Free REST API Security guide
March 31, 2019 Comments Off on Free REST API Security guide
If you’ve worked with both major varieties of API (Web services & REST) for any length of time, you’ll know that the approach to security varies widely between them. In the Web services world, there are numerous standards bodies and security guidelines, such as:
These are just a few examples of what’s out there.
Thanks to all of this ancillary work, a common (mis)perception has sprung up that Web services are more secure than REST APIs. While there’s a kernel of truth to this assumption, REST APIs now benefit from their own set of security standards and best practices. To give you a better idea of what these are, check out this helpful eBook on Dzone, written by Guy Levin, CTO of RestCase.
AWS Neptune graph database training now available
May 31, 2018 Comments Off on AWS Neptune graph database training now available
Currently in preview mode, Amazon’s new Neptune graph database offering will be a game changer. By democratizing access to graph data, it will spawn innumerable new initiatives.
I’m proud to announce the availability of the WiseClouds’ Amazon Web Services Neptune Graph Database Design & Development course. Available for private delivery (both via live Webinar as well as onsite), these hands-on classes are highly customizable based on client requirements. To learn more and download the syllabus, visit here.
Why the recent Internet of Things (IoT) attack is just the beginning
October 30, 2016 Comments Off on Why the recent Internet of Things (IoT) attack is just the beginning
A few days ago we witnessed a new type of distributed denial of service (DDoS) incident. Unlike previous botnet attacks that enlisted compromised computers, this one corralled assorted unprotected devices like Internet-ready webcams, DVRs, and baby monitors to flood Domain Name System (DNS) servers, and thereby seriously degrade the Internet for hours. I’ll leave the explanation of the mechanics of this incident to more qualified commentators, but I do want to weigh in on why I think these types of events are very hard to combat and why I’m very skeptical about the hype around the Internet of Things (IoT).
We all (well, many of us) know how important it is to keep our computers and software patched and up-to-date; most people also get why firewalls are essential. But consider these facts about IoT devices:
- They’re being created for just about every industry. This diversity means that it’s much harder for the entire universe of vendors to agree on common security standards: defining safeguards for a heart pump is a little different than for a Web-ready washing machine. I’ve served on my share of standards committees: to say that they move slowly is an understatement!
- They have really short development cycles. IoT is shaping up to be a brutally competitive landscape. The winners will be those vendors that deliver solutions to market quickly. Designing and building strong security safeguards takes time, and time is money. The end result is that device protection takes a back seat to market pressures.
- There’s limited space for security software. Margins are very thin on hardware devices: security-focused onboard storage space adds costs that aren’t directly related to functionality.
- They frequently rely on APIs for communication. I’ve blogged about API security in the past. Suffice it to say that it’s a rare API that’s locked down properly.
- New models are always coming on the market. Here’s the really scary part: even if vendors do start getting their security act together, it will be years before today’s highly insecure devices get retired. Meanwhile, they’ll be standing by for their next set of DDoS orders.
Announcing Swagger training & certification
July 25, 2016 Comments Off on Announcing Swagger training & certification
Whether they’re employed internally, externally, or both, APIs are vital assets that connect systems, streamline workflows, and make every type of integration possible. In fact, beyond strengthening operational efficiency and enabling cross-system communication, APIs now serve as competitive differentiators for many organizations. It’s no exaggeration to point out that renowned technology-driven businesses such as Uber, AirBnB, or eBay live and die on the quality and performance of their APIs, and this intense reliance is spreading across every industry.
Swagger – and its ecosystem of standards and products – is in the process of transforming the ways that APIs are designed, developed, tested, and supported. I’m happy to announce that my colleague Chris Riley has created an outstanding one-day training and certification program to help enterprises get the most out of Swagger.
Chris is a world-class expert on DevOps, Continuous Integration, and everything else related to how modern APIs are being created, and this deep knowledge comes across in his courseware. He also happens to be a great trainer who is committed to helping his students gain the proficiency they need.
Organizations can send individuals to public Webinars, schedule a private Webinar, or even have an instructor deliver the class onsite. To learn more, visit SmartBear’s registration page.
