The Nuts and Bolts of API Security: Protecting Your Data at All Times

Travis Spencer - Curity (formerly Twobo Technologies). Nordic APIs World Tour 2015: May 11 - Copenhagen. Travis Spencer argues that API keys are insufficient for implementing proper API security and identity management. This talk delves into OAuth and OpenId Connect, with the goal to create a holistic approach to API and enterprise security that keeps all systems safe through a multi-faceted approach to identity control. This talk specifically covers: - The risks of relying solely on API keys - Fundamental introduction to OAuth as an identity delegation protocol - The actors involved in an OAuth process - Step-by-step processes involved in the common web server OAuth flow (validating tokens, returning data, etc.) - Overview of scopes, permissions and delegations. - Kinds of tokens (Access Tokens, Refresh Tokens) - Profiles of tokens (Bearer, Holder of Key) - Overview on types of tokens (WS-Security, SAML, JWT) - Using OpenID Connect as a federation protocol - Step-by-step OpenID Connect flow example - and more For thought provoking pieces on everything APIs, check out the Nordic APIs blog: http://nordicapis.com/blog/ Read these Nordic APIs articles for more on API security: Deep Dive into OAuth and OpenID Connect: http://nordicapis.com/api-security-oauth-openid-connect-depth/ How To Control User Identity Within Microservices: http://nordicapis.com/how-to-control-user-identity-within-microservices/ Equipping Your API With The Right Armor: http://nordicapis.com/api-security-equipping-your-api-with-the-right-armor/ The Four Defenses of the API Stronghold: http://nordicapis.com/api-security-the-4-defenses-of-the-api-stronghold/ Techniques and Technologies to Increase API Security: http://nordicapis.com/building-a-secure-api/ The theme for the Nordic APIs World Tour was the API Lifecycle. Read these Nordic APIs articles for more information on managing an API's entire Lifecycle: http://nordicapis.com/envisioning-the-entire-api-lifecycle/ http://nordicapis.com/api-lifecycle-analysis-stage-preparing-your-api-strategy-pre-launch/ http://nordicapis.com/api-lifecycle-development/ http://nordicapis.com/api-lifecycle-operations-stage-marketing-your-api/ http://nordicapis.com/api-lifecycle-retirement-stage-a-history-of-major-public-api-retirements/