APIsecure 2023 - For flex(ibility) sake, modernize your legacy APIs!, Topher Marie (Strata Identity)

For flex(ibility)'s
sake, modernize
your legacy APIs!
APISecure
March 15, 2023

© Strata Identity Inc. 2022. All Rights Reserved. Patents Pending.
Topher Marie
2
• CTO and Cofounder of Strata Identity
• Lead Identity Architect at Oracle
• Product Owner at Auth0
• CTO and Cofounder of JumpCloud
• Engineer at Ping Identity and Symplified

What do we mean by "Legacy?"
• Contrast new development and "Legacy" software
• Legacy software is currently and actively used by its intended audience
• Can be from many different sources
• COTS
• Enterprise platforms
• Bespoke
3

"Legacy" software is important too!
• We discuss new development a lot!
• A lot of effort is actually on existing software
• Maintenance and enhancements
• The business use case continues to be important, but the underlying
software may be beginning to age out.
• Vulnerabilities accrue
• Paradigms have changed
4

What do we mean by "Modernization"
• No need/desire to update business functionality
• At least, this isn't the focus
• Security and Access Control fixes
• Enhanced useability is often a side effect
• Latest API frameworks/behaviors
5

Typical trigger scenarios
• Legacy system reaches EOL
• Price increases for a legacy platform.
• Centralizing responsibility for security/access management into a
single team
• Adding security to an existing app via second-factor auth.
• Improving overall security posture, moving to zero-trust
• Difficult to maintain because of talent availability
6

Some goals of modernization
● Fix vulnerabilities, enhance security
● Take advantage of popular/modern frameworks
○ Don't undervalue the power of community
● Follow current best practices
7

Tactics for Modernization
Not every modernization journey is the same
8

Default Tactic: Do a rewrite
• This is what most engineers think about first
• Lots of professional services companies and consultants like to do this too
9

Some downsides to rewrites
• Budget
• Time
• Complexity
• Lack of expertise
• Risk of breakage
• Security
• Business use cases
• Can you stop developing in the existing codebase? Or is it a moving
target.
• Rewrite of Netscape killed the company
10

The rewrite treadmill
• Constant evolution of security
• OAuth best practices, but now SSE / CAEP
• Basic API paradigms: REST -> RPC -> GraphQL
11

Tactic: facade
• Wrap the existing software with enhanced functionality
• Facade acts as a proxy to the existing API
• Similar to the Mediator pattern in some ways
• API or application itself is not changed
• Current best practices are applied at the facade
• Security
• Access Control
• API Paradigm
12

Tactic: facade
13

Benefits of the facade
• API doesn't know anything has changed
• Old functionality is always still available
• Less risk to business logic
• Can be incrementally deployed / developed
• Security, access control, even API paradigm can be decoupled from the
business logic
14

Why decouple?
• If we don't decouple here, we're basically rewriting the app
• Software and security are constantly evolving.
• Without decoupling, we have a new legacy product on our hands
immediately.
• Maintains flexibility for similar changes in the future
15

Creating your facade
Get a bite at the traffic by routing through a proxy point
16

Iron out the networking
By not doing much other than proxying traffic, you can make sure you can
route traffic appropriately
17

Prepare traffic filtering
18

Allows an incremental approach
• We don't want a big bang cutover
• We're able to make incremental changes via the facade / abstraction layer
and show immediate value.
19

Aside: the Big-Bang Antipattern
• Significant project risk and investment.
20

Modernize the protocol
• If needed, this is also a good time to modernize the API protocols
themselves
• Could also just be adding additional options
• From legacy to REST
• Add json, jwts, etc.
21

Decouple the identity
• Target App/API receives identity from the proxy/abstraction layer in the
expected format
• Proxy receives the identity from the existing identity provider
• Each application / identity provider can be migrated separately.
22

Harden the identity
• With this abstraction layer, we can now layer in additional factors
• Add in step-up authentication for incoming identity
• Add mutual TLS for outbound identity
• Continuous Access Evaluation Protocol
• Risk Incident Sharing and Coordination
23

Externalize Authorization
• For resources that aren't focused on authorization, the facade layer
becomes a point where authorization can be implemented
24

Improve practices
• Continuous Integration
• Regression testing
• Documentation
25

Companies that work in this space
• Apigee, Amazon
• Tyk, Mulesoft, Kong
• Strata Identity
26

APIsecure 2023 - For flex(ibility) sake, modernize your legacy APIs!, Topher Marie (Strata Identity)

Recommended

Recommended

More Related Content

Similar to APIsecure 2023 - For flex(ibility) sake, modernize your legacy APIs!, Topher Marie (Strata Identity)

Similar to APIsecure 2023 - For flex(ibility) sake, modernize your legacy APIs!, Topher Marie (Strata Identity) (20)

More from apidays

More from apidays (20)

Recently uploaded

Recently uploaded (20)

APIsecure 2023 - For flex(ibility) sake, modernize your legacy APIs!, Topher Marie (Strata Identity)