services. This protected critical assets, provided flexibility by decoupling clients from implementations, and enabled capabilities like authentication, routing and throttling. The document then discusses how Unum defined various data and interface models to support SOA and defines what an API is in relation to SOA. It outlines how the CA API gateway fits into Unum's architecture as part of the enterprise service bus to securely enable access to resources for partners

Enterprise API deployment best practice

Sanjay Roy

The document outlines how an enterprise API management platform can help organizations address challenges in the modern API economy. Specifically, it discusses how such a platform can: 1) Modernize legacy application interfaces by mediating between different interface standards. 2) Create new APIs and applications by orchestrating internal and third-party APIs. 3) Securely manage the lifecycle of APIs, applications, and partners from development to production.

APIs Fueling the Connected Car Opportunity - Scott Morrison, SVP & Distinguis...

CA API Management

Hello, Dishwasher! The Looming Identity Crisis on the Internet of Things

CA Technologies

In this presentation you will learn: How IoT will affect our everyday lives, extending from our home, to our car and into our workspace; Why things need identity—and what form this identity should take; The five top security risks in the Internet of Things; How you can manage and mitigate these risks and what we can learn from classic IAM, and what we must do differently. For more information on CA Security solutions, please visit: http://bit.ly/10WHYDm

API and Microservices Management

IBM DataPower Gateway

SaaS Metrics That Matter | MuleSoft

MuleSoft

In the cloud, new businesses can emerge overnight. What are you doing to differentiate your application? How are you innovating ahead of your competition, while meeting your Executive KPI's? At a recent Executive Roundtable Ann Winblad, Co-Founder and Managing Director of Hummer Winblad Venture Partners, discussed these SaaS best practices with a group of 45 CEOs, Sales and Services Executives. View this presentation to learn how Executives from leading SaaS businesses in the Bay Area are creating a competitive advantage, and meeting their investor's key performance indicators. What you will learn: * 6 SaaS metrics that matter to your investors, and should matter to you * How to increase recurring revenue without additional resources * How to minimize customer turnover with a unique competitive advantage

What's new in API Connect and DataPower - 2019

IBM DataPower Gateway

IBM API Connect and Gateways 2019 provides: 1. A multi-cloud fabric for API Connect that allows deployment across any cloud with improved performance, scalability, and flexibility. 2. A cloud-native API gateway service that provides 5x improved performance without sacrificing security. 3. Enhanced user experiences through a simplified UI, automated testing and monitoring, and reduced overhead of operations.

SSO Agility Made Possible - November 2014

Andrew Ames

CA SSO (formerly SiteMinder) has served the web access security functions of so many, yet the mobile channel is expanding how organizations think about security and APIs are the fundamental connectivity point. Acclaim Consulting, CA and National Rural Electric Cooperative Association (NRECA) present a strategy and solution for "future-proofing" security and SSO. Topics covered: • Centralizing security policy and auditing across multiple platforms and devices • Unified security using cookies or tokens for authorization and session management • Leveraging current investments in IT security assets and extending to mobile apps • Business Solution Collaboration - Security Architect and Application Developers

Federal Grade Security with Mocana

Apperian

Mocana provides mobile application protection and device security solutions. Their flagship product is Mobile App Protection (MAP) which uses application wrapping to add security controls to mobile apps in order to protect corporate data on devices. MAP integrates with mobile management platforms and allows policies to be applied individually to each wrapped app, providing security without compromising the user experience.

Application Experience Analytics Services: The Strategic Digital Transformati...

CA Technologies

Join this session for a taste of mainframe excellence deconstructed, with Jean Louis Vignaud, VP of Product Management, sharing the CA Technologies vision for how mainframe as a service breaks silos through a unified, enterprise-grade toolset deployed mobile to mainframe. Learn how a menu of IBM z Systems® services can be intelligently configured and provisioned to deliver at scale delight for the entire IT team—reduced TCO and flawless SLA delivery for CIOs, unparalleled security and compliance management for CISOs, and greater accessibility to mainframe code and data through a redesigned, “cloud-like experience” for enterprise architects and developers. Stay connected at: http://ow.ly/d0f350g68Bq Thank you.

CIS13: Mobile Single Sign-On: Extending SSO Out to the Client

CloudIDSummit

This document discusses extending single sign-on (SSO) capabilities to mobile clients. It proposes using OAuth and OpenID Connect to implement cross-application SSO on mobile devices while distinguishing between the device, user, and individual apps. A key challenge is the isolation of apps and data on mobile operating systems, which this solution aims to address through a native SDK and centralized management of tokens. The overall architecture features device registration, requesting access tokens via JSON Web Tokens to enable SSO, and administration of tokens.

Mobile Single-Sign On: Extending SSO Out to the Client - Layer 7's CTO Scott ...

CA API Management

What's hot

Managing Identity by Giving Up Control - Scott Morrison, SVP & Distinguished ...

CA API Management

Adapting to Digital Change: Use APIs to Delight Customers & Win

CA API Management

5 Steps for End-to-End Mobile Security with Consumer Apps

CA API Management

Mobile Risk Analysis: Take Your Mobile App Security to the Next Level

CA Technologies

API Security and OAuth for the Enterprise

CA API Management

Truth, Lies & APIs - Ross Garrett, Director Product Marketing, CA Layer 7 @ G...

