The document discusses applying zero-trust security with API-led connectivity. It begins by describing traditional trust boundary based security and its limitations. It then defines the zero-trust mindset, which assumes nothing and no one can be trusted and everything needs to be verified. The document outlines how adopting a zero-trust model impacts infrastructure, application, and data security layers. It argues a zero-trust architecture is now needed rather than relying only on network segmentation and IAM. The document concludes by describing how MuleSoft's Anypoint Platform enables building APIs in a way that is contextual, secure and aligned with a zero-trust approach.

1. All contents © MuleSoft, LLC
Kiet.Yap@mulesoft.com - Distinguished Client Architect
MuleSoft France
Applying Zero-Trust Security
with API-Led Connectivity

2. All contents © MuleSoft, LLC 2
Thank you

3. All contents © MuleSoft, LLC
Safe harbor statement
The information in this presentation is confidential and proprietary to MuleSoft and may not be disclosed without
the permission of MuleSoft. This presentation is not subject to your license agreement or any other service or
subscription agreement with MuleSoft. MuleSoft has no obligation to pursue any course of business outlined in this
document or any related presentation, or to develop or release any functionality mentioned therein. This document,
or any related presentation and MuleSoft's strategy and possible future developments, products and or platforms
directions and functionality are all subject to change and may be changed by MuleSoft at any time for any reason
without notice. The information on this document is not a commitment, promise or legal obligation to deliver any
material, code or functionality. This document is provided without a warranty of any kind, either express or implied,
including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-
infringement. This document is for informational purposes and may not be incorporated into a contract. MuleSoft
assumes no responsibility for errors or omissions in this document, except if such damages were caused by MuleSoft
intentionally or grossly negligent.
All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ
materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking
statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.
3

4. All contents © MuleSoft, LLC
Agenda
1. Current Security Landscape and Approaches
2. Security to Cybersecurity Challenges
3. Defining Zero-Trust Mindset
4. How to adopt APIs with Zero-Trust Model
4

5. All contents © MuleSoft, LLC
Traditional trust boundary based security
“If the enemy can’t get in, you can’t get out” – para. Tacitus
● Using Network level security to segregate
responsibilities
● Using Intrinsic Product Level security /
AuthN / AuthZ to secure the access when
possible, other delegate to IAM
● Create groups of “trust”: if I know who you
are and where you are coming from, you
have access. Otherwise, NO
● The strategy is security by “no”
Firewall
Firewall
Identity
&
Access
Management
Trusted
(VPN)
Untrusted

6. All contents © MuleSoft, LLC
Passenger Journey at the airport
6
Passport
Control
Register
Passenger into
the flight
Register
Luggage into
the flight
Mark the
Passenger as
away from the
territory
Encourage the
Passenger to leave
some money before
leaving
Please the Passenger
with Champagne to
make sure she/he
flies more often
Time to leave
Restricted Area
Public Area
Boarding Area
From a pure functional perspective

7. All contents © MuleSoft, LLC
Passenger Journey at the airport
If we use a centralized API Gateway approach to secure the Journey
7
Check-in
Lounge
Access
Boarding
Hand
Luggage
Immigration
Duty Free
Shopping
Check the
boarding pass,
passport and
the passenger
Check the
boarding pass
Check the boarding
pass and the
membership status
Check the
passport and
the boarding
pass
Public
Gateway
Internal
Gateway
Check the
passport
against the
passenger
Check the
contain of the
luggage
Restricted Area
Public Area
Boarding Area

8. All contents © MuleSoft, LLC
Passenger Journey at the airport
No airport in the world is doing this because…
8
Check-in
Lounge
Access
Boarding
Hand
Luggage
Immigration
Duty Free
Shopping
Bypassing the
immigration
control
Escaping /
Switching
Passport /
Boarding Pass
Public
Gateway
Internal
Gateway
Switch the
luggage
Switch
Passport after
the security
check
Restricted Area
Public Area
Boarding Area

9. All contents © MuleSoft, LLC
Applying the same pattern with APIs
9
API
API
API
API
API
API
Gateway Gateway
DMZ
Internet Intranet
Do we really want to do that?

