Defense-In-Depth for API and DevOps Security [Slides]
We must add authorization processes and intelligence to API and DevOps security. Check out this presentation to learn more about creating architectures and UX designs that support mitigation.
Join the DZone community and get the full member experience.
Join For FreeAuthorization has come a long way since setting bits in the file system. With the advancements in machine learning, big data, and behavioral profiling, it's time for authorization to take its next generational leap and move into a flexible, risk-based access control model that works in concert with legacy access control policies.
Cloud Authorization engines must focus on adding intelligence to the authorization process with validators that query external platforms for consensus during transactional processing and merry that with emerging threats to any of the entities (users, services, things, locations, etc.) present within the transaction. Threat mitigation options must be designed to rebuild the trust within the transaction or to mitigate the emerging risk by providing consensus via the leveraging of traditional methods, ABAC, RBAC, entitlements, scope, and respond during the transaction with transactional step-up Auth, degradation of Entitlements, reduction in data attributes returned, etc.
In this presentation, we showed how to create architectures and UX flows that support real-time threat mitigation for transactions involving any user, service, or thing.
Published at DZone with permission of Nathanael Coffing, DZone MVB. See the original article here.
Opinions expressed by DZone contributors are their own.
Comments