CA API Management

Layer 7: Getting Your SOA to Production Without Cost and Complexity

CA API Management

Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...

CA Technologies

Mastering Digital Channels with APIs

CA API Management

Enable and Secure Business Growth in the New Application Economy

CA Technologies

Lessons Learned From Four Years of API Management Implementation Success at Unum

CA Technologies

Enterprise API deployment best practice

Sanjay Roy

APIs Fueling the Connected Car Opportunity - Scott Morrison, SVP & Distinguis...

CA API Management

Hello, Dishwasher! The Looming Identity Crisis on the Internet of Things

CA Technologies

API and Microservices Management

IBM DataPower Gateway

SaaS Metrics That Matter | MuleSoft

MuleSoft

What's new in API Connect and DataPower - 2019

IBM DataPower Gateway

SSO Agility Made Possible - November 2014

Andrew Ames

Federal Grade Security with Mocana

Apperian

Application Experience Analytics Services: The Strategic Digital Transformati...

CA Technologies

What's hot (20)

Managing Identity by Giving Up Control - Scott Morrison, SVP & Distinguished ...

Adapting to Digital Change: Use APIs to Delight Customers & Win

5 Steps for End-to-End Mobile Security with Consumer Apps

Mobile Risk Analysis: Take Your Mobile App Security to the Next Level

API Security and OAuth for the Enterprise

Truth, Lies & APIs - Ross Garrett, Director Product Marketing, CA Layer 7 @ G...

Layer 7: Getting Your SOA to Production Without Cost and Complexity

Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...

Mastering Digital Channels with APIs

Enable and Secure Business Growth in the New Application Economy

Lessons Learned From Four Years of API Management Implementation Success at Unum

Enterprise API deployment best practice

APIs Fueling the Connected Car Opportunity - Scott Morrison, SVP & Distinguis...

Hello, Dishwasher! The Looming Identity Crisis on the Internet of Things

API and Microservices Management

SaaS Metrics That Matter | MuleSoft

What's new in API Connect and DataPower - 2019

SSO Agility Made Possible - November 2014

Federal Grade Security with Mocana

Application Experience Analytics Services: The Strategic Digital Transformati...

Similar to 5 Reasons Why APIs Must be Part of Your Mobile Strategy - Scott Morrison, Distinguished Engineer, CA

CIS13: Mobile Single Sign-On: Extending SSO Out to the Client

CloudIDSummit

Mobile Single-Sign On: Extending SSO Out to the Client - Layer 7's CTO Scott ...

CA API Management

Mobile SSO: Give App Users a Break from Typing Passwords

CA API Management

Why do we use mobile devices? Simple – they’re easy to use and very convenient. So, why do we make it so hard for mobile consumers to do business with us by confronting them with multiple login screens and passwords? While security is essential to protecting mobile usage, convenience cannot be sacrificed. With the release of the CA Layer 7 Mobile Access Gateway 2.0 and its Mobile SDK, organizations can now achieve faster mobile consumer engagement, end-to-end mobile app security and convenient mobile Single Sign-On (SSO). In this webinar, Tyson Whitten and Leif Bildoy of CA Technologies explore the why and how of mobile SSO and the Mobile Access Gateway. You will learn • The mobile app choices you need to make to enable better consumer engagement • The connectivity and security implications of these choices • The mobile security solutions that balance security and convenience

Enabling the Multi-Device Universe

CA API Management

Moving beyond conventional single sign-on to seamless cross-device access with APIs People are carrying more devices every day – with the average being 2.9 per person. Meanwhile, multitasking has gone into overdrive, as users quickly move from laptop to phone to tablet, expecting a seamless experience when accessing their favorite apps. And this expectation is not just limited to leisure and personal use – it extends to business applications. Security has broken this seamless workflow and inhibited the mobile “stickiness” businesses are striving to achieve. This webinar with Scott Morrison and Leif Bildoy of CA Technologies will demonstrate how the right combination of identity functionality and secure APIs can help your organization to overcome these challenges and enable the multi-device universe. You Will Learn • What challenges must be overcome when supporting multiple mobile app types • How SSO is evolving past mobile app access to device access • Why the right implementation of identity and APIs will create consumer stickiness • How the Internet of Things (IoT) is creating new business opportunities

Con8817 api management - enable your infrastructure for secure mobile and c...

OracleIDM

The document discusses API security challenges in modern enterprises driven by cloud and mobility. It outlines Oracle's approach to API management and security which includes: (1) treating the enterprise web as consisting of APIs, (2) addressing the same security problems around DMZ security, access control, and insider threats but with new names, (3) enabling better security through service abstraction and standards-based layers for access control. It then provides examples of Oracle's API gateway and identity management solutions for securing APIs.

Trust No One: The New Security Model for Web APIs - SecTor talk by Greg Kliew...

CA API Management

API Roles In Cloud and Mobile Security - Greg Olsen, IT Manager, Integration ...

