Pre-Con Ed: CA API Gateway: Developing Custom Policies to Secure Your Enterprise APIs

Download as pptx, pdf

1 like487 views

This document summarizes a presentation about developing custom policies to secure enterprise APIs using CA API Gateway. The presentation covers an introduction to services, policies, and assertions in API Gateway and how they are used to secure APIs. It then demonstrates securing an API in a live demo and discusses performance considerations and troubleshooting policies. The agenda includes introductions to core concepts, securing an API, performance factors, and troubleshooting.

Technology

Developing Custom Policies to
Secure Your Enterprise APIs
Jamie Williams
Senior Software Engineer
CA Technologies
DO3X47EV
DEVOPS

3 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
© 2016 CA. All rights reserved. All trademarks referenced herein belong to their respective companies.
The content provided in this CA World 2016 presentation is intended for informational purposes only and does not form any type of
warranty. The information provided by a CA partner and/or CA customer has not been reviewed for accuracy by CA.
For Informational Purposes Only
Terms of this Presentation

4 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Abstract
In this session on CA API Gateway we'll focus on basic policy creation and demonstrate the ease
with which enterprise APIs can be secured.
We will also spend some time on policy performance factors, troubleshooting, and
understanding points of failure when securing APIs.
Jamie
Williams
CA Technologies
Senior Software
Engineer

5 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Agenda
INTRODUCTION TO SERVICES, POLICIES, AND ASSERTIONS
SECURING YOUR API
PERFORMANCE CONSIDERATIONS
TROUBLESHOOTING
1
2
3
4

6 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Introduction to Services, Policies, and Assertions
 A Service is a logical construct that represents the sum of the
API calls the client side can call to access the service that the
Gateway is protecting
 Every service has a policy that implements an individual flow
of data between the client and the back-end service
 Assertions are the building blocks of policy that determine the
authentication method, identity credentials, transport
method, and routing method for the service

7 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Live Demo

8 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Recommended Sessions
SESSION # TITLE DATE/TIME
DO3X49E
CA API Gateway: Managing and migrating Gateway
policies with the Gateway Migration Utility
11/14/2016 at 11:00 am
DO3X52E
CA Mobile App Services: Build the Powerful Mobile App
Every Enterprise Needs in Under an Hour
11/14/2016 at 1:00 pm
DO3X51E
Workshop on Policy Creation, Management and Support
for OAuth and OIDC in CA Mobile API Gateway
11/14/2016 at 2:00 pm

9 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Questions?

10 © 2016 CA. ALL RIGHTS RESERVED.@CAWORLD #CAWORLD
Thank you.
Stay connected at communities.ca.com

@CAWORLD #CAWORLD © 2016 CA. All RIGHTS RESERVED.11 @CAWORLD #CAWORLD
DevOps – API Management and
Application Development
For more information on DevOps – API Management and
Application Development, please visit: http://cainc.to/DL8ozQ

This document discusses using context variables and custom fields in CA API Developer Portal policy writing. It describes how portal policy templates and custom fields allow additional input that can be leveraged by gateway policies. The presentation includes an example of a policy template, discusses typical use cases, and demonstrates a policy that uses a custom field to variably set quotas on HTTP methods and restrict partner access.

Pre-Con Ed: How to Provide Mobile Users With a Convenient, Yet Secure, Sessio...CA Technologies

The document discusses the challenges of maintaining user sessions in mobile applications when integrating with third-party web applications and describes how to utilize CA Mobile API Gateway features with OAuth and SAML to streamline user experience. It outlines the scenario, the components involved, and the technical details of transitioning from a native app to a web application. Additionally, it includes information about recommended sessions related to enterprise mobile app management.

Tech Talk: CA API Gateway: Deploying Docker Container GatewaysCA Technologies

The document discusses deploying CA API Gateway using Docker containers. It begins with an introduction to the benefits of Docker environments like consistency, portability, and enabling microservices architecture. It then discusses how CA API Gateway can be deployed as a Docker container for simplified deployment. The presentation includes two demos, the first showing the CA API Gateway Docker container and the second demonstrating how it can be used for microservices through service discovery and API publishing/proxying. Recommended related sessions on DevOps, API management, and microservices are also listed.

Pre-Con Ed: CA Mobile App Services: Build the Powerful Mobile App Every Enter...CA Technologies

Strategies for DevOps in the API and Microservices WorldCA Technologies

The document discusses strategies for implementing DevOps in an API and microservices environment. It outlines some of the challenges companies face when transitioning to microservices, including lack of agility and dependencies between services. It then provides several strategies for DevOps success, such as starting with a smaller initial project to learn microservices, focusing on reducing the size and dependencies of deliverables to enable faster deployment, and considering replacing rather than upgrading services. The conclusion emphasizes learning to build and deploy small, with attention to dependencies, in order to balance speed, safety and time to market.

Tech Talk: CA Live API Creator MythBuster: Database Design Takes an ExpertCA Technologies

Pre-Con Ed: CA Live API Creator: Build and Deploy Enterprise-class APIs With...CA Technologies

The document outlines a presentation on building and deploying enterprise-class APIs, focusing on the importance of reactive logic for automating integrations and enhancing security. It introduces concepts like multi-table validations, the significance of API-driven communication in the app economy, and the reduction of coding effort through abstraction. Attendees will learn practical skills, including creating APIs from existing databases and implementing reactive logic.

Pre-Con Ed: CA API Gateway: Managing and Migrating Policies with the Gateway ...CA Technologies

The document discusses how to use the Gateway Migration Utility to manage and migrate configurations between different environments for CA API Gateway. It covers migration concepts like exporting policies and resources, using mappings to define how resources are imported, and templating for environmental resources. The presentation provides an overview of these concepts and demonstrates how to use mappings in the utility to automate the migration process.

Pre-Con Ed: CA Live API Creator: How to Integrate Enterprise Data for Mobile ...CA Technologies

This document provides an overview of a presentation on integration with API servers. The presentation discusses how API servers can enable integration between on-premises and partner systems through APIs and webhooks. It also covers hands-on examples of creating APIs that span multiple databases, processing webhooks to integrate between systems, and sending requests to partner systems. The goals are to learn how to create an API server that exposes APIs for partners and mobile apps, enforces logic, and creates webhooks for integration with partner systems.

Pre-Con Ed: CA Live API Creator: Learn How to Integrate Data From Enterprise...CA Technologies

The document presents an overview of how organizations can integrate enterprise applications like Salesforce with local domain-specific applications using CA Live API Creator. It discusses the importance of APIs in enabling agility and competitiveness in the app economy and outlines steps for configuring and connecting to Salesforce to create custom resources. Additionally, it emphasizes the need for businesses to maintain their logic while allowing for seamless data integration from multiple sources.

Pros, Cons, Pitfalls of common Docker container architectures (#dockitecture)CA Technologies

This document discusses common Docker container architectures including monolithic, hybrid, and microservice approaches. It provides pros and cons of each architecture based on factors like maintainability, scalability, and extensibility. The document also presents scorecards to evaluate architectures and summarizes that hybrid and microservice designs are seeing benefits for non-functional requirements. Docker is enabling more organizations to adopt microservice architectures through containerization.

Pre-Con Ed: CA Live API Creator: How to Create, Deploy, Secure and Scale an E...CA Technologies

Tech Talk: CA Live API Creator: APIs and the App EconomyCA Technologies

This document summarizes a presentation about CA Live API Creator. It discusses how APIs can help meet the requirements of the app economy, including multi-channel access, enforced data integrity and security, integration, business agility, and simplicity. The presentation provides an example of how an API server can address these challenges using automated API logic, reactive logic, and integration logic. It argues that CA Live API Creator can dramatically reduce the effort required for API logic and business logic compared to conventional coding approaches.

Securing your API Portfolio with API ManagementCA Technologies

This document discusses securing APIs and the benefits of using an API management (APIM) solution. It covers topics like the differences between APIM and web access management (WAM), securing APIs for mobile and single-page applications, JSON web tokens, OpenID Connect vs OAuth, and real-world use cases from Verizon and Duke Energy. The presentation emphasizes the importance of flexibility in API security and how APIM allows centralized handling of security for multiple APIs.

Critical Considerations for Mobile and IoT StrategyCA Technologies

The document discusses seven critical considerations for developing a mobile and IoT strategy: 1) Ensuring security of data and services, 2) Designing apps suited for mobile use, 3) Supporting user identities, 4) Planning integrations with enterprise systems, 5) Encrypting data in transit and at rest, 6) Enabling communication and collaboration, 7) Planning a scalable IoT architecture. It notes the importance of these issues and provides examples of how to address each consideration when building a mobile and IoT strategy.

Pre-Con Ed: Learn What's New in CA Spectrum®CA Technologies

This document provides an agenda and overview for a presentation on new features in CA Spectrum. The presentation will cover enhancements to the CA Spectrum web client and topology views, improved Jaspersoft reporting, bidirectional integration with CA Unified Infrastructure Management, new support for wireless controller/access point management and Cisco ACI, and other enhancements. It provides background on CA Spectrum and the value it delivers, as well as descriptions and examples of many of the specific new features.

Securing Mobile Payments: Applying Lessons Learned in the Real WorldCA Technologies

1) The document discusses best practices for securing mobile payments based on lessons learned, including mobile authentication using push notifications and biometrics, securing in-app purchases, leveraging real-time risk analytics, and securely provisioning cards to mobile wallets. 2) It outlines CA's strategy for secure mobile payments which includes solutions for mobile authentication, in-app purchases, mobile wallets, real-time risk scoring, and NFC mobile wallet provisioning with cardholder authentication. 3) The document provides details on CA's mobile authentication solutions, risk analytics network model which considers device reputation across banks, and mobile wallet provisioning flow which incorporates one-time passcodes for authentication.

CA API Management: A DevOps EnablerRajat Vijayvargiya

The document discusses the role of CA API Management (APIM) in enabling DevOps and promoting digital transformation in enterprises by leveraging APIs. It highlights the importance of creating an agile API architecture that enhances developer collaboration, ensures security, and improves user experience while accelerating app delivery. Additionally, it emphasizes managing APIs like products and fostering developer communities to drive business growth and optimize integration across various platforms.

5 pillars of API ManagementJames Farley-Sutton

The document discusses the 5 pillars of API management with CA Technologies: 1. Expose enterprise data and functionality in API-friendly formats like RESTful APIs. 2. Protect information assets exposed via APIs to prevent misuse through measures like an API gateway. 3. Authorize secure, seamless access for valid identities using standards like OAuth. 4. Optimize system performance and manage the API lifecycle with features in an API gateway. 5. Engage, onboard, educate and manage developers through an interactive online portal.

Pre-Con Ed: CA Live API Creator: Using Data Explorer to Test APIs, Create Bac...CA Technologies

The document outlines a presentation by Val Huber on using the Live API Creator and Data Explorer, emphasizing its capabilities in building and customizing applications without requiring coding skills. Key topics include simplifying database creation, empowering business users, and enabling agile app development through reactive logic and integration. The session also highlights the importance of APIs in achieving agility in the app economy.

Tech Talk: CA Live API Creator: Modern Integration Strategies—API Integration...CA Technologies

Val Huber of CA Technologies gave a presentation on modern integration strategies using APIs and webhooks. The presentation discussed how past integration approaches copied large amounts of data between systems, which is slow and can create outdated data. Modern approaches use API integration to consolidate multiple on-premises systems without data copying, and webhooks to integrate with partners via RESTful web services. The talk illustrated these approaches and how CA Live API Creator enables faster API, logic, and integration development compared to traditional approaches through features like reactive logic, automatic object modeling, and database integration.

Pre-Con Ed (Lab): Making CA Identity Suite Deployment Incredibly EasyCA Technologies

This document summarizes a presentation about making deployments of the CA Identity Suite incredibly easy. It discusses using the CA Identity Suite Virtual Appliance to install and integrate the full Identity Suite in under 30 minutes. It also discusses using Deployment Xpress to easily deploy use cases within the Identity Suite with just a few clicks by selecting from a marketplace of available use cases. The presentation includes demos of both the virtual appliance and Deployment Xpress.

