1 Raindrop

Bringing API Security to the most dangerous place in your enterprise

What's the most dangerous part of your enterprise? How about your developer's desktop? There are few things with more ability to negatively or positively impact your enterprise security than developers. Infosec must empower them with knowledge and security tools they need to get the job done. Intel is rolling out integration with Mashery for enhanced API security management. Why is this a big deal? Back in February I did a Security > 140 Conversation with Craig Burton (emphasis added):

GP: Your work on the API economy has many implications, as a security guy I am particularly interested in the security and identity bits. What do you think changes in the security architect's world when they're defending an API (and the data and functionality behind it) versus normal IT Security defending an enterprise?

CB: I think the biggest change is in the area of token and key management. If an organization wants to make sure that its API(s) are not being abused, well managed keys and tokens are essential. Managing developer's with keys is probably not something most organizations have ever done. This will be new and will require focus, education and vigilance. This is why finding the right partner for managing an API or API suite is essential.

The dichotomy of purpose is also going to be a challenge. In the enterprise, the job is to plug any and all holes as much as possible.

In an API economy, it is essential to have elegant managed access to core competency.
This is not only a technical challenge with keys and tokens, but a political and position challenge that goes against the grain of the past.

Web services gateways started to gain steam with SOA, SOAP and the like, but Gateways are vital today. They play a fundamental role in Cloud and Mobile security. We can expect that the security capabilities will be there for most products, but equally important is how they are able to empower developers to get the job done.

Android Hacked in Ethiopia

Now this is a lede:

"What happens if you give a thousand Motorola Zoom tablet PCs to Ethiopian kids who have never even seen a printed word? Within five months, they'll start teaching themselves English while circumventing the security on your OS to customize settings and activate disabled hardware."

Michael Howard said something years back that stuck with me - programming is human against compiler, much easier than security which is human against human.

Of course in this case its not a classic security fail of a malicious threat against asset, in fact the overall story is quite a triumph of human ingenuity:

"We left the boxes in the village. Closed. Taped shut. No instruction, no human being. I thought, the kids will play with the boxes! Within four minutes, one kid not only opened the box, but found the on/off switch. He'd never seen an on/off switch. He powered it up. Within five days, they were using 47 apps per child per day. Within two weeks, they were singing ABC songs [in English] in the village. And within five months, they had hacked Android. Some idiot in our organization or in the Media Lab had disabled the camera! And they figured out it had a camera, and they hacked Android."

What it does show from a security perspective though is the limitation of what we can reasonably expect from any access control. Humans with time and determination will find their way around, whatever you're basing your access control scheme on (TLS, Kerberos, SAML, ...) you have to assume it will fail eventually (and not in a good way as in this story) and factor in how the system as a whole survives.