CA API Management

The session will enable you to understand what roles APIs play in any move to the cloud or for mobility. The presentation is NOT about technology but focuses on the decisions and considerations necessary to develop these APIs. You will also learn about some of the security “got ya’s” which you should avoid! Learn about decisions which were necessary for my company to pursue an API strategy through the Service Gateway – learn from our mistakes and come up with solid decisions for your implementation.

Oracle mobile cloud service

shravan kumar chelika

This document provides an overview of Oracle Mobile Cloud Service (MCS) and its features. MCS addresses challenges with enterprise mobile development like integration across apps and backend systems. It provides mobile backends, platform APIs, custom APIs, connectors, and a client SDK. The presentation demonstrates consuming MCS from an Oracle MAF app and summarizes key capabilities like mobile backends, custom APIs using Node.js, and connectors for external systems.

Federation Evolved: How Cloud, Mobile & APIs Change the Way We Broker Identity

CA API Management

Understanding how emerging standards like OAuth and OpenID Connect impact federation Federation is a critical technology for reconciling user identity across Web applications. Now that users consume the same data through cloud and mobile, federation infrastructure must adapt to enable these new channels while maintaining security and providing a consistent user experience. This webinar will examine the differences between identity federation across Web, cloud and mobile, look at API specific use cases and explore the impact of emerging federation standards. You Will Learn Best practices for federating identity across mobile and cloud How emerging identity federation standards will impact your infrastructure How to implement an identity-centric API security and management infrastructure Presenters Ehud Amiri Director, Product Management, CA Technologies Francois Lascelles Chief Architect, Layer 7

MobilizeUrApps - Android Application Development

mobilizeurapps

Demystifying the Mobile Container - PART I

Relayware

Mobile app developers have been engaged in a philosophical debate about "HTML5 vs. Native" for a couple of years now. But more and more in-the-know mobile strategists are deciding the answer is "Neither." Rather than choose between rich and interactive native experiences or portable and cost-effective web development, more apps are being deployed using web technologies and "native containers" to deliver the best of both worlds. Highlights: - What is a "container?" - What are the different types of containers? - For which types of apps is each appropriate? - What are the advantages of a container deployment strategy? - Are there good examples of successfully deployed containerized mobile apps?

Oracle E-Business Suitre mobile apps ADF

Berry Clemens

Oracle mcs overview 1029

Oracle Corporation

This document provides an overview of Oracle Mobile Cloud Service and instructions for getting started with the Android client SDK. It describes Mobile Cloud Service as a cloud-based platform for developing, deploying, and managing mobile applications and their backend services. The document outlines features like push notifications, data storage, caching, user management, and analytics. It then provides step-by-step instructions for setting up an Android application project, integrating the Mobile Cloud SDK, configuring the mobile backend, and running a demo application.

IDENTITY IN THE WORLD OF IOT

ForgeRock

The document discusses identity in the Internet of Things (IoT) world. It covers the following key points: 1. Identity is frequently targeted in cyber attacks against executives, administrators, and outsourced vendors. Attackers need to be right once while enterprise security needs to be right every time. 2. IoT devices like refrigerators and thermostats are increasingly being hacked. 3. A framework is needed for identity management of users, devices, applications, and resources to enable secure access from any client or device to any service located anywhere. 4. Next generation IT requirements for identity in IoT include standards-driven federation and APIs, identity management for all entities, multi-factor

API Services: Harness the Power of Enterprise Infrastructure

Apigee | Google Cloud

When existing enterprise IT systems were designed, mobile, social and cloud services were in their infancy and most interaction was internal to the company. Today, enterprise IT is challenged with supporting agile changes, fast releases, and exposing functionality to be consumed by partners who haven’t even been identified! Learn how security, monitoring, logging and other technology in the Apigee API Platform integrates with existing enterprise infrastructure to meet the challenges of the new digital marketplace while allowing IT to continue to provide world-class security and protection for a company’s systems and for users’ data.

Con8823 access management for the internet of things-final

OracleIDM

The document provides an agenda for a presentation on access management for the Internet of Things. The agenda includes introducing identity for IoT, security challenges for IoT, how Oracle Access Management 11gR2 can secure access for IoT, a customer case study, and a demo. Key topics that will be covered are introducing composite identities for devices, services, and users in IoT; securing communication between people, things, and APIs; and leveraging social networks, mobile access, OAuth, and gateways to manage access and identities for IoT applications and use cases.

Introduction to Android Application Security Testing - 2nd Sep 2017

Satheesh Kumar V

This document provides an introduction to mobile application security with a focus on Android. It discusses Android architecture, application fundamentals, security model, and tools for reverse engineering Android apps. It also summarizes the top 10 mobile risks from the OWASP Mobile Top 10 including issues like insecure data storage, authentication, authorization, and code quality. Hands-on examples are provided for reverse engineering apps and analyzing the application permissions.

Achieving Visibility, Security and Real-Time Actionable Alerts Using VPC Flow...