Introduction to Service VirtualizationCA Technologies

This document provides an overview and agenda for a presentation on CA Service Virtualization. The presentation introduces service virtualization, discusses why it is important for addressing the speed and quality quandary in software development, and how it works to improve software development and testing. Key points include that service virtualization models the behavior of software services to remove constraints in development and testing. It can help teams complete work faster, improve quality, and reduce costs. The demonstration portion will show how service virtualization improves on traditional stubs and mocks.

Pre-Con Ed: Leverage the Dynamic Service Modeling Functionality With CA Servi...CA Technologies

The document discusses CA Service Operations Insight, which enhances the ability to meet service level agreements by modeling and monitoring critical business services rather than just individual components. It emphasizes leveraging the dynamic service import capabilities and service discovery policies to reduce manual effort in building service models. The presentation outlines the transformation from traditional operations centers to a business operations center focused on service health, triage, and collaboration across different domains.

Tech Talk: Agile Product Management PlaybookCA Technologies

This document summarizes a presentation about embedding agile product management practices. It discusses iteratively working on initiatives and features at different levels, from executive strategy down to development teams. It presents techniques for collaboration between product managers and teams, gathering continuous feedback, planning in initiative and feature roadmaps and releases, and executing work within timed releases. The overall message is how to structure work hierarchically while enabling collaboration across roles to deliver the most valuable functionality.

Tech Talk: CA Live API Creator MythBuster: Domain Logic Requires Domain-spec...CA Technologies

This document summarizes a presentation about using reactive logic to handle domain-specific business logic. Reactive logic uses spreadsheet-like expressions to define validations and computations across multiple database tables. This approach is more concise and executable than traditional coding, scaling effectively to handle complex enterprise problems like payment allocation and price rollups through a few simple rules. The reactive logic approach claims to provide faster development and greater agility than traditional coding for business logic, which typically requires a significant amount of code.

Data on Demand: Now That’s What we’re Lookin’ For!CA Technologies

This document discusses how CA Test Data Manager can provide test data on demand for development and testing teams. It presents three use cases: 1) allowing testers to reserve unique test data through integration with CA Agile Central, 2) cloning missing test data from production environments, and 3) enabling synthetic generation of application objects. Live demonstrations are provided for each use case. The presentation concludes that CA Test Data Manager's capabilities for finding, generating, and delivering test data help ensure development and testing teams have the right data when and where they need it.

Digital transformation in financial services through trusted digital relation...CA Technologies

This document summarizes a presentation about digital transformation in financial services. The presentation discusses how financial services have become digital businesses and must transform digitally to stay competitive against new fintech startups. It highlights how building trusted digital relationships with customers through secure digital identity management can help financial institutions innovate, drive customer acquisition and retention, and grow their business. The presentation provides examples of how some financial institution customers are using CA's digital relationship platform and identity and access management solutions to transform their business through trusted digital relationships.

CA API Gateway: Web API and Application SecurityCA Technologies

This document discusses how CA API Gateway can be used to secure web APIs and applications. It begins with an introduction to securing the new digital perimeter where APIs are increasingly exposed. It then provides an overview of the CA API Management suite and common use cases. The remainder of the document discusses various security considerations and features that the CA API Gateway provides, such as authentication, authorization, encryption, auditing, and protection from common vulnerabilities and attacks. It concludes by recommending where organizations should start in securing their APIs and applications.

Pre-Con Ed: CA API Gateway: How to Deploy Your Gateway Across Multiple Enviro...CA Technologies

The document outlines deployment scenarios and best practices for CA API Gateway, covering on-premises, public cloud, private cloud, and hybrid options. It discusses various deployment models, their pros and cons, and offers real-world examples for each scenario. Additionally, the document includes best practices for load balancing, VMware configurations, and performance testing to optimize the implementation.

More Related Content

What's hot (20)