The document discusses lessons learned from a case study of Aaramshop, an online organic products store. Forty2.io, a CA accelerator, worked with Aaramshop over a year to identify growth opportunities, improve the customer experience, and optimize go-to-market channels. They also collaborated to protect Aaramshop's APIs from threats like hijacking and injection attacks. The document outlines five key lessons learned and recommends how companies can benefit from data and APIs to accelerate e-commerce.

1. World®
’16
Case Study: Aaramshop—Top Five
Lessons Learned About Accelerating
E-Commerce With Data and APIs
Jin Zhang - Founder - Forty2.io
Scott Morrison - Distinguished Engineer - CA Technologies
DO3X15S
DEVOPS

2. 2 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
© 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies.
The content provided in this CA World 2016 presentation is intended for informational purposes only and does not form any type
of warranty. The information provided by a CA partner and/or CA customer has not been reviewed for accuracy by CA.
For Informational Purposes Only
Terms of this Presentation

3. 3 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Abstract
Aaramshop is an online store that promotes local and organic supplies. In the one-
year journey since CA World 2015, Forty2.io, a CA Accelerator, has worked closely
with Aaramshop to identify business growth opportunities. The two also
collaborated to alert web application bottlenecks and to protect web resources,
including APIs. All of these are fueled by data-driven prediction and prescription,
including pattern recognition, anomaly detection, automatic shield against API
hijacking, scaling and abuse. In this session, we share lessons learned about how
your business can truly benefit from data and APIs.
Scott
Morrison
CA Technologies
Distinguished Engineer
Jin
Zhang
Forty2.io
Founder

4. 4 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Agenda
AARAMSHOP AND FORTY2.IO
5 LESSONS LEARNED
WHAT WE ARE EXPLORING NEXT
1
2
3

5. 5 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
About CA Accelerator
“Enterprise startups”
CA’s innovation engine
Visit ca.com/accelerator

6. 6 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Focus on Organic Product Innovation
§ Listen to customers
§ US East and West incubation
§ Fail fast – and safe
§ Fresh blood
§ Review process, just like venture
capitalists J
§ Forty2.io is one of the incubation
projects

7. 7 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Digital Transformation
Creating something new—new markets, new products and new
areas of growth and revenues.
= Opportunities for Companies That Embrace It
Companies who are not embracing this change are quickly becoming irrelevant and will
likely no longer play a significant role in the next 5–10 years.

8. 8 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Protection of revenue, brand and data
Maximization of IT utilization: cost savings,
ability to serve more to customers
Increase of productivity: ability to identify
risks and thefts quicker
A Solution: forty2.io
forty2.io is an analytics driven app which protects digital businesses with one click resolution:

9. 9 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Aaramshop
§ Aiming to be the Uber for grocers
§ A platform connecting local grocers and consumers
§ Fresh, easy, local, relationship-based
§ Mobile app campaign following Diwali season

10. 10 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Our Learning and Discovery
Growth Opportunity Customer Experience GTM Channel

11. 11 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Three Initial Discoveries – Growth Opportunity

12. 12 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Three Initial Discoveries – Customer Experience

13. 13 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Three Initial Discoveries – GTM Channel

14. 14 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
What We Are Exploring Next
§ Single pane of glass
§ More growth opportunity
§ API Protection
– API Hijacking
– Script Insertion
– SQL Injection

15. 15 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
APIs Are Based on the Architecture of the Web
So can we just re-use our web security strategies?
We need to be wary of bad web
development practices migrating to
APIs…
API Development != Web Development

16. 16 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Traditional Web Apps Constrain Interaction
HTTP
Server
Users
Browser App
Server
Database
Pages Objects Records
Rendered
View
Constraint Space
Firewall 1 Firewall 2

17. 17 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
APIs in Contrast Offer a More Direct Conduit to Data
HTTP
Server
Attacker
Browser App
Server
Database
Objects Records
Rendered
Web View
Often:
• Self-documenting
• Closely mapped to object
space, data structure, etc
APIs can leak
information

18. 18 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
APIs Increase Attack Surface
HTTP
Server
Attacker
Browser
App
Server Database
Users
Browser
Traditional Web
APIs
Granularity
Boundary
Granularity
Boundary

19. 19 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Insertion Attacks Are A Common Attack Vector
Source: https://xkcd.com/327/
Exploits of a Mom
Insertion attacks are really about using leveraging
unconstrained parameters to exploit remote processing
engines (both server or other clients)

20. 20 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
So Are Man-In-The-Middle Attacks
HTTP
Server
Users
App App
Server
Database
Breeches in:
• Integrity
• Confidentiality

21. 21 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
The Best Practice Is To Use API Gateways For Security
API
Gateway
Users
Apps
Takes Care of:
• Authentication
• Authorization
• Integrity
• Confidentiality
• Audit
• Key Management
• IAM integration
• Parameter hygiene
• Filtering
• etc…
Directory

22. 22 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
APIM Brings About a Positive Shift in Responsibility
Developers Security Pros

23. 23 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Summary
CA
Accelerators
Lean Startup
Aaramshop
Learning
API
Protection
Mitigation tipsSolve real problem, fast

24. 24 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Recommended Sessions
SESSION # TITLE DATE/TIME
SCX71S
The answer is Forty2 - How Analytics-backed
Bot Mitigation Helped Insillicum
11/16/2016 at 03:00 pm
DO3T05S
Case Study: LG&E/KU—How Mobile Apps,
APIs With Microservices and CA API
Management are Helping to Shape the
Company’s Future
11/16/2016 at 03:45 pm
IET02T
Leveraging Machine Learning to Protect web
Apps from Cyber-attacks
11/17/2016 at 03:00 pm

25. 25 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Must See Demos
API Insights
CA API Management
DevOps – API
Management
Protect APIs Integrate IoT
CA API Management
DevOps – API
Management
Launch Faster
CA API Management
DevOps – API
Management

26. 26 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Questions?

27. 27 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Thank you.
Stay connected at communities.ca.com

28. 28 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
DevOps – API Management and
Application Development
For more information on DevOps – API Management and
Application Development, please visit: http://cainc.to/DL8ozQ