Amazon Web Services

Visibility is a must for detecting threats and compromises in the cloud, containers, and on-premises networks. In this session, we will explore how Stealthwatch Cloud uses VPC Flow logs and network telemetry combined with advanced analytics such as entity modeling and threat intelligence feeds like Cisco Talos to detect attacks, data exfiltration, unusual remote access, and traffic that is not compliant with your policies.

Best Practices You Must Apply to Secure Your APIs - Scott Morrison, SVP & Dis...

CA API Management

The document discusses best practices for securing APIs and identifies three key areas: parameterization, identity, and cryptography. It notes that APIs have a larger attack surface than traditional web apps due to more direct parameterization. It recommends rigorous input and output validation, schema validation, and constraining HTTP methods and URIs. For identity, it advises using real security tokens like OAuth instead of API keys alone. It also stresses the importance of proper cryptography, like using SSL everywhere and following best practices for key management and PKI. The overall message is that APIs require different security practices than traditional web apps.

Mobile Payment Security with CA Rapid App Security

CA Technologies

Similar to 5 Reasons Why APIs Must be Part of Your Mobile Strategy - Scott Morrison, Distinguished Engineer, CA (20)

CIS13: Mobile Single Sign-On: Extending SSO Out to the Client

Mobile Single-Sign On: Extending SSO Out to the Client - Layer 7's CTO Scott ...

Mobile SSO: Give App Users a Break from Typing Passwords

Enabling the Multi-Device Universe

Con8817 api management - enable your infrastructure for secure mobile and c...

Trust No One: The New Security Model for Web APIs - SecTor talk by Greg Kliew...

API Roles In Cloud and Mobile Security - Greg Olsen, IT Manager, Integration ...

Oracle mobile cloud service

Federation Evolved: How Cloud, Mobile & APIs Change the Way We Broker Identity

MobilizeUrApps - Android Application Development

Demystifying the Mobile Container - PART I

Oracle E-Business Suitre mobile apps ADF

Oracle mcs overview 1029

IDENTITY IN THE WORLD OF IOT

API Services: Harness the Power of Enterprise Infrastructure

Con8823 access management for the internet of things-final

Introduction to Android Application Security Testing - 2nd Sep 2017

Achieving Visibility, Security and Real-Time Actionable Alerts Using VPC Flow...

Best Practices You Must Apply to Secure Your APIs - Scott Morrison, SVP & Dis...

Mobile Payment Security with CA Rapid App Security

More from CA API Management

Api architectures for the modern enterprise

CA API Management

Extend your legacy SOA/ESB infrastructure to Mobile & IoT This webinar recording provides a use-case driven discussion around appropriate use of existing middleware infrastructure as well as its shortcomings. It dives deep into how APIs can not only complement an ESB or SOA infrastructure but also fill existing gaps. Watch this webinar recording to learn about: - Strengths and weaknesses of your existing ESB/SOA infrastructure - Architecture strategy: extend and add value to legacy middleware with APIs - Integration / API use cases in Retail, Manufacturing and Telecom - The API360 approach to digital strategy

Takeaways from API Security Breaches Webinar

CA API Management

Examining today's biggest API breaches to mitigate API security vulnerabilities Data breaches have become the top news story. And APIs are quickly becoming the hacker's new favorite attack vector. They offer a direct path to critical information and business services that can be easily stolen or disrupted. And your private APIs can be exploited just as easily as a public API. So what measures can you take to strengthen your security position? This webinar explores recent API data breaches, the top API security vulnerabilities that are most impactful to today's enterprise and the protective measures that need to be taken to mitigate API and business exposure. You Will Learn -Recent breaches in the news involving APIs -Top attacks that compromise your business -Mitigating steps to protect your business from attacks and unauthorized access -API Management solutions that both enable and protect your business Learn about API Security at http://www.ca.com/api

API Design Methodology - Mike Amundsen, Director of API Architecture, API Aca...

CA API Management

At some point, we all need to design and implement APIs for the Web. What makes Web APIs different than typical component APIs? How can you leverage the power of the Internet when creating your Web API? What characteristics to many "great" Web APIs share? Is there a consistent process you can use to make sure you design a Web API that best fits your needs both now and in the future? In this session Mike Amundsen describes a clear methodology for designing Web APIs (based on the book "RESTful Web APIs" by Richardson and Amundsen) that allows you to map key aspects of your business into a usable, scalable, and flexible interface that will reach your goals while creating a compelling API for both server and client developers. Whether you are looking to implement a private, partner, or public API, these principles will help you focus on the right metrics and design goals to create a successful API.

Liberating the API Economy with Scale-Free Networks - Mike Amundsen, Director...

CA API Management

The document discusses scale-free networks and their application to APIs and the API economy. It notes that while many networks follow a power law distribution, centralized hubs create vulnerabilities. It suggests that API providers adopt a node-based model rather than a centralized hub model to avoid these vulnerabilities and empower users. Both providers and consumers are advised to explore node-based and client-based aggregator models.

API360 – A How-To Guide for Enterprise APIs - Learn how to position your ente...

