Apidays Paris 2023 - IAM for API security strategy, Danielle Kayumbi, Deezer

Apidays Paris 2023 - Software and APIs for Smart, Sustainable and Sovereign Societies
December 6, 7 & 8, 2023

IAM for API security strategy
Danielle Kayumbi, IAM for API security strategy, Deezer

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. IAM For API Security Strategy
2. Danielle HODIEB KAYUMBI Software Engineer danielleKayumbi
4. APIs are everywhere Powering our lives from behind the scenes
7. ww.nbcnews.com/mach/science/these-tiny-robots-could-be-disease-fighting-machines-inside-body-ncna861451
8. More than 83% of web traffic is now processed througth APIs 83% Akaimai report
9. Rapid growth leads to larger attacks
10. 90% of breaches targeted Applications and APIs 2022 APIs become “Most frequent attack vector” https://lab.wallarm.com/evolution-of-api-security-in-2023-a-practical-guide/
11. Breaches
13. API 01 Broken Access control
14. Missing Access control PUT, GET, DELETE https://www.theguardian.com/technology/2017/aug/31/hacking-risk-recall-pacemakers-patient-death-fears-fda-firmware-update Privilege escalation
15. API attacks will jump nearly 1 000 % by 2030 https://siliconangle.com/2023/07/27/api-cyberattacks-projected-jump-nearly-tenfold-2030/
16. In 2016, Nissan Leaf Allowed to control remotely the climate, the charge of the battery and get the driving range
17. Only required a Vehicle Identification Number
18. https://siliconangle.com/2023/07/27/api-cyberattacks-projected-jump-nearly-tenfold-2030/
19. Get battery status Get climate status Turn climate on/off Get details about journeys & distances
23. https://www.youtube.com/watch?v=Nt33m7G_42Q&t=321s
24. Security is important Beyond features & functionalities
25. A simple denial-of-service attack has the potential to kill. Pacemaker https://www.theguardian.com/technology/2017/aug/31/hacking-risk-recall-pacemakers-patient-death-fears-fda-firmware-update
26. API Security is lacking
27. What do we need to expose ? Who are your users now ? In the future ? What’s the worst thing someone can do with your API ?
28. Strong authentication and authorization solution Least privileges Limit data exposure
29. Identity & Access Management
30. I A M
31. Who ? Can do what ? On which resources ?
32. https://www.tuv.com/usa/en/identity-und-access-management-%28iam%29.html
33. Authentication Authorization User Management Central User repository IAM
34. Users Groups Identity
35. Principle of least privileges
36. Role-based access control Access control lists Discretionary access control
38. Resource types Identities sources Client types (public, confidential)
44. GraphQL Client Resource owner Authorization server Resource server
45. GraphQL Client Resource owner Authorization server Resource server
46. GraphQL Client Resource owner Authorization server Resource server
47. GraphQL Client Resource owner Authorization server Resource server
48. GraphQL Authorization request Client Authorization server Resource server Resource owner
49. GraphQL Authorization request Client Authorization server Resource server Authorization grant Resource owner
50. GraphQL Authorization request Client Authorization server Resource server Authorization grant Authorization grant Resource owner
51. GraphQL Authorization request Client Authorization server Resource server Authorization grant Authorization grant Access token (role, scope) Resource owner
52. GraphQL Authorization request Client Resource owner Authorization server Resource server Authorization grant Access token (role, scope) Resources Authorization grant Access token (role, scope) ACL
53. GraphQL Keycloak Cart microservice Role Product-reader Client credential flow
54. GraphQL public/private key
58. https://www.keycloak.org/docs/latest/server_admin/#assembly-managing-clients_server_administration_guide
61. Centralize authentication & authorization Protocol & standards Principle of limited privileges
63. https://logrhythm.com/solutions/security/zero-trust-security-model/
64. Verify identity and context Control risk Enforce policy
65. Protect your data at all costs
66. Thank you danielleKayumbi