This deck will cover what is SCA, the regulatory requirements, the exemptions, SCA approaches, configuring default authenticators and customizing SCA based components.
Watch the Webinar On-Demand here - https://wso2.com/solutions/financial/open-banking/webinars/uk/
[WSO2 API Day Chicago 2019] Sustainable Competitive Advantage WSO2
Sustainable competitive advantage, while once a necessary part of any strategy, is now increasingly obsolete for most firms. The new path to winning means capturing opportunities quickly and exploiting them decisively. It's all about learning to thrive in a transient advantage economy. Transient advantage is the central thesis of Rita McGrath's recent book on competitive advantage. These principles are especially relevant for agile companies that pursue digital-first business models. Quinnox has adopted this philosophy for its clients and its own business where we believe enterprise integration driven by API's is the bridge to digital transformation, speed to market, and frequency to market.
42Crunch Security Audit for WSO2 API Manager 3.1WSO2
API Security has become an important concern in recent times as organizations are more cautious about exposing raw, sensitive data via APIs. Therefore, it is important that APIs adhere to the OpenAPI Specification (OAS) to ensure API security.
WSO2 has partnered with 42Crunch, to bring in the ability to conduct a security audit on the OpenAPI Specification definition, and to obtain an audit report.
The WSO2 API Manager 3.1 brings a lot of interesting features, including the ability to run 42Crunch’s audit tool directly from the API Publishing portal.
In this webinar, we will:
- Explain the advantages of introducing security at design time
- Introduce the 42Crunch audit functionality
- Explain how 42Crunch and WSO2 API Manager can be used together for better API Security
Which APIs? which business models - A real-world guide for African banks.WSO2
learn how banks of different sizes within the African financial services ecosystems can choose between different API-enabled business models to cut costs, streamline internal workflows and deliver better consumer experiences.
[APIdays INTERFACE 2021] The Evolution of API Security for Client-side Applic...WSO2
Client-side applications are becoming an increasingly popular technology to build applications owing to the advanced user experience that they provide consumers. Authentication and API authorization for these applications are also becoming equally popular topics that many developers have a hard time getting their heads around.
Check these slides, where Johann Nallathamby, Head of Solutions Architecture for IAM at WSO2, will attempt to demystify some complexities and misconceptions surrounding this topic and help you better understand the most important features to consider when choosing an authentication and API authorization solution for client-side applications.
These slides will review:
- The broader classification of client-side applications and their legacy and more recent authentication and API authorization patterns
- Sender-constrained token patterns
- Solution patterns being employed to improve user experience in client-side applications
This presentation will illustrate what is the common issues when the API is made publicly available, how API gateway can be utilized to enhance security, performance improvement can be accomplished by using API gateway.
[WSO2 API Day Chicago 2019] Sustainable Competitive Advantage WSO2
Sustainable competitive advantage, while once a necessary part of any strategy, is now increasingly obsolete for most firms. The new path to winning means capturing opportunities quickly and exploiting them decisively. It's all about learning to thrive in a transient advantage economy. Transient advantage is the central thesis of Rita McGrath's recent book on competitive advantage. These principles are especially relevant for agile companies that pursue digital-first business models. Quinnox has adopted this philosophy for its clients and its own business where we believe enterprise integration driven by API's is the bridge to digital transformation, speed to market, and frequency to market.
42Crunch Security Audit for WSO2 API Manager 3.1WSO2
API Security has become an important concern in recent times as organizations are more cautious about exposing raw, sensitive data via APIs. Therefore, it is important that APIs adhere to the OpenAPI Specification (OAS) to ensure API security.
WSO2 has partnered with 42Crunch, to bring in the ability to conduct a security audit on the OpenAPI Specification definition, and to obtain an audit report.
The WSO2 API Manager 3.1 brings a lot of interesting features, including the ability to run 42Crunch’s audit tool directly from the API Publishing portal.
In this webinar, we will:
- Explain the advantages of introducing security at design time
- Introduce the 42Crunch audit functionality
- Explain how 42Crunch and WSO2 API Manager can be used together for better API Security
Which APIs? which business models - A real-world guide for African banks.WSO2
learn how banks of different sizes within the African financial services ecosystems can choose between different API-enabled business models to cut costs, streamline internal workflows and deliver better consumer experiences.
