API transactions are subjected to many authorization decisions at many different layers. User identities, application scopes, attributes, roles, data privacy, user consent, contracts… Tidy up your decision-making responsibilities across your stack. This presentation will discuss the benefits and tradeoffs of decoupling authorization from service implementation.

1. Kondo-ing API Authorization
Remy Lyle
OCT 2019
1 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.

2. HI! I’M REMY
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.2
• Global Tech Enablement Team @ Ping
Identity
• Denver, CO, USA
• Convinced that APIs are the next frontier
for identity and security
• Marie Kondo is a personal hero

3. MARIE KONDO
 Tidying Expert,
Bestselling Author,
Netflix Hit Show Star
 NYTimes Best Selling
Book, The Life
Changing Magic of
Tidying Up
 “Does it spark joy?”
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.3

4. BUT… FOR
API
AUTHORIZATIONS?
4 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.
https://www.wsj.com/articles/kondo-ing-a-
guru-of-organizing-becomes-a-verb-
11547745648

5. ANATOMY OF AN API
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.5
JSON
GET /getData

6. ANATOMY OF AN API
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.6
JSON
GET /getData
Scopes
Identity
Attributes
Privacy
Preferences
User Consents
Data
Regulations
Zero Trust

7. AND HOW MANