The document summarizes an API security meetup hosted by the Perth MuleSoft Meetup Group. The meetup included introductions, a presentation on API security best practices focusing on people, processes, and technology, and an introduction to Anypoint DataGraph. The API security presentation discussed the costs of security breaches, common attack vectors, and the OWASP API security top 10. It emphasized that technology alone cannot mitigate risks and that people and processes must also be established. The DataGraph introduction demonstrated how it can help developers consume data from multiple APIs with a single query.

1. 25-Aug-2021
Perth MuleSoft Meetup Group
API Security Best Practices: People, Process, and Technology
considerations for securing APIs
Introduction to Anypoint DataGraph

2. Welcome
2
Ryan Grondal
Lead Solution Engineer
MuleSoft
Michael Price
Senior Solutions Architect
MuleSoft
A SHOW OF HANDS:
Who is new to this Meetup?

3. 3
● Introductions
● API Security Best Practices: People, Process, and Technology considerations for securing APIs
● Introduction to Anypoint DataGraph
● Wrap-up and Networking
Agenda

4. Presented by Nicholas Bowman
API Security Best Practices: People, Process, and
Technology considerations for securing APIs

7. § Productivity Costs
§ Recovery and Technology Costs
§ Reputation Cost
§ Compliance Costs E.g. ASIC Penalties

8. ‘An Attack Vector is a path or means by which an attacker can gain unauthorized
access to a computer or network to deliver a payload or malicious outcome. Attack
vectors allow attackers to exploit system vulnerabilities, install different types of
malware and launch cyber attacks.
https://www.upguard.com/blog/attack-vector
Weak credentials
Compromised credentials
Malicious insiders
Missing or poor encryption
Misconfiguration
Brute force
Distributed Denial of Service
SQL injections
Cross-site scripting (XSS)

9. OWASP API Security Top 10
https://owasp.org/www-project-api-security/
OWASP Provides a top 10 list of API Security
Vectors.
It’s important to note that these vectors can not be
mitigated with technology alone. Let’s consider the
first 3 in the list:
API1:2019 Broken Object Level Authorization
API2:2019 Broken User Authentication
API3:2019 Excessive Data Exposure

10. Open Discussion – Attack Vectors on API Attack
Surface
App Devs
LoB
Central IT

12. Core C4E
Governance Framework Standards
Estimation Scoping - Gate Estimates
Architecture, Functional design and
Integration Solutions.
Agile Delivery of Technical design
Technology updates and Env Management
Hypercare support, Extended support and
Transition to BAU
Internal Staff SI Partner Third party Vendors
BAU / IT Supp
Dev Lead Dev Dev Dev Dev Lead Dev Lead Dev Dev Dev Dev
Squad 1 Squad 2
ICoE Development resource pool
Onshore – Offshore Development model
IT / Business / Regulatory
Changes
Governance / Design / Delivery
Training and
Assistance
API Specifications
Dev
Ops
Maintenance
and
Initiatives
BAU
Handover
Fixes and
Upgrades
Project
Requirements
Energy and Market Integrations
Customer care and self service
Billing and finance
Data management and automation
Corporate and Enterprise IT Systems
and Business process
Lead Architect Architect Designer
Delivery Stakeholders and Security

13. Key Roles for API Security
Educate Agile Team members to consider API security through the Design and
Development phases. Put up guard-rails with automated processes that limit
Project teams from making the wrong security choices
Empower Security and Integration Architects to govern and evangelize Security
Policies and Standards across the three API tiers. Give them automated Enterprise
tools to enforce standards – E.g. Azure DevOps
Empower Central IT / C4E functions with the right Enterprise Platforms and Tooling
to support API Security – Identity Management, Central Logging, MuleSoft API
Manager. Put in place ACM / Confluence for Security Patterns and Standards