[APIdays INTERFACE 2021] The Evolution of API Security for Client-side Applic...WSO2
Client-side applications are becoming an increasingly popular technology to build applications owing to the advanced user experience that they provide consumers. Authentication and API authorization for these applications are also becoming equally popular topics that many developers have a hard time getting their heads around.
Check these slides, where Johann Nallathamby, Head of Solutions Architecture for IAM at WSO2, will attempt to demystify some complexities and misconceptions surrounding this topic and help you better understand the most important features to consider when choosing an authentication and API authorization solution for client-side applications.
These slides will review:
- The broader classification of client-side applications and their legacy and more recent authentication and API authorization patterns
- Sender-constrained token patterns
- Solution patterns being employed to improve user experience in client-side applications
This presentation will illustrate what is the common issues when the API is made publicly available, how API gateway can be utilized to enhance security, performance improvement can be accomplished by using API gateway.
Agenda:
What is BPM?
BPM Benefits and Usage Fields
Camunda BPM Engine
Business Process Model and Notation
BPMN 2.0 Elements
What is Camunda?
Technical Architecture
Why Camunda
Demo
This session is all about Gravitee.io that consists of two modules: Gravitee.io Access Management, which is responsible for providing Authentication and Authorization with help of OAuth2.0 and OpenID Connect, and Gravitee.io API Management, which is responsible for the management of APIs, by simply publishing and consuming the APIs.
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...apidays
apidays LIVE India 2021 - Connecting 1.3 billion digital innovators
May 20, 2021
Asynchronous and Broadcasting APIs using Kafka
Rohit Saxena, Software Development Consultant at Guardian Life
Polling-based APIs or the RESTful APIs were the main building blocks of traditional integration stories. But with the need to respond to events in real-time, integration architecture has shifted from being polling-based to event-driven. With the emergence of reactive event-driven architecture, the asynchronous APIs were able to hold their distinct position in modern-day integrations.
Even though the event-driven APIs provide their own advantages such as high resiliency, high responsiveness, and more, management of asynchronous APIs continues to be a challenge to the organizations.
The AsyncAPI specification plays a major role in the event-driven world by providing a specification to describe and document the asynchronous APIs. These slides will explore the entire flow from creating an asynchronous API to exposing it as a managed API by adhering to the AsyncAPI specification.
INTERFACE, by apidays - The future of API Management in a hybrid, multi-clou...apidays
INTERFACE, by apidays 2021 - It’s APIs all the way down
June 30, July 1 & 2, 2021
The future of API Management in a hybrid, multi-cloud world
Shaun Clowes, SVP of Product at Mulesoft
This webinar will give an overview of the conventional login forms and currently more popular logins via social networks. Further, we will discuss adopting Social Logins in your applications and an Identity Hub’s role there to overcome any added overhead.
Watch the on-demand webinar here: https://wso2.com/library/webinars/identity-hubs-role-in-social-logins/
In this community call, we will discuss the highlights of WSO2 API Manager 4.0 including
- Why we moved from WSO2 API Manager 3.2.0 to 4.0.0.
- New architectural changes
- Overview of the new features with a demo
- Improvements to the existing features and deprecated features
Recording: https://youtu.be/_ks4zEeRFdk
Sign up to get notified of future calls: https://bit.ly/373f4ae
WSO2 API Manager Community Channels:
- Slack: https://apim-slack.wso2.com
- Twitter: https://twitter.com/wso2apimanager
Leveraging Async APIs to deliver cross domain agile collaboration Nuwan Dias
How Asynchronous APIs help organizations to collaborate with each other. Discusses the differences and usages of synchronous and asynchronous APIs, talk through challenges faced by organizations when using Asynchronous APIs and how to overcome them as well.
View on-demand: https://wso2.com/library/webinars/api-security-best-practices-and-guidelines/
Modern enterprises are increasingly adopting APIs, exceeding all predictions. With more businesses investing in microservices and the increased consumption of cloud APIs, you need to secure beyond just a handful of well-known APIs. You will need to secure a higher number of internal and external endpoints.
