WSO2Con US 2013 - Securing Cloud and Mobile: Pragmatic Enterprise Security Architecture

•

1 gefällt mir•717 views

This document discusses security considerations for cloud and mobile architectures. It notes that internet and mobile device usage has grown dramatically in the past decade. However, many mobile users do not password protect their devices and multi-factor authentication is often not used for mobile apps. The document then discusses issues like mobile device management, OAuth usage for APIs, and approaches for single sign-on for native mobile apps. It advocates for secure data channels and API management to help address vulnerabilities in an increasingly mobile and cloud-centric landscape.

Technologie Business

Securing
Cloud
and
Mobile

Pragma&c
Enterprise
Security

Architecture

Prabath
Siriwardena
(@prabath)
WSO2

Director,
Security
Architecture

Within
the
ﬁrst
decade
of
the
21st
century
–

internet
worldwide
increased
from
350
million

to
more
than
2
billion.

Mobile
phone
subscribers
increased
from

750
million
to
5
billion

Today
it’s
around
6
billion

Only
30%
of
mobile
users,
password
protect

their
mobile
devices

Many
SaaS
providers
ignore
mulJfactor

authenJcaJon
for
mobile
applicaJons

113
cell
phones
are
lost
or
stolen
every

minute
in
the
U.S
and
$7
million
worth
of

smartphones
are
lost
daily

62%
of
mobile
workers

currently
use
their
personal
smartphones
for

work

hAp://www.websense.com/assets/reports/websense-‐2013-‐threat-‐report.pdf

Mobile
Device
Management
systems
need
to

be
an
integral
part
of
the
corporate

IdenJty
Management

Cloud
service
providers
are

becoming
mobile
friendly
with
REST/JSON
APIs

OAuth
2.0
dominates
Mobile
and
API
security

Avoid
using
Resource
Owner
Password
OAuth

grant
type

Mobile
applicaJons
secured
with
OAuth
can
be

vulnerable
to
phishing

Your
Facebook
or
TwiYer
account
credenJals

can
be
quite
easily
phished
through
your

mobile
phone
-‐
than
from
a
laptop
computer

The
need
to
bake-‐in
client
key
and
the
secret

key
into
the
mobile
app
itself
is
an
issue
yet
to

solve

OAuth
has
given
a
beYer
failover
capability
to

mobile
applicaJons
in
case
of
an
aYack

It
takes
an
average
of
20
seconds
for
a

user
to
log
into
a
resource

Single
Sign
On
increases
user
producJvity

Browser
based
Single
Sign
On

Authoriza&on
Server
(IdP)

Mobile
Device

Na&ve
App

Na&ve
Web
Browser

NaJve
Single
Sign
On

Mobile
Device

Na&ve
App

Na&ve
IdP
App

OpenID
FoundaJon
is
working
on
standardizing

NaJve
Single
Sign
On
based
on

OpenID
Connect

SAML2
IdP

SAML2
IdP

Federated
Single
Sign
On

Authoriza&on
Server
(IdP)

Mobile
Device

Na&ve
App

Na&ve
Web
Browser

Federated
Single
Sign
On
with
heterogeneous

AuthorizaJon
Servers

Managed
Cloud
APIs

Cloud
API

Mobile
App

API
Gateway

Weitere ähnliche Inhalte

Was ist angesagt?

Take a fresh approach to IT security and management, designed specifically for mobile Overview Twenty years ago, laptops revolutionized how the enterprise conducted business. But with the laptop came a host of new security and manageability challenges that we are arguably still trying to work out. Now, mobile computing promises to be exponentially more disruptive. It is a mistake to think you can apply yesterday’s laptop thinking to today’s mobile devices and still maintain a secure infrastructure. Mobile devices are radically different from laptops and they are evolving at a completely different pace, so they demand a fresh approach.

Beyond MDM: 5 Things You Must do to Secure Mobile Devices in the Enterprise

CA API Management

Connecting The Real World With The Virtual World

Ping Identity

Successful Enterprise Single Sign-on: Addressing Deployment Challenges

Hitachi ID Systems, Inc.