Presenting a Webinar on Delivering Data Security with Hadoop and the IoT
July 18, 2016 Comments Off on Presenting a Webinar on Delivering Data Security with Hadoop and the IoT
On August 9, I’ll be teaming with Reiner Kappenberger from Hewlett Packard Enterprise to explore some of the most pressing security implications of Hadoop and the Internet of Things (IoT). Hosted by the IT GRC Forum, here’s what we’ll be covering:
The Internet of Things (IoT) is here to stay, and Gartner predicts there will be over 26 billion connected devices by 2020. This is driving an explosion of data which offers tremendous opportunity for organizations to gain business value, and Hadoop has emerged as the key component to make sense of the data and realize the maximum value. On the flip side the surge of new devices has increased potential for hackers to wreak havoc, and Hadoop has been described as the biggest cybercrime bait ever created.
Data security is a fundamental enabler of the IoT, and if it is not prioritized the business opportunity will be undermined, so protecting company data is more urgent than ever before. The risks are huge and Hadoop comes with few safeguards, leaving it to organizations to add an enterprise security layer. Securing multiple points of vulnerability is a major challenge, although when armed with good information and a few best practices, enterprise security leaders can ensure attackers will glean nothing from their attempts to breach Hadoop. In this webinar we will discuss some steps to identify what needs protecting and apply the right techniques to protect it before you put Hadoop into production.
If you’d like to join us, register here.
Excellent article about FBI’s iPhone crack
March 30, 2016 Comments Off on Excellent article about FBI’s iPhone crack
Bruce Schneier has long been one of my favorite technology authors and bloggers. He manages to write about extremely complex topics in a very accessible way – a notably rare and highly admirable skill. His latest article explains why the secretive approach that the FBI is employing to unlock iPhones will eventually harm innocent users unless Apple is notified of the device’s vulnerability.
The problem with computer vulnerabilities is that they’re general. There’s no such thing as a vulnerability that affects only one device. If it affects one copy of an application, operating system or piece of hardware, then it affects all identical copies. A vulnerability in Windows 10, for example, affects all of us who use Windows 10. And it can be used by anyone who knows it, be they the FBI, a gang of cyber criminals, the intelligence agency of another country … anyone.
This is precisely why Apple needs to understand what’s happened. Otherwise, the next entity to break into iPhones may not be doing so in the legitimate and honorable interest of solving crime.
I read Bruce’s blog regularly, and recommend it to anyone interested in security and information protection.
Comprehensive API survey now available from SmartBear
February 29, 2016 Comments Off on Comprehensive API survey now available from SmartBear
I’ve been designing, developing, testing, and optimizing APIs for many years. I’m encouraged by the increasing amounts of attention that these critical enterprise assets are now garnering.
SmartBear has recently conducted an all-encompassing survey of more than 2,300 developers, testers, IT/operations professionals and business leaders representing over 50 different industries and 104 countries. This is essential reading for anyone seeking to learn more about the state of the API landscape.
It covers topics such as:
- API technology and tool trends
- Top opportunities and challenges in the API space
- API development and delivery approaches
- API consumer expectations and priorities
- Keys to ensuring API quality and optimizing performance
You can download this excellent resource here.
Free data-driven API testing eBook is now available
December 29, 2015 Comments Off on Free data-driven API testing eBook is now available
I recently had the pleasure of co-hosting a data-driven API testing Webinar with Paul Bruce from SmartBear. I’ve compiled the recommendations we made during this event into a free eBook which you can now download. A special thanks to Kim Salmon from SmartBear for her help in getting the book developed and published!
Das Auto, der Algorithmus, und der Smog
September 19, 2015 Comments Off on Das Auto, der Algorithmus, und der Smog
Looks like Volkswagen is going to have some ‘splainin’ to do: the company has been ordered to recall 482,000 diesel-powered vehicles (including Jetta, Golf, Passat, Beetle, and Audi A3) by the US Environmental Protection Agency, US Department of Justice, and California Air Resources Board.
VW is being accused of implementing an algorithm that detects when the car is being smog-tested and then applying full emission controls so that the vehicle will pass. At other times (like during normal road operations), the emission controls were programmatically relaxed and the car belched out much higher levels of pollutants such as nitrogen oxide.
You can read the violation notice here. Wow.
And as algorithms become more prevalent in everyday devices (i.e. “the Internet of Things”), there should be all sorts of entertaining stories to come. Some will involve felonious behavior, while others will just be the natural outcome of poor design or shoddy quality control.
rdschneider 
You must be logged in to post a comment.