At the same time, security itself is a broad area and vendors implement a number of seemingly similar standards and patterns, making it very difficult for consumers to settle on the best option for securing APIs. The sheer number of options can be very confusing.
There is much to learn about API security, regardless of whether you are a novice or expert and it’s extremely important that you do because security is an integral part of any development project, including API ecosystems.
This webinar will deep-dive into the importance of API security, API security patterns, and how identity and access management (IAM) fit in the ecosystem.
DURING THE WEBINAR, WE WILL COVER:
Managed APIs
OAuth 2.0 and API security patterns
Introduction to WSO2 Identity Server
How we align with OWASP API security guidelines
The cloud is rapidly becoming the de-facto standard for deploying enterprise applications. Microservices are at the core of building cloud-native applications due to its proven advantages such as granularity, cloud-native deployment, and scalability. With the exponential growth of the consumer base of these service offerings, enforcing microservice/API security has become one of the biggest challenges to overcome.
In this deck, we discuss:
- The need for API/Microservices Security
- The importance of delegating security enforcement to an API Gateway
- API Authentication and Authorization methodologies
- OAuth2 - The de-facto standard of API Authentication
- Protection against cyber attacks and anomalies
- Security aspects to consider when designing Single Page Applications (SPAs)
Watch the webinar on-demand here - https://wso2.com/library/webinars/2019/11/api-security-in-a-cloud-native-era/
WSO2- OSC Korea - Accelerating Digital Businesses with APIsWSO2
APIs are taking over every vertical out there with its standards, reusability, and simplicity that are required to operate in the present world. However as the number of APIs grows along with the users who access and use these APIs, the need for proper management and governance is required more than ever.
Distributed architectures make security difficult. JWT, OAuth2 and OIDC are standards that help in securing microservices. Microservices are deployed as containers. So container security too is critical to secure microservices. Learn how to holistically secure microservices.
Building a Fool Proof Security Strategy for PSD2 ComplianceWSO2
PSD2 is centered around exposing sensitive customer data. This means the security measures you take to expose this data cannot have any loopholes. Just like your API management strategy, your security strategy is critical to implementing successful compliance.
WSO2 Open Banking comes with inbuilt capabilities to support Strong Customer Authentication (SCA) and access management. Built around the key requirements of the Regulatory Technical Standards (RTS) it provides the end to end security requirements for compliance, while ensuring that customer experience is not compromised.
This webinar will cover
The key requirements of the RTS for PSD2 Compliance - Strong Customer Authentication (SCA), federated authentication, consent management and more
The capabilities of WSO2 Open Banking to meet these security requirements
How to ensure a secure yet frictionless customer experience
A demonstration of WSO2 Open Banking
Agenda:
What is BPM?
BPM Benefits and Usage Fields
Camunda BPM Engine
Business Process Model and Notation
BPMN 2.0 Elements
What is Camunda?
Technical Architecture
Why Camunda
Demo
This session is all about Gravitee.io that consists of two modules: Gravitee.io Access Management, which is responsible for providing Authentication and Authorization with help of OAuth2.0 and OpenID Connect, and Gravitee.io API Management, which is responsible for the management of APIs, by simply publishing and consuming the APIs.
apidays LIVE India - Asynchronous and Broadcasting APIs using Kafka by Rohit ...apidays
apidays LIVE India 2021 - Connecting 1.3 billion digital innovators
May 20, 2021
Asynchronous and Broadcasting APIs using Kafka
Rohit Saxena, Software Development Consultant at Guardian Life
Polling-based APIs or the RESTful APIs were the main building blocks of traditional integration stories. But with the need to respond to events in real-time, integration architecture has shifted from being polling-based to event-driven. With the emergence of reactive event-driven architecture, the asynchronous APIs were able to hold their distinct position in modern-day integrations.
Even though the event-driven APIs provide their own advantages such as high resiliency, high responsiveness, and more, management of asynchronous APIs continues to be a challenge to the organizations.
The AsyncAPI specification plays a major role in the event-driven world by providing a specification to describe and document the asynchronous APIs. These slides will explore the entire flow from creating an asynchronous API to exposing it as a managed API by adhering to the AsyncAPI specification.