10. All contents © MuleSoft, LLC
Agenda
1. Current Security Landscape and Approaches
2. Security to Cybersecurity Challenges
3. Defining Zero-Trust Mindset
4. How to adopt APIs with Zero-Trust Model
10

11. All contents © MuleSoft, LLC
APIs Enable Businesses…
11
Connect With Customers and Streamline Operations
▪ APIs expose sensitive data
▪ The attack surface is expanding
▪ APIs are the attack vector of choice
for hackers to disrupt your service
or gain access to private information
But also enable hackers with more doors to attack

12. All contents © MuleSoft, LLC
Danger of Considering a Traditional API Gateway
Cyber Security is about preventing unauthorized information access and protect delivery of
essential services from
• Remote attacks
• Misconfiguration of physical systems
• Holes in complex and unstructured information networks
A black-box based Gateway or Proxy to protect from
Brute Force Attack are not sufficient
as a Cyber Security layer
12

13. All contents © MuleSoft, LLC
Modern Security Posture
13
▪ Security has changed from keeping the
bad guys out and the good guys in, to
TRUST NOBODY (zero-trust model).
Insider Threats are more prevalent than
previously understood
▪ Security by the “no” is unacceptable.
Protection is about applying industry
standards across layers of security and
defense in depth (OWASP, SANS, NIST,
PCI, ISACA ISO27k)
▪ The strategy is no longer security by
“no”, it is now security by ”know”
https://www.business.com/articles/cybersecurity-
inside-outside-threats/

14. All contents © MuleSoft, LLC
Agenda
1. Current Security Landscape and Approaches
2. Security to Cybersecurity Challenges
3. Defining Zero-Trust Mindset
4. How to adopt APIs with Zero-Trust Model
14

15. All contents © MuleSoft, LLC
https://doubleoctopus.com/security-wiki/network-architecture/zero-trust/
“Zero Trust, Zero Trust Network, or Zero Trust Architecture refer to
security concepts and threat model that no longer assumes that
actors, systems or services operating from within the security
perimeter should be automatically trusted…
…and instead must verify anything and everything trying to
connect to its systems before granting access”

16. All contents © MuleSoft, LLC
Actual Passenger Journey at the airport
16
Passport
Control
Register
Passenger into
the flight
Register
Luggage into
the flight
Mark the
Passenger as
away from the
territory
Encourage the
Passenger to leave
some money before
leaving
Please the Passenger
with Champagne to
make sure she/he
flies more often
Time to leave
Check the
contain of the
luggage
Check the
boarding pass,
passport and
the passenger
Check the
boarding pass
Check the boarding
pass and the
membership status
Check the
passport and
the boarding
pass
Check the
passport
against the
passenger
Apply the right security, in the right context, at the right moment

17. All contents © MuleSoft, LLC
Major Impact of Zero-Trust Architecture
17
• Concept of Internet/DMZ/Intranet + Identity and Access Management are no more
sufficient
• Redefining roles in Zero-Trust model
– Infrastructure level (Firewall, Network Segment, hardware based encryption, signature)
• To filter out “syntactically” brute force attack or bad requests (wrong origin, wrong signature…)
– Application level (request authentication, user authentication, authorization)
• To trust “semantically” the incoming request by enforcing validation, in the application
– Data level (encryption, masking, tokenization)
• To expose “contextually” the necessary data only

