Structuring
Security
Forward
(Part 2)
Megan Bell

Current State — best practices only get so far
Encryption and signatures
Tokens
API gateways
Quotas and throttling
API vulnerability management
API keys | Basic authentication |
OpenID Connect

Problem — Not addressing the issues
Business logic challenges
Authentication / Authorization
Source code security / integration
Expanded staff permissions
Excessive data exposure
Misconfiguration
APIs

Data is pushed to an
endpoint for consumption.
Rapid development
Lean security.

Broaden security thinking:
- Lifecycles
- Connections
- Interactions

Lean Security:
- Volume of
knowledge
- Less staff
- More complexity
- Automation

Immune Systems

Immune System Protections:
● Innate
● Adaptive
● Passive

Immune System Functions:
● detect and fight infection
● recognize one’s own cells as "self," as part of protection
from an attack
● retain memory from previous infections
● limit response after a pathogen has been removed

Build a strong
foundation –
start with
innate
security.

Security begins with good design,
quality and “governance”.

Accountability

Investment
decisions – build
versus buy

Begin with data and its purpose

Know systems, services and
pieces and parts.

Safety:
● Boundaries
● Access
● Defense-in-
depth

Know your risk
profile (victimology
– how does an
attacker see you?)

Data in Transit

Security
Patterns

Thank you.