INTERFACE, by apidays - The future of API Management in a hybrid, multi-clou...apidays
INTERFACE, by apidays 2021 - It’s APIs all the way down
June 30, July 1 & 2, 2021
The future of API Management in a hybrid, multi-cloud world
Shaun Clowes, SVP of Product at Mulesoft
This webinar will give an overview of the conventional login forms and currently more popular logins via social networks. Further, we will discuss adopting Social Logins in your applications and an Identity Hub’s role there to overcome any added overhead.
Watch the on-demand webinar here: https://wso2.com/library/webinars/identity-hubs-role-in-social-logins/
In this community call, we will discuss the highlights of WSO2 API Manager 4.0 including
- Why we moved from WSO2 API Manager 3.2.0 to 4.0.0.
- New architectural changes
- Overview of the new features with a demo
- Improvements to the existing features and deprecated features
Recording: https://youtu.be/_ks4zEeRFdk
Sign up to get notified of future calls: https://bit.ly/373f4ae
WSO2 API Manager Community Channels:
- Slack: https://apim-slack.wso2.com
- Twitter: https://twitter.com/wso2apimanager
Leveraging Async APIs to deliver cross domain agile collaboration Nuwan Dias
How Asynchronous APIs help organizations to collaborate with each other. Discusses the differences and usages of synchronous and asynchronous APIs, talk through challenges faced by organizations when using Asynchronous APIs and how to overcome them as well.
View on-demand: https://wso2.com/library/webinars/api-security-best-practices-and-guidelines/
Modern enterprises are increasingly adopting APIs, exceeding all predictions. With more businesses investing in microservices and the increased consumption of cloud APIs, you need to secure beyond just a handful of well-known APIs. You will need to secure a higher number of internal and external endpoints.
At the same time, security itself is a broad area and vendors implement a number of seemingly similar standards and patterns, making it very difficult for consumers to settle on the best option for securing APIs. The sheer number of options can be very confusing.
There is much to learn about API security, regardless of whether you are a novice or expert and it’s extremely important that you do because security is an integral part of any development project, including API ecosystems.
This webinar will deep-dive into the importance of API security, API security patterns, and how identity and access management (IAM) fit in the ecosystem.
DURING THE WEBINAR, WE WILL COVER:
Managed APIs
OAuth 2.0 and API security patterns
Introduction to WSO2 Identity Server
How we align with OWASP API security guidelines
The cloud is rapidly becoming the de-facto standard for deploying enterprise applications. Microservices are at the core of building cloud-native applications due to its proven advantages such as granularity, cloud-native deployment, and scalability. With the exponential growth of the consumer base of these service offerings, enforcing microservice/API security has become one of the biggest challenges to overcome.
In this deck, we discuss:
- The need for API/Microservices Security
- The importance of delegating security enforcement to an API Gateway
- API Authentication and Authorization methodologies
- OAuth2 - The de-facto standard of API Authentication
- Protection against cyber attacks and anomalies
- Security aspects to consider when designing Single Page Applications (SPAs)
Watch the webinar on-demand here - https://wso2.com/library/webinars/2019/11/api-security-in-a-cloud-native-era/
WSO2- OSC Korea - Accelerating Digital Businesses with APIsWSO2
APIs are taking over every vertical out there with its standards, reusability, and simplicity that are required to operate in the present world. However as the number of APIs grows along with the users who access and use these APIs, the need for proper management and governance is required more than ever.
Distributed architectures make security difficult. JWT, OAuth2 and OIDC are standards that help in securing microservices. Microservices are deployed as containers. So container security too is critical to secure microservices. Learn how to holistically secure microservices.
Building a Fool Proof Security Strategy for PSD2 ComplianceWSO2
PSD2 is centered around exposing sensitive customer data. This means the security measures you take to expose this data cannot have any loopholes. Just like your API management strategy, your security strategy is critical to implementing successful compliance.
WSO2 Open Banking comes with inbuilt capabilities to support Strong Customer Authentication (SCA) and access management. Built around the key requirements of the Regulatory Technical Standards (RTS) it provides the end to end security requirements for compliance, while ensuring that customer experience is not compromised.