CA API Management

APIs are everywhere: powering mobile apps, enabling cloud computing, connecting people through social networks and helping to create the Internet of Things. Organizations of every kind are evaluating how they can leverage APIs and replicate the success of companies like Amazon, Google and Salesforce. Join this webinar to learn about the #API360 model for enterprise API success. This model covers the full spectrum of considerations for companies looking to succeed with APIs for the long haul. You will also hear more about the upcoming #API360 Summit that will take place in Dallas on February 26. You Will Learn • How leading Web companies have used APIs to boost revenues and market share • How to create an enterprise API strategy that will yield real business results • How to institutionalize best practices that will allow your APIs to evolve and grow

API Monetization: Unlock the Value of Your Data

CA API Management

This document discusses opportunities for companies to monetize their application programming interfaces (APIs) and data. It outlines how exposing data through APIs can extend a company's brand and reach while also generating revenue. The document recommends practices for unlocking the value of enterprise data, such as by creating targeted products and services. It also provides tips on best practices for monetizing data APIs, including modeling revenue and simplifying API discovery for developers.

Revisiting Geddes' Outlook Tower - Mike Amundsen, Director of API Architectur...

CA API Management

The Information Age, 100 years on The rise of the computer and the digital revolution is responsible for an explosion of devices, data, and connectedness. These are all enabling what is called the dawning of the Information Age. And software designers, developers, and architects all share an important responsibility for shaping and guiding the world’s progress through this axial age into the future. However, more than 100 years ago, the work of organizing the world’s information into a single all-encompassing taxonomy had already begun. Partially influenced by the positivist doctrine of Auguste Comte, leading thinkers of the early 20th century such as the librarian Paul Otlet in Belgium, museum curator Patrick Geddes in Scotland, and educator Melvil Dewey in the US were each working to design universal classification systems that would encompass and coordinate the explosion of information appearing in libraries, museums, newspapers, magazines, and eventually even radio, movies, and television. What did we learn in the last century? What have we forgotten? How does their work affect our current trajectory in transforming the work of software and systems design and development? What can we take from Dewey, Otlet, and Geddes with us in to the next 100 years of the Information Age.

Building APIs That Last for Decades - Irakli Nadareishvili, Director of API S...

CA API Management

The Art of API Design - Ronnie Mitra, Director of API Design, API Academy at ...

CA API Management

5 steps end to end security consumer apps

CA API Management

This document discusses 5 steps for achieving end-to-end security for consumer mobile apps. It outlines identifying the risk level of apps, understanding where mobile device management and mobile application management fit, securing APIs, implementing secure app development practices, and using authentication, authorization, and access control to balance security and user experience. The document is presented by CA Technologies and promotes their mobile security products and solutions.

Gartner AADI Summit Sydney 2014 Implementing the Layer 7 API Management Pla...

CA API Management

The VIP networking lunch will feature a presentation by Keith Junius, Solution Architect, from Veda on ‘Implementing an API Management Platform’. Attendees will hear about how Veda has modernized their B2B API platform by deploying SOA Gateways. Join Layer 7 at this lunch to learn about: • Design considerations for API management platforms • Technical and business challenges faced across the whole system lifecycle • The soft skills required to achieve a successful outcome • Lessons learned during and after the project • Benefits realized by the new platform

Using APIs to Create an Omni-Channel Retail Experience

CA API Management

Today, tech-savvy consumers are always connected, using their mobile devices to compare prices, read user-generated reviews and pay for products - and many leading e-tailers already connect their customers to this information. The any time, any place connectivity enabled by mobile devices empowers all retailers to offer the kinds of enhanced shopping experiences modern consumers are becoming accustomed to. To truly satisfy the needs of these well-informed, mobile consumers, retail organizations will need ways to create unified shopping experiences across all channels – from brick-and-mortar stores to the Web to mobile. Increasingly, offering a compelling mobile experience will become the cornerstone upon which these omni-channel shopping experiences are built. In this webinar, you will learn how APIs can: • Help deliver a consistent retail experience across multiple channels • Connect retailers with social data • Extend legacy systems to mobile apps • Enable organizations to make real-time use of contextual data and buying patterns

Panel Session: Security & Privacy for Connected Cars w/ Scott Morrison, SVP ...

CA API Management

Cars are already full of sensors and producing gigabytes of data, but they are not connected yet. Connecting them can represent a tremendous opportunity for several industries (insurance companies, repairs, traffic optimization...) but it certainly comes with a lot of challenges. Security and Privacy are the biggest challenges this market have to overcome, especially because it has been completely out of scope for this industry so far.

Clients Matter, Services Don't - Mike Amundsen's talk from QCon New York 2014

CA API Management

This document discusses how services on the web should focus on clients rather than themselves. It identifies five key services - identity, synchronization, representation, description, and discovery - that are challenging to implement well. These can be reframed as security, storage, compatibility, functionality, and distribution from the client's perspective. The conclusion calls for recovering a client-centric approach to building web services going forward.

The Connected Car UX Through APIs - Francois Lascelles, VP Solutions Architec...

CA API Management

Whether it be infotainment, companion or ecommerce apps, they all have one thing in common - APIs. APIs are enabling the development of new apps both inside and outside the vehicle. But the "always on" connectivity comes with increased risk to both the user and data. Explore common app initiatives fueling the connected car industry Understand the intersection of connected car apps, identities and agile API platforms Learn how to apply the right security and UX balance that drives connected car app adoption

Is there an API in that (IoT)?