18. All contents © MuleSoft, LLC
Major Impact of Zero-Trust Architecture
18
• Concept of Internet/DMZ/Intranet + Identity and Access Management are no more
sufficient
• Redefining roles in Zero-Trust model
– Infrastructure level (Firewall, Network Segment, hardware based encryption, signature)
• To filter out “syntactically” brute force attack or bad requests (wrong origin, wrong signature…)
– Application level (request authentication, user authentication, authorization)
• To trust “semantically” the incoming request by enforcing validation, in the application
– Data level (encryption, masking, tokenization)
• To expose “contextually” the necessary data securely
While the network segmentation is needed, it can’t be considered as a factor of
trust anymore
Each exposed service must have the capability to enforce the access control
and to filter the data based on the usage context at the endpoint level

19. All contents © MuleSoft, LLC
Agenda
1. Current Security Landscape and Approaches
2. Security to Cybersecurity Challenges
3. Defining Zero-Trust Mindset
4. How to adopt APIs with Zero-Trust Model
19

20. All contents © MuleSoft, LLC
One platform for APIs and Integrations
20
Anypoint Platform

21. All contents © MuleSoft, LLC
Modern APIs: Core enabler for API-led connectivity
21
Core capabilities in reusable
building blocks
Easily managed for security,
scalability, and performance
Discoverable and accessible
through self-service
Productized and designed for
ease of consumption
Customer ID Order history
API contract
Logic
Connectivity
Customer orders

22. All contents © MuleSoft, LLC
The API-Led Connectivity
Web app API
Orders
Salesforce
customers
SAP
customers
Toll
shipments
UPS
shipments
Shipment
status
Order history
Customers
Order status
Mobile API
Process
APIs
Experience
APIs
System
APIs
Contextually built APIs
22

23. All contents © MuleSoft, LLC
The API-Led Connectivity
Web app API
Orders
Salesforce
customers
SAP
customers
Toll
shipments
UPS
shipments
Shipment
status
Order history
Customers
Order status
Mobile API
Process
APIs
Experience
APIs
System
APIs
Contextually and Securely built APIs
23

24. All contents © MuleSoft, LLC
The API-Led Connectivity with Anypoint Security Edge
Web app API
Orders
Salesforce
customers
SAP
customers
Toll
shipments
UPS
shipments
Shipment
status
Order history
Customers
Order status
Mobile API
Process
APIs
Experience
APIs
System
APIs
Contextually and Securely built APIs with DDoS Protection
24

25. All contents © MuleSoft, LLC
Zero Trust Security – Risk Level per Access Type
25
Medium Low
High Medium
● Zero Trust Security is not about
functions & feature
● Resonate in terms of
entitlement, not encryptions or
protocols
● Apply proven patterns & security
Blueprint to leverage existing
best practices
● Enrich with custom
enforcement only if necessarily
Sensitive
Data
Non Sensitive
Data
Managed Source (Network and Application)
(Internal Application, Secured Apps, Self created Mobile App)
Un-Managed Source (Network AND/OR Application)
(Partner application , 3rd Party Mobile Applications)

26. All contents © MuleSoft, LLC
Client Credential Mode (Internal)

27. All contents © MuleSoft, LLC
Client Credential Mode (External)

28. All contents © MuleSoft, LLC
Resource Password Owner Mode

29. All contents © MuleSoft, LLC
Authorization Code Mode

30. All contents © MuleSoft, LLC
Authorization Code + One Time Pin Mode

31. All contents © MuleSoft, LLC
MuleSoft Zero-Trust Model
With API-Led Connectivity on Anypoint Platform
31
MuleSoft API Security
Model
Firewall Firewall
Customers /External
Applications
Physical
Isolation
Gateway
Gateway
Trusted Users
(VPN)
Trusted Services
Proxies
Employee
Trusted
Partner
Security by
the “know”
Security by the “no”
Traditional API “Gateway” Model
System of Records
Individual Isolation with access control
(Virtual Gateway attached to each API)
Individual Isolation with access control
(Virtual Gateway attached to each API)
Edge Gateway to protect from
Brute force Attack
Edge Gateway to protect from
Brute force Attack
Firewall
DMZ
DMZ
2-Ways TLS
Websocket

32. All contents © MuleSoft, LLC
Thank you