This webinar will cover
The key requirements of the RTS for PSD2 Compliance - Strong Customer Authentication (SCA), federated authentication, consent management and more
The capabilities of WSO2 Open Banking to meet these security requirements
How to ensure a secure yet frictionless customer experience
A demonstration of WSO2 Open Banking
Get Strong Customer Authentication Ready for PSD2WSO2
Banks are standing face to face with the PSD2 go-live deadline, however, they are still not ready to roll out their interfaces with Strong Customer Authentication (SCA). For this reason, the Financial Conduct Authority (FCA) agreed to give an extra 18 months for the roll-out of SCA.
SCA ensures that the consumption of financial APIs by the third party is done with the explicit consent of the customer and with multiple levels of assurance in the authentication, to ensure customer authenticity. WSO2 Open Banking allows compliance of SCA and provides extendability, allowing configuration of custom authentication methods such as SMS one-time password, out-of-band authentication, etc.
This deck covers in detail:
- An introduction to PSD2 AIS, PIS Flows
- The basics of SCA
- Configuration of Multi-Factor Authentication with WSO2 Open Banking
- Additional Adaptive Authentication with WSO2 Open Banking Business Intelligence
Watch the webinar on-demand here - https://wso2.com/library/webinars/2019/10/get-strong-customer-authentication-sca-ready-for-psd2/
Security & Seamless CX in User Authentication: How to Achieve Both?Ivona M
Watch our webinar and learn:
-How to satisfy the existing security compliance criteria in the era of impatient customers?
-Industry best practices in ensuring the highest security and improved user experience in the authentication process.
-Practical steps to planning and implementing optimal authentication ecosystems without unnecessary expenses.
-From OTP to push and biometry – which authentication methods will be best suited to your business needs?
-How to ensure strong authentication for remote work?
For more info go to https://sxs.asseco.com/
Move your customer authentication to the next level!Ivona M
In this presentation you will learn:
-Industry best practices in ensuring the highest security and improved user experience.
-How to prevent fraud with advanced SCA techniques.
-Solving operational issues and optimizing costs with the all-in-one authentication system.
-Real examples of practical steps to ensure seamless UX.
-How to enhance your existing VPN security for remote work.
-From OTP to push and biometry – which authentication method is the best fit for your business needs.
For more info go to https://sxs.asseco.com/
PortalGuard’s Flexible Two-factor Authentication options are designed as strong authentication methods for securing web applications. PortalGuard leverages a one-time password (OTP) as a factor to further prove a user's identity. The OTP can be delivered via SMS, email, printer, and transparent token. Configurable by user, group or application this is a cost effective approach to stronger authentication security.
Tutorial: http://pg.portalguard.com/flexible_two-factor_tutorial
[WSO2Con EU 2018] Kicking Your Enterprise Security Up a Notch With Adaptive A...WSO2
Adaptive authentication offers a good balance between security and usability. This presentation discusses the benefits of adaptive authentication and how WSO2 Identity Server can support any adaptive or risk-based authentication use case.
E-Lock AdaptAuth is an AI-powered, Adaptive, Multi-factor Authentication solution that provides an advanced layer of protection in the form of Adaptive MFA. Adaptive authentication utilizes information such as IP addresses, geo-locations, device signatures and user behavior patterns to assess the risk and accordingly adapts the authentication flow.This is achieved by building a risk profile for every user by analyzing past authentication attempts and behavioral patterns. The extent of deviation from such patterns invokes additional MFA factors until desired levels of identity assurance are achieved.
Capabilities provided by AdaptAuth:
Basic Authentication
Two-factor authentication- App based OTP, Email/SMS OTP, Digital Certificate, Fingerprint, FIDO2 authentication
Multi-factor Authentication
Adaptive Authentication
Single-Sign on
Garantire un’autenticazione sicura degli utenti è fondamentale in un sistema di accessi alle piattaforme digitali. Che si tratti di home banking o piattaforme di e-commerce, desktop o mobile, l’utente ha il diritto di accedere in modo sicuro ma non complicato ai servizi offerti.
Oggi vi parleremo di come WSO2 ha gestito e risolto il tema della Strong Customer Authentication.