Mobile phones are a quintessential part of our lives; they keep us connected with friends and family and make our lives more convenient every day. As the global Covid-19 pandemic encouraged people to remain safely indoors, there was a large increase in the number of Mobile Banking users. From depositing checks remotely to having 24*7 access to your bank account, the convenience and the utility of Mobile Banking are the reasons behind this popularity. And yet many people still wonder if Mobile Banking is Safe. If you are someone who is undecided about adopting Mobile Banking because of concerns about the security of Mobile Banking then here is the answer to your question ‘Are Mobile Banking Apps really safe?’ covered in this article. The best way to do this is to look at the risks involved with Mobile Banking and what organizations and customers can do about it.

Are Mobile Banking Apps Safe?

VISTA InfoSec

Sure, you can spell enterprise security without the letters M-F-A, but the modern digital enterprise isn't as secure without a strong multi-factor authentication (MFA) strategy. Enterprises are under attack, and credentials are a primary target. Many leading enterprises are enhancing their security and control with MFA, allowing them to move away from a high-risk, password-based security approach and to give their employees, partners, and customers a better user experience. View this slide deck for best practices for a MFA strategy.

You Can't Spell Enterprise Security without MFA

Ping Identity

Managing & Securing the Online and Mobile banking - Chew Chee Seng

Knowledge Group

IDENTITY IN THE WORLD OF IOT

ForgeRock

Hitchhikers know everything exciting happens outside the lines, like cloud, mobile, social, big data and the internet of things. The challenge of navigating today’s universe is lack of portable, automated, discoverable and scalable identity management. DON’T PANIC. This presentation from Ping Identity CTO Patrick Harding explains how a next-generation identity and access management layer encompassing the identity of people and things, passive analytics, active feedback and automated connections to partners, customers, and apps is the modern Hitchhiker’s Guide to the Identiverse. Presented at Gartner Catalyst 2013.

Hitchhikers Guide to the Identiverse - How Federated Business will Rule the W...

Ping Identity

Distil Networks Protecting the Telephony Industry

Paul Hobbs

Managing Identity without Boundaries

Ping Identity

Chief Architect Francois Lascelles gave this presentation at Gartner Catalyst 2013. The user experience associated with mobile applications is a critical determinant of the adoption of the APIs that powers them. Mobile platforms and their public app stores create challenges when it comes to securing APIs consumed by mobile applications in such a way that does not require constant user prompts. This presentation will describe the challenge of providing positive UX patterns such as single sign-on on mobile platforms and explore API provider-side architectures enabling them.

Balancing Mobile UX & Security: An API Management Perspective Presentation fr...

CA API Management

Mobile banking (mbanking) has quietly emerged as a critical and inevitable weapon in the ongoing battle to retain customers and reduce expenses. Mobile transactional costs are lower than desktop transactions and represent the fastest growing portion of the consumer financial service business. In fact, many customers will willingly switch allegiances to financial service institutions that offer the convenience and speed of mobile banking versus brick and mortar transactions only. However, the precipitous rise in mobile financial service applications comes at a cost. Many consumers are skeptical that mobile platforms and mbanking applications are equipped with the proper security measures to turn their phone into a strong authentication device. As younger generations demand expanded mobile financial service applications, the need for the industry to demonstrate a commitment to increasing the security of these transactions is rising rapidly.

Secure Authentication for Mobile Banking Customers with mVerify™

M2SYS Technology

Protect your business with a universal identity platform The Azure Active Directory (Azure AD) enterprise identity service provides single sign-on and multi-factor authentication to help protect your users from 99.9 percent of cybersecurity attacks. Gartner named Microsoft a leader in Magic Quadrant 2020 for Access Management Single sign-on simplifies access to your apps from anywhere Conditional Access and multi-factor authentication help protect and govern access A single identity platform lets you engage with internal and external users more securely Developer tools make it easy to integrate identity into your apps and services Connect your workforce Whether people are on-site or remote, give them seamless access to all their apps so they can stay productive from anywhere. Automate workflows for user lifecycle and provisioning. Save time and resources with self-service management. Choose from thousands of SaaS apps Simplify single sign-on. Azure AD supports thousands of pre-integrated software as a service (SaaS) applications. Protect and govern access Safeguard user credentials by enforcing strong authentication and conditional access policies. Efficiently manage your identities by ensuring that the right people have the right access to the right resources. Engage with your customers and partners Secure and manage customers and partners beyond your organizational boundaries, with one identity solution. Customize user journeys and simplify authentication with social identity and more. Integrate identity into your apps Accelerate adoption of your application in the enterprise by supporting single sign-on and user provisioning. Reduce sign-in friction and automate the creation, removal, and maintenance of user accounts.