CA API Management

An opinionated investigation into the impact of the Internet of Thing on APIs. What will remain and what will change? How will the future API design, protocols and developer experience be impacted by the promises and limitations of IoT. If you are wondering if IoT is hype or reality and how you will integrate it with it from an API perspective this talk is for you. This presentation will get you an (admittedly) opinionated overview over the current state of the art and possible future direction of APIs in IoT.

Your New Digital Business & APIs

CA API Management

Every competitive business is now a digital business. In a world where differentiation and scale are being driven through apps and data, success is not a question of whether the businesses should go digital – it is a question of how the business should go digital. In this webinar, Tyson Whitten – Director of API & Mobility Solutions at CA Technologies – will describe the key methods that successful organizations are using to create sustainable competitive advantage through digital transformation.

Mapping the API Landscape - Mike Amundsen, Director of API Architecture

CA API Management

Lean API Strategy - Holger Reinhardt, Snr Principal Business Unit Strategy, L...

CA API Management

Your Journey to Agility using APIs - Tyson Whitten, Director of Solutions Mar...

CA API Management

The document discusses achieving business agility through APIs. It states that while software has allowed for more customer engagement and process automation, software also has limitations in terms of agility. APIs can help overcome these limitations by removing restrictions and allowing data to be connected and accessed across various digital channels like social media, mobile apps, cloud services, and IoT devices. This brings together a business's digital ecosystem and allows them to continuously engage customers, extend their reach, access new ideas, innovate, and stay ahead of competitors to achieve the next level of agility.

More from CA API Management (20)

Api architectures for the modern enterprise

Takeaways from API Security Breaches Webinar

API Design Methodology - Mike Amundsen, Director of API Architecture, API Aca...

Liberating the API Economy with Scale-Free Networks - Mike Amundsen, Director...

API360 – A How-To Guide for Enterprise APIs - Learn how to position your ente...

API Monetization: Unlock the Value of Your Data

Revisiting Geddes' Outlook Tower - Mike Amundsen, Director of API Architectur...

Building APIs That Last for Decades - Irakli Nadareishvili, Director of API S...

The Art of API Design - Ronnie Mitra, Director of API Design, API Academy at ...

5 steps end to end security consumer apps

Gartner AADI Summit Sydney 2014 Implementing the Layer 7 API Management Pla...

Using APIs to Create an Omni-Channel Retail Experience

Panel Session: Security & Privacy for Connected Cars w/ Scott Morrison, SVP ...

Clients Matter, Services Don't - Mike Amundsen's talk from QCon New York 2014

The Connected Car UX Through APIs - Francois Lascelles, VP Solutions Architec...

Is there an API in that (IoT)?

Your New Digital Business & APIs

Mapping the API Landscape - Mike Amundsen, Director of API Architecture

Lean API Strategy - Holger Reinhardt, Snr Principal Business Unit Strategy, L...

Your Journey to Agility using APIs - Tyson Whitten, Director of Solutions Mar...

Recently uploaded

WeTestAthens: Postman's AI & Automation Techniques

Postman

System Design Case Study: Building a Scalable E-Commerce Platform - Hiike

Hiike

AWS Cloud Cost Optimization Presentation.pptx

HarisZaheer8

This presentation provides valuable insights into effective cost-saving techniques on AWS. Learn how to optimize your AWS resources by rightsizing, increasing elasticity, picking the right storage class, and choosing the best pricing model. Additionally, discover essential governance mechanisms to ensure continuous cost efficiency. Whether you are new to AWS or an experienced user, this presentation provides clear and practical tips to help you reduce your cloud costs and get the most out of your budget.

June Patch Tuesday

Ivanti

Ivanti’s Patch Tuesday breakdown goes beyond patching your applications and brings you the intelligence and guidance needed to prioritize where to focus your attention first. Catch early analysis on our Ivanti blog, then join industry expert Chris Goettl for the Patch Tuesday Webinar Event. There we’ll do a deep dive into each of the bulletins and give guidance on the risks associated with the newly-identified vulnerabilities.

dbms calicut university B. sc Cs 4th sem.pdf

Shinana2

“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...

Edge AI and Vision Alliance

For the full video of this presentation, please visit: https://www.edge-ai-vision.com/2024/06/temporal-event-neural-networks-a-more-efficient-alternative-to-the-transformer-a-presentation-from-brainchip/ Chris Jones, Director of Product Management at BrainChip , presents the “Temporal Event Neural Networks: A More Efficient Alternative to the Transformer” tutorial at the May 2024 Embedded Vision Summit. The expansion of AI services necessitates enhanced computational capabilities on edge devices. Temporal Event Neural Networks (TENNs), developed by BrainChip, represent a novel and highly efficient state-space network. TENNs demonstrate exceptional proficiency in handling multi-dimensional streaming data, facilitating advancements in object detection, action recognition, speech enhancement and language model/sequence generation. Through the utilization of polynomial-based continuous convolutions, TENNs streamline models, expedite training processes and significantly diminish memory requirements, achieving notable reductions of up to 50x in parameters and 5,000x in energy consumption compared to prevailing methodologies like transformers. Integration with BrainChip’s Akida neuromorphic hardware IP further enhances TENNs’ capabilities, enabling the realization of highly capable, portable and passively cooled edge devices. This presentation delves into the technical innovations underlying TENNs, presents real-world benchmarks, and elucidates how this cutting-edge approach is positioned to revolutionize edge AI across diverse applications.

leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...

alexjohnson7307

Choosing The Best AWS Service For Your Website + API.pptx

Brandon Minnick, MBA

Have you ever been confused by the myriad of choices offered by AWS for hosting a website or an API? Lambda, Elastic Beanstalk, Lightsail, Amplify, S3 (and more!) can each host websites + APIs. But which one should we choose? Which one is cheapest? Which one is fastest? Which one will scale to meet our needs? Join me in this session as we dive into each AWS hosting service to determine which one is best for your scenario and explain why!

Nordic Marketo Engage User Group_June 13_ 2024.pptx

MichaelKnudsen27

GraphRAG for Life Science to increase LLM accuracy

Tomaz Bratanic

Introduction of Cybersecurity with OSS at Code Europe 2024

Hiroshi SHIBATA

I develop the Ruby programming language, RubyGems, and Bundler, which are package managers for Ruby. Today, I will introduce how to enhance the security of your application using open-source software (OSS) examples from Ruby and RubyGems. The first topic is CVE (Common Vulnerabilities and Exposures). I have published CVEs many times. But what exactly is a CVE? I'll provide a basic understanding of CVEs and explain how to detect and handle vulnerabilities in OSS. Next, let's discuss package managers. Package managers play a critical role in the OSS ecosystem. I'll explain how to manage library dependencies in your application. I'll share insights into how the Ruby and RubyGems core team works to keep our ecosystem safe. By the end of this talk, you'll have a better understanding of how to safeguard your code.

Driving Business Innovation: Latest Generative AI Advancements & Success Story

Safe Software

Are you ready to revolutionize how you handle data? Join us for a webinar where we’ll bring you up to speed with the latest advancements in Generative AI technology and discover how leveraging FME with tools from giants like Google Gemini, Amazon, and Microsoft OpenAI can supercharge your workflow efficiency. During the hour, we’ll take you through: Guest Speaker Segment with Hannah Barrington: Dive into the world of dynamic real estate marketing with Hannah, the Marketing Manager at Workspace Group. Hear firsthand how their team generates engaging descriptions for thousands of office units by integrating diverse data sources—from PDF floorplans to web pages—using FME transformers, like OpenAIVisionConnector and AnthropicVisionConnector. This use case will show you how GenAI can streamline content creation for marketing across the board. Ollama Use Case: Learn how Scenario Specialist Dmitri Bagh has utilized Ollama within FME to input data, create custom models, and enhance security protocols. This segment will include demos to illustrate the full capabilities of FME in AI-driven processes. Custom AI Models: Discover how to leverage FME to build personalized AI models using your data. Whether it’s populating a model with local data for added security or integrating public AI tools, find out how FME facilitates a versatile and secure approach to AI. We’ll wrap up with a live Q&A session where you can engage with our experts on your specific use cases, and learn more about optimizing your data workflows with AI. This webinar is ideal for professionals seeking to harness the power of AI within their data management systems while ensuring high levels of customization and security. Whether you're a novice or an expert, gain actionable insights and strategies to elevate your data processes. Join us to see how FME and AI can revolutionize how you work with data!

Energy Efficient Video Encoding for Cloud and Edge Computing Instances

Alpen-Adria-Universität

Programming Foundation Models with DSPy - Meetup Slides

Zilliz

Trusted Execution Environment for Decentralized Process Mining

LucaBarbaro3

Azure API Management to expose backend services securely

Dinusha Kumarasiri

Digital Marketing Trends in 2024 | Guide for Staying Ahead

Wask

https://www.wask.co/ebooks/digital-marketing-trends-in-2024 Feeling lost in the digital marketing whirlwind of 2024? Technology is changing, consumer habits are evolving, and staying ahead of the curve feels like a never-ending pursuit. This e-book is your compass. Dive into actionable insights to handle the complexities of modern marketing. From hyper-personalization to the power of user-generated content, learn how to build long-term relationships with your audience and unlock the secrets to success in the ever-shifting digital landscape.