Agenda
Cos’è SCA
RTS per SCA
Approcci SCA
Configurare gli autenticatori
Personalizzare i componenti base di SCA
Per ulteriori informazioni scrivi a wso2.sales@profesia.it
Multifactor authenticationMultifactor authentication or MFA .docxgilpinleeanna
Multifactor authentication
Multifactor authentication or MFA is a security system that requires more than on method of authentication from independent categories of credentials to verify the user’s identity for a login or other transaction.
Multifactor authentication combines two or more independent credentials: what the user knows like a password, what the user has the security token and what the user is like biometric verification. The goal of multifactor authentication is to create a layer of defense and make it more difficult for an unauthorized person to access a some like a physical location, network or database, or a computing device. If one of the factor is compromised, an attacker still needs at least one more barrier to breach before successfully breaking into the target.
Multifactor authentication cont…
Typical MFA scenarios include:
Swiping a card and entering a PIN.
Logging into a website and being requested to enter an additional one-time password OTP that the website’s authentication server sends to the requester’s phone, email address, or any other form.
Downloading a VPN client with a valid digital certificate and logging into the VPN before being granted access to a network.
Swiping a card, scanning a fingerprint and answering a security question
Attaching a USB hardware token to a Desktop that generates a one-time passcode and using the one-time passcode to log into a VPN client.
RSA Token/Symantec VIP Access
RSA token or security token is a two-factor authentication technology that is used to protect network resources. The authentication is based on two factors. The two factors are first something you know like your password or pin and the second factor is something you have the authenticator (RSA Token). The code that RSA Token produces changes every 60 seconds as an added form of security.
Symantec VIP Access is a software that protects your online accounts and transactions. The VIP credential provides a dynamic security code that you can use in addition to your user name and password for safe and secure account access. The code that VIP Access produces changes every 30 seconds as an added form of security.
How RSA Token/VIP software work
The way RSA Token and the VIP software work is when a user attempts to access a protected resource, he or she is prompted for a unique code. The code is a combination of their user’s password or pin and the code that is displayed on the authenticator token or VIP application at the time of logging in.
The user ID and pass code are intercepted by the RSA Authentication Agent and presented to the RSA Authentication Manager software which validates the pass code. The RSA SecurID system computes what number the token is supposed to be showing at that moment in time, checks it against what the user entered, and makes the decision to allow or deny access. This is also the case with the VIP software.
Reference
http://www.webopedia.com/TERM/R/rsa_secure_id.html
https://idprote ...
With the advanced technologies such as biometrics verification and cryptographic keys, IT around the world is moving towards passwordless authentication for its apps.
Subscribe for more insightful report at: https://kms-solutions.asia/
Las organizaciones necesitan evolucionar más allá del nombre de usuario y contraseña básico y asegurar las transacciones en línea con un abanico de opciones de autenticación segura.
Accelerate Enterprise Software Engineering with PlatformlessWSO2
Key takeaways:
Challenges of building platforms and the benefits of platformless.
Key principles of platformless, including API-first, cloud-native middleware, platform engineering, and developer experience.
How Choreo enables the platformless experience.
How key concepts like application architecture, domain-driven design, zero trust, and cell-based architecture are inherently a part of Choreo.
Demo of an end-to-end app built and deployed on Choreo.
Less Is More: Utilizing Ballerina to Architect a Cloud Data PlatformWSO2
At its core, the challenge of managing Human Resources data is an integration challenge: estimates range from 2-3 HR systems in use at a typical SMB, up to a few dozen systems implemented amongst enterprise HR departments, and these systems seldom integrate seamlessly between themselves. Providing a multi-tenant, cloud-native solution to integrate these hundreds of HR-related systems, normalize their disparate data models and then render that consolidated information for stakeholder decision making has been a substantial undertaking, but one significantly eased by leveraging Ballerina. In this session, we’ll cover:
The overall software architecture for VHR’s Cloud Data Platform
Critical decision points leading to adoption of Ballerina for the CDP
Ballerina’s role in multiple evolutionary steps to the current architecture
Roadmap for the CDP architecture and plans for Ballerina
WSO2’s partnership in bringing continual success for the CD
The integration landscape is changing rapidly with the introduction of technologies like GraphQL, gRPC, stream processing, iPaaS, and platformless. However, not all existing applications and industries can keep up with these new technologies. Certain industries, like manufacturing, logistics, and finance, still rely on well-established EDI-based message formats. Some applications use XML or CSV with file-based communications, while others have strict on premises deployment requirements. This talk focuses on how Ballerina's built-in integration capabilities can bridge the gap between "old" and "new" technologies, modernizing enterprise applications without disrupting business operations.
