How to Build an Open Enterprise with Extensible—yet Secure—APIs

With the rise of cloud computing, mobility and the Internet of Things, application programming interfaces, better known as APIs, have become enterprise IT’s raison d'être.

With the rise of cloud computing, mobility and the Internet of Things, application programming interfaces, better known as APIs, have become enterprise IT’s raison d’être. And lots of companies are leveraging API technologies to offer richer, more dynamic and better performing services to customers.

However, API-enabled information exchange brings increased risk. These external APIs inherently require soft perimeters; otherwise the information exchange between systems that APIs enable could not occur. To mitigate those risks, many enterprises are investing in several new approaches: improved authentication that facilitates, yet protects, machine-to-machine communications; a gateway that can block malicious threats while still enabling an open ecosystem of application development; and a portal environment that fosters engagement and collaboration among developers both internally and externally but still maintains control over API use. You can learn more about securing your APIs from the CA Technologies eBooklet, “Five Simple Strategies to Securing your APIs”.

Authentication ensures that it’s the right people and devices using the set of APIs that make up an application — whether mobile, cloud or Web. Yet it doesn’t make sense for the user to authenticate each time an API is called, or you’ll kill the user experience; authentication needs only happen once if identity and access management is built into the API communication model. There’s a protocol, Open Authentication (OAuth), that enables this. Instead of a user simply putting in a user name and password, tokens are used. One OAuth token can be shared between different mobile applications, for example, and the authentication happens behind the scenes, on behalf of the user, to enable machine-to-machine communications.

When a major air carrier wanted to improve its mobile apps that let travelers check in and access mobile boarding passes, the company realized it would have to expose its applications and data to both internal developers and select external partners using APIs. But the airline had concerns: It wanted to ensure the APIs wouldn’t be compromised. The company is using the CA Layer 7 Gateway to secure, manage, and regulate any mobile API request that comes to their backend services and systems.

The CA Layer 7 Gateway abstracts information services and exposes them as APIs to internal and third-party developers who can incorporate functionality and data within the applications they build for handheld devices, online portals or commercial websites. The CA Layer 7 Gateways perform actions on every API request originating from a third-party developer, such as authentication. Consumer experience is critical and the gateway ensures fast response by aggregating multiple API requests at the gateway where bandwidth is high.  The gateway coordinates data capture across the back-end systems and sends a lightweight response to the app. In cases where data is used repeatedly, the gateway cache will respond without taxing back-end systems.

The consumer experience is critical, but the enterprise must also protect information from threats while still enabling an open ecosystem of application development. Firewall functions, such as those offered in a CA Layer 7 Gateway, monitor things like the XML streams coming in and are able to filter out any known attacks against system, including denial of service attacks, to help ensure availability and responsiveness of important apps.

Finally, as the number of APIs grows along with the numbers of developers using them, enterprises need a way to manage and control access to the APIs. The CA Layer 7 Portal helps foster creation among developers both internally and externally but still maintains control over API use. For example, the Portal provides a list of APIs available to each developer, a document describing how to use it, a dynamic test capability and automatic code generation for various programming languages.  Once in use, the business uses the API Portal to see which partners or mobile apps are using the APIs to identify how to best utilize future development or perhaps send a bill for data usage.

An open enterprise—enabled by APIs that are secured and managed—is the only way to succeed in today’s mobile, cloud-enabled, and interconnected world.

Written by

John Hawley

John is VP of security strategy for CA Technologies, with 15 years experience in the…

Published in

Security

View this topic
  • James Holland

    This is great. Hooray for Disney’s imagineers!

  • http://www.sheistocktips.com/ SHRISTOCKTIPS

    SHRISTOCKTIPS has
    become a new brand in the share market research with its accurate research. Proven
    itself always right whether market is bull or bear. Last week all paid clients
    booked handsome profit in NIFTY, BANKINIFTY & STOCKS. Now for the coming
    week we expect more correction can come in NIFTY as the IRAQ issue is getting
    more tense, If it happens more then you will see a sharp fall in all world marketNSE BSE, STOCK TIPSbecause as we know all world run on
    crude & most of the crude comes from IRAQ. So be ready for a sharp fall so
    sell will be the best strategy for next week also. Traders can make a sell
    position in NIFTY around 7600-7650 with stoploss 7750 for the target of
    7300-7200.One can also make a sell call NIFTY 50 stocks as per NIFTY levels. You
    can also take our two days free trial to check our accuracy. For further updates
    you can visit our website. http://goo.gl/sMgZ7n

    Regards

    SHRISTOCKTIPS TEAM

  • king lear

    testing comment functionality, please do not publish this

  • http://www.rachelmacik.com Rachel Macik

    Love the personal pic :)

    • CAHighlight

      Thank you!

  • Plutora Inc

    This is a good case study. 2.3 sec’s off a login transaction is big.

  • http://www.linkedin.com/in/michelehudnall Michele Hudnall

    While the analysts were hyping DevOps, I posted the oversight of not including security as part of that discussion as you are highlighting here. Instead of just talking DevOps, it should be DOS (what’s old is new again :-) – DevOpsSec. As a previous AppDev person, it’s the app, who’s using it, why and where rather than the device and having the service available.

    As you rightly point, out Security should be baked into the solution.
    https://www.netiq.com/communities/data-center-solutions/accelerating_business_overhauling_service_management/

    Nice Post and Timely!

    @HudnallsHuddle

    • CAHighlight

      Thank you for your feedback Michele. Agreed – security cannot be overlooked. Appreciate your input!

  • Mitesh

    I would love a printed copy

  • Lars Johansson

    I love the idea of BYOID! This makes me choose if I am almost anonymous (with my Hotmail Nicname) or official with identity from an official organisation. My Identity Provider will attach identity with right level of LoA according to the need of the Service provider.

    • CAHighlight

      Thank you for your comment. BYOID has tangible benefits for end users and relying parties but it also has to be weighed in the balance with potential risks and liability concerns. It will be interesting to see how BYOID plays out in the enterprise.