Microsoft Azure Active Directory

David J Rosenthal

IRJET- Graphical Secret Code in Internet Banking for Improved Security Transa...

IRJET Journal

Catalyst 2015: Patrick Harding

Ping Identity

Identity-Defined Privacay & Security for Internet of Things

Ping Identity

Nexmo Verify SDK

Srivatsan Srinivasan

Onboarding in the IoT

Paul Madsen

apidays LIVE Hong Kong - Art and Science of Rate Limits for APIs by Shahnawaz...

apidays

How to successfully implement a secure mobile strategy

VASCO Data Security

Was ist angesagt? (20)

Beyond MDM: 5 Things You Must do to Secure Mobile Devices in the Enterprise

Connecting The Real World With The Virtual World

Successful Enterprise Single Sign-on: Addressing Deployment Challenges

Are Mobile Banking Apps Safe?

You Can't Spell Enterprise Security without MFA

Managing & Securing the Online and Mobile banking - Chew Chee Seng

IDENTITY IN THE WORLD OF IOT

Hitchhikers Guide to the Identiverse - How Federated Business will Rule the W...

Distil Networks Protecting the Telephony Industry

Managing Identity without Boundaries

Balancing Mobile UX & Security: An API Management Perspective Presentation fr...

Secure Authentication for Mobile Banking Customers with mVerify™

Microsoft Azure Active Directory

IRJET- Graphical Secret Code in Internet Banking for Improved Security Transa...

Catalyst 2015: Patrick Harding

Identity-Defined Privacay & Security for Internet of Things

Nexmo Verify SDK

Onboarding in the IoT

apidays LIVE Hong Kong - Art and Science of Rate Limits for APIs by Shahnawaz...

How to successfully implement a secure mobile strategy

Andere mochten auch

Mobile Inception's mission "Enabling the mobile enterprise", is to help small & medium organisations to leverage the benefits and to tackle the multiple challenges of the mobile era. Aside from designing & building tailored Mobile Enterprise Solutions, our experts provide guidance and consulting on the following topics: - Modern Mobile & Cloud APIs - Mobile Security & Privacy - BYOD & Enterprise App Store - Mobile Native User Experience - Cross-platform mobile development w/ Xamarin Contact us at info@mi8.be

Mobile inception - Blueprint for cloud-enabled mobile enterprise solutions

MobileInception

2109 mobile cloud integrating your mobile workloads with the enterprise

Todd Kaplinger

Mobile Monday DUS Mobile Cloud for Enterprise-final-print

Peter Decker

Enterprise platform 3.0v4 for webinar

John Mathon

Ps Enterprise Mobility Mobile Cloud 1

eddy124

A Mobile-First, Cloud-First Stack at Pearson

MongoDB

Microsoft vision and platform, cloud first-mobile first

GeneXus

WSO2Con US 2013 - Identity Management Best Practices with WSO2 Identity Server

WSO2Con US 2013 - Securing Cloud and Mobile: Pragmatic Enterprise Security Architecture

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (12)

Ähnlich wie WSO2Con US 2013 - Securing Cloud and Mobile: Pragmatic Enterprise Security Architecture

Ähnlich wie WSO2Con US 2013 - Securing Cloud and Mobile: Pragmatic Enterprise Security Architecture (20)

Mehr von WSO2

Mehr von WSO2 (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

WSO2Con US 2013 - Securing Cloud and Mobile: Pragmatic Enterprise Security Architecture