Platformless Horizons for Digital AdaptabilityWSO2
In this keynote, Asanka Abeysinghe, CTO,WSO2 will explore the shift towards platformless technology ecosystems and their importance in driving digital adaptability and innovation. We will discuss strategies for leveraging decentralized architectures and integrating diverse technologies, with a focus on building resilient, flexible, and future-ready IT infrastructures. We will also highlight WSO2's roadmap, emphasizing our commitment to supporting this transformative journey with our evolving product suite.
Quantum computers are rapidly evolving and are promising significant advantages in domains like machine learning or optimization, to name but a few areas. In this keynote we sketch the underpinnings of quantum computing, show some of the inherent advantages, highlight some application areas, and show how quantum applications are built.
Securing your Kubernetes cluster_ a step-by-step guide to success !KatiaHIMEUR1
Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster.
However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks.
In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.
DevOps and Testing slides at DASA ConnectKari Kakkonen
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
State of ICS and IoT Cyber Threat Landscape Report 2024 previewPrayukth K V
The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development.
The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers:
State of global ICS asset and network exposure
Sectoral targets and attacks as well as the cost of ransom
Global APT activity, AI usage, actor and tactic profiles, and implications
Rise in volumes of AI-powered cyberattacks
Major cyber events in 2024
Malware and malicious payload trends
Cyberattack types and targets
Vulnerability exploit attempts on CVEs
Attacks on counties – USA
Expansion of bot farms – how, where, and why
In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East
Why are attacks on smart factories rising?
Cyber risk predictions
Axis of attacks – Europe
Systemic attacks in the Middle East
Download the full report from here:
https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/
Essentials of Automations: Optimizing FME Workflows with ParametersSafe Software
Are you looking to streamline your workflows and boost your projects’ efficiency? Do you find yourself searching for ways to add flexibility and control over your FME workflows? If so, you’re in the right place.
Join us for an insightful dive into the world of FME parameters, a critical element in optimizing workflow efficiency. This webinar marks the beginning of our three-part “Essentials of Automation” series. This first webinar is designed to equip you with the knowledge and skills to utilize parameters effectively: enhancing the flexibility, maintainability, and user control of your FME projects.
Here’s what you’ll gain:
- Essentials of FME Parameters: Understand the pivotal role of parameters, including Reader/Writer, Transformer, User, and FME Flow categories. Discover how they are the key to unlocking automation and optimization within your workflows.
- Practical Applications in FME Form: Delve into key user parameter types including choice, connections, and file URLs. Allow users to control how a workflow runs, making your workflows more reusable. Learn to import values and deliver the best user experience for your workflows while enhancing accuracy.
- Optimization Strategies in FME Flow: Explore the creation and strategic deployment of parameters in FME Flow, including the use of deployment and geometry parameters, to maximize workflow efficiency.
- Pro Tips for Success: Gain insights on parameterizing connections and leveraging new features like Conditional Visibility for clarity and simplicity.
We’ll wrap up with a glimpse into future webinars, followed by a Q&A session to address your specific questions surrounding this topic.
Don’t miss this opportunity to elevate your FME expertise and drive your projects to new heights of efficiency.
Epistemic Interaction - tuning interfaces to provide information for AI supportAlan Dix
Paper presented at SYNERGY workshop at AVI 2024, Genoa, Italy. 3rd June 2024
https://alandix.com/academic/papers/synergy2024-epistemic/
As machine learning integrates deeper into human-computer interactions, the concept of epistemic interaction emerges, aiming to refine these interactions to enhance system adaptability. This approach encourages minor, intentional adjustments in user behaviour to enrich the data available for system learning. This paper introduces epistemic interaction within the context of human-system communication, illustrating how deliberate interaction design can improve system understanding and adaptation. Through concrete examples, we demonstrate the potential of epistemic interaction to significantly advance human-computer interaction by leveraging intuitive human communication strategies to inform system design and functionality, offering a novel pathway for enriching user-system engagements.