Presentation of the OECD Artificial Intelligence Review of Germany

innovationoecd

Columbus Data & Analytics Wednesdays - June 2024

Jason Packer

TrustArc Webinar - 2024 Global Privacy Survey

TrustArc

How does your privacy program stack up against your peers? What challenges are privacy teams tackling and prioritizing in 2024? In the fifth annual Global Privacy Benchmarks Survey, we asked over 1,800 global privacy professionals and business executives to share their perspectives on the current state of privacy inside and outside of their organizations. This year’s report focused on emerging areas of importance for privacy and compliance professionals, including considerations and implications of Artificial Intelligence (AI) technologies, building brand trust, and different approaches for achieving higher privacy competence scores. See how organizational priorities and strategic approaches to data security and privacy are evolving around the globe. This webinar will review: - The top 10 privacy insights from the fifth annual Global Privacy Benchmarks Survey - The top challenges for privacy leaders, practitioners, and organizations in 2024 - Key themes to consider in developing and maintaining your privacy program

Recently uploaded (20)

WeTestAthens: Postman's AI & Automation Techniques

System Design Case Study: Building a Scalable E-Commerce Platform - Hiike

AWS Cloud Cost Optimization Presentation.pptx

June Patch Tuesday

dbms calicut university B. sc Cs 4th sem.pdf

“Temporal Event Neural Networks: A More Efficient Alternative to the Transfor...

leewayhertz.com-AI in predictive maintenance Use cases technologies benefits ...

Choosing The Best AWS Service For Your Website + API.pptx

Nordic Marketo Engage User Group_June 13_ 2024.pptx

GraphRAG for Life Science to increase LLM accuracy

Introduction of Cybersecurity with OSS at Code Europe 2024

Driving Business Innovation: Latest Generative AI Advancements & Success Story

Energy Efficient Video Encoding for Cloud and Edge Computing Instances

Programming Foundation Models with DSPy - Meetup Slides

Trusted Execution Environment for Decentralized Process Mining

Azure API Management to expose backend services securely

Digital Marketing Trends in 2024 | Guide for Staying Ahead

Presentation of the OECD Artificial Intelligence Review of Germany

Columbus Data & Analytics Wednesdays - June 2024

TrustArc Webinar - 2024 Global Privacy Survey

5 Reasons Why APIs Must be Part of Your Mobile Strategy - Scott Morrison, Distinguished Engineer, CA

2. 5 reasons why APIs must be part of your mobile strategy

3. Layer 7 SecureSpan Gateway Secure and Manage Enterprise APIs Gateway Cluster at Edge of Network API/Service Servers  DMZ deployment  Hardware appliance, virtual appliance or software Firewall 2 Firewall 1 … Enterprise Network Cloud SSG Cluster Mobile Devices API/Service Client Partners 3 Directory Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

5. The Essence of the Problem: Secure Mobile Access to Apps and Data API/Service Servers How Do We Make APIs Available?  Firewall mazes Firewall 2  Diversity of clients and back end systems  Clients and servers change at different rates Firewall 1 Directory Enterprise Network Internet Of Particular Interest:  Authentication, Authorization & SSO  Secure Transmission API/Service Client 5 Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

6. We Want Classic SSO In An Active Profile For REST API/Service Servers Could leverage WS-Fed here  SAML’s second act? Directory Internet Apps making RESTful API calls 6 Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

7. But We Also Want Local App SSO API/Service Servers “Like a VPN… but without all of the negatives” Single Sign On App Group (these apps will share sign-on sessions) A B C So now it’s getting interesting… 7 Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

9. Self Service: User should be able to log out if device is lost or stolen 9 Copyright 2013 CA. CA. reserved. No unauthorized copying or Copyright ©©2012All rights All rights reserved. distribution permitted

10. Solution: Native Single Sign-On SDK For Mobile Developers Strong Security for Mobile Apps API Servers  Cross-platform and built for a consumer or BYOD world  100% Standards-based using OAuth+OpenID Connect  X-app SSO with multi-factor auth & secure channel  X.509 Certificate provisioning for strong auth and transaction signing One time PIN SMS, APNS, call Enterprise Network iPhone App-sharable Secure Key Store Android 10 iPad Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

11. Client Deployment Strategy  Don’t make me work hard – But give me a strong and extensible security model  Transfer of security responsibility – Let developers do what they do best  Simple SDK – Align with common development time environments  iOS, Android, Javascript, etc  Mirror REST frameworks  Future – Aspects, wrapping, etc. 11 Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

13. Protocol Strategy OAuth + OpenID Connect  Profiled for mobile  Clear distinction between device, user and app Authorization Server username/password A B ID Token C Per app 13 Access Token/Refresh Token Copyright © 2013 CA. All rights reserved. No unauthorized copying or distribution permitted

14. Questions?

15. K. Scott Morrison Distinguished Engineer Scott.Morrison@ca.com @KScottMorrison slideshare.net/CAinc linkedin.com/KScottMorrison ca.com

Editor's Notes

APIs come with their own problems. You never have just one API. So quickly the issue is scaling access and management.
APIs come with their own problems. You never have just one API. So quickly the issue is scaling access and management.

5 Reasons Why APIs Must be Part of Your Mobile Strategy - Scott Morrison, Distinguished Engineer, CA

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to 5 Reasons Why APIs Must be Part of Your Mobile Strategy - Scott Morrison, Distinguished Engineer, CA

Similar to 5 Reasons Why APIs Must be Part of Your Mobile Strategy - Scott Morrison, Distinguished Engineer, CA (20)

More from CA API Management

More from CA API Management (20)

Recently uploaded

Recently uploaded (20)

5 Reasons Why APIs Must be Part of Your Mobile Strategy - Scott Morrison, Distinguished Engineer, CA

Editor's Notes