14. 14
© Capgemini 2021. All rights reserved | 14
The Challenge
API Security Uplift – Australian University
Lacking central control of API
Security Policy Enforcement
Outdated Security Techniques and
Standards
Adhoc Encryption and Credential
Management
Generally lacking visibility of who is
accessing APIs internally and externally
The Solution
MuleSoft API Manager Gateway Licensed
and Enabled
Standardise Policy Enforcement of APIs by a
Central Ops Team
Create Layered security for Internal System
of Record APIs and Cloud / Consumer APIs
Integrate with the University’s Identity
Management Platforms – Azure AD and CAS
OOTB and Configurable API Consumption
Analytics and Alerting via a single Pane of
Glass
The Value Delivered
The University can rapidly expose new and
Innovative API channels for their Student
and Staff with Confidence
Operations and Security Teams are empowered to
set Policies and Enforce them by Internal /
External Consumers and Domains
Project Teams can focus on Designing and
Building API for their Business and have the
Security guard-rails in place

15. Summary
Cost of a security breach can be quantified in multiple ways
APIs represent a significant Attack Vector and Attack Surface for security breaches
Tech such as API Runtime Enforcement on API Manager is vital but People and
Processes must be established to make best use of the Runtime Security
Enablement

16. Presented by Michael Price
Introduction to Anypoint DataGraph

17. How is data fragmented across APIs today?

18. 18
Developers still write custom code despite reuse of APIs
Delivery
capacity
Organizations want to increase delivery speed
You are probably here
You are
probably here
Custom code development
Enable reuse
with some
additional work
Enable reuse with
NO additional work

19. 19
Benefits of REST APIs
Secure and manage each service
individually
Share and catalog to promote reuse
by developers
Design logic to capture data for
each system or process easily
IT exposes data with APIs
REST APIs securely expose data across systems to developers
CustID: 10034
CustName: Tim Witz
Username: t.witz
CustEmail: twitz@gmail.com
...
Get me
customer
#10034
Customer API
Customer database
Developer

20. SAP
Developers
IT and architects
20
This means many APIs for developers to consume, and IT to manage
The average enterprise has 900+ systems

21. Consuming many APIs at a time is hard
21
Significant work is needed to parse the data required for each project
● REST APIs are consumed one API at a time,
so you write multiple requests
● With each request, you get all fields - not
just the ones you need
● Custom code is needed to parse the data
needed from each response
Customer API
CustID: 10034
CustName: Tim Witz
Username: t.witz
CustEmail: t.witz@...
...
Find customer
#10034
Order API
OrderID: 48893
CustName: Tim Witz
Product#1: 31122
Product#2: 94430
...
Find
Tim Wetz’s
orders
Product API
ProductID: 31122
ItemName: Ski Jacket
SKU_name: 28821
ItemDesc: ...
...
Find product
31122 from
Order 48893
… Repeat for every API
Why is it hard?

22. 23
Developers can to consume data from multiple APIs at once
Delivery
capacity
Custom code development
Multiple requests
to extract data from
multiple APIs
Serve data across
multiple APIs with
one request
The next leap in accelerating delivery
You are probably here
Present
Past Future
Reuse
multiple APIs
at once
No APIs
Reuse
one API
at a time

23. This is where Anypoint DataGraph changes the game

24. 25
A query language for your API
“GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data.
GraphQL provides a complete and understandable description of the data in your API, gives clients the
power to ask for exactly what they need and nothing more, makes it easier to evolve APIs over time, and
enables powerful developer tools.”
https://graphql.org/
What is GraphQL?

25. A graph of APIs unlocks new efficiencies
Product Customer Shipment
Invoice Order
Invoice Total
Order ID
Customer ID
Product ID
Shipment ID
Customer ID
Order ID
Order Status
Shipment ID
Exp. Delivery Date
Tracking ID
Customer ID
Customer Email
Customer Address
Product ID
Product Name
Stock
Developers

26. Show me my orders,
status and expected
delivery
The graph serves data with a single query
Product Customer Shipment
Invoice Order
Invoice Total
Order ID
Customer ID
Product ID
Shipment ID
Customer ID
Order ID
Order Status
Shipment ID
Exp. Delivery Date
Tracking ID
Customer ID
Customer Email
Customer Address
Product ID
Product Name
Stock
Developers

27. Developers
Show me all products,
stock and delivery date
The graph can be reused to speed up projects
Product Customer Shipment
Invoice Order
Invoice Total
Order ID
Customer ID
Product ID
Shipment ID
Customer ID
Order ID
Order Status
Shipment ID
Exp. Delivery Date
Tracking ID
Customer ID
Customer Email
Customer Address
Product ID
Product Name
Stock

28. Anypoint DataGraph
29
Serve data from all your APIs to developers instantly
Unify APIs into powerful data services
Explore, unify and serve data from all your APIs into
powerful services, without new code
Consume many APIs a single request
Enable developers to consume multiple APIs at once with
a single, visually built GraphQL query
Reach new levels of productivity
Replace custom code for many API requests with a
managed service that requires no maintenance

29. Demo

30. 31
● Share:
○ Tweet using the hashtag #MuleSoftMeetups
○ Invite your network to join: https://meetups.mulesoft.com/
● Feedback:
○ Fill out the survey feedback and suggest topics for upcoming events
○ Contact MuleSoft at meetups@mulesoft.com for ways to improve the program
What’s next?

31. Introduce yourself to your neighbor
Networking Time

32. Thank you

33. Announcements

34. Product
35

35. Studio 7.10

36. Notification and management of new Mule Module versions
(connectors)
Improvements to the Mule development experience
Studio 7.10
Metadata Assistant
● Users can now extract and propagate metadata
across subflows with a few clicks through a new
wizard
Improvements to renaming flow references
● Changes on a flow name will be propagated
automatically across flow references
In-product notifications for new versions of connectors
● Proactive notification when a connector in use has
a new version available.
● Launches a management window to see all
connectors with new versions available.
APIKit OData 4.0.0 Beta Support
● Availability to use the OData protocol for
connectivity
37
1
2

37. Simplified publication and metadata management
Exchange July Release
Simpler automated builds for publishing and
managing assets in Exchange
With a single API call add documentation, images,
categories, tags and custom fields while publishing
new asset versions using:
● Exchange API v2
● Maven API v3
● Anypoint-cli
Add documentation pages, specify page ordering
and add images during asset publication
Asset Binary
Doc
Pages
Images
Tags
Categories
Custom
Fields
Maven
Facade
Anypoint-cli
Exchange
API
Automate & manage assets in one easy
step
Comprehensive Publication API

38. New: Industry Meetups
39

39. New: Industry Meetup groups
Industry-focused Meetup groups encourage customers from the same industry to connect.
Examples of industry groups:
● Healthcare and Life Sciences
● Finance
● Public sector and Government
● Retail and Consumer Goods
● Communications, Media and Technology
An opportunity for you:
● Discover use cases from others,
● Get inspired for future projects,
● Make new connections,
● Receive complimentary training courses by leading a
group or giving a talk!
How to participate:
1. Start a group, organize events and bring your peers
together. Fill out this form: Link
2. Speak at an event and get free training! Contact
mariana.lemus@mulesoft.com

40. Friends of Max video series
41

41. What’s New & What’s Trending
Friends of Max
1. How to create an API specification in RAML
2. Setting up HTTPS
3. Customizing API Communities Part 1: Create a community
and build a landing page
4. Customizing API Communities Part 2: Custom login,
register, search, and community news experiences
5. Customizing API Communities Part 3: How to customize
your API and Forum experiences
6. MuleSoft's API Community Manager | Friends of Max
Demonstration
42
1. 5 steps to operationalize monitoring
2. MuleSoft multi-region deployment deep dive
3. Multi-factor authentication for Anypoint
Platform
4. Anypoint Business Groups - Part 1
5. Anypoint Platform: Connected Apps
6. MuleSoft Government Cloud FedRamp and DoD
Impact Levels
What’s new with Friends of Max? New Videos in August

42. Thank you!
43