Neuro-symbolic is not enough, we need neuro-*semantic*Frank van Harmelen
Neuro-symbolic (NeSy) AI is on the rise. However, simply machine learning on just any symbolic structure is not sufficient to really harvest the gains of NeSy. These will only be gained when the symbolic structures have an actual semantics. I give an operational definition of semantics as “predictable inference”.
All of this illustrated with link prediction over knowledge graphs, but the argument is general.
Transcript: Selling digital books in 2024: Insights from industry leaders - T...BookNet Canada
The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more.
Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/
Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.
2. Agenda
● What is SCA?
● The RTS for SCA
● Exemptions from SCA
● SCA Approaches
● Configuring default authenticators
● Customizing SCA based components
○ Implementing custom authenticators
○ Customizing Key Manager Extension
3. What is Strong Customer Authentication?
Authentication
Factors
Password, PIN, ID number Key, mobile device, token or
Smart card
Fingerprint, face or voice
recognition
Knowledge Possession Inherence
Authentication = Verifying the identity of a user
Strong customer Authentication = Authenticating by using at least 2 out of the 3 elements
12. ● Custom authenticator:
○ .jar file ~ authenticator logic
○ .war ~ user interfaces
● Copy the .jar file to <wso2_obkm>/repository/components/dropins
directory and restart the Key Manager component.
● Copy the .war file to
<wso2_obkm>/repository/deployment/server/webapps directory and
make sure web application deployed successfully from the Key manager
logs.
Implementing Custom Authenticators
13. • Add a authenticator config element to the application-authentication.xml
file in the <wso2_obkm>/repository/conf/identity/ directory and you can
define and parameters that could be used in the implementation of
authenticator.
Configure Custom Authenticators
<AuthenticatorConfig name="FacebookAuthenticator" enabled="true">
<Parameter name="AuthTokenEndpoint">https://graph.facebook.com/abcd</Parameter>
<Parameter name="AuthnEndpoint">http://www.facebook.com/dialog/oauth</Parameter>
</AuthenticatorConfig>
17. Open Banking Flows
Login and
accessing account
information via
web/mobile
application
Initiation
account info
Login page
2 Factor authentication
Customer consent
Token
Get account
information
Web/Mobile Apps
Token
1
2
3
4
5
6
7
18. Multi-step and multi-option
Configuration per application
Multi-Step : Add any number of
authentication steps
Multi-Option : Add any number of
authenticators for a step
19. ● Further flexibility can be achieved by customizing
the key manager extension
○ Set different combinations of authenticators
○ Set different authenticators for production and
sandbox applications
○ Set authenticators dynamically under different
circumstances
Customizing Key Manager Extension
20. ● Create a custom java component and add the
below dependencies
○ com.wso2.finance.open.banking.sca.keymanager
○ org.wso2.carbon.apimgt.impl
● Java class should extend
“SCABasedKeyManagerClient”
● Override method “setAuthenticators”
Customizing Key Manager Extension
21. • Build the module and add the component in
OB-APIM/repository/components/dropins.
• Modify the <KeyManagerClientImpl> element in api-manager.xml of
OB-APIM/repository/conf/ directory with FQN of your extended class
Customizing Key Manager Extension
<APIKeyManager>
<KeyManagerClientImpl>com.wso2.sample.SampleKeyManagerClient</KeyManagerClientImpl>
</APIKeyManager>
22. Upcoming Webinars
• Webinar 4: OBIE Directory Integration - A Technical Deep Dive - May 7
• Webinar 5: PISP journey based on Open Banking UK - May 8
• Webinar 6: Verify Your Conformance Against OBIE - May 9
• All webinars will be at 10.00 a.m. GMT.
23. Additional Resources
More Information http://wso2.com/solutions/financial/open-banking/
Try out WSO2 Open Banking https://openbanking.wso2.com
Get in Touch openbankingdemo@wso2.com
Solution RoadMap
How WSO2 Open Banking Adheres to the Open Banking UK Standard
What’s new in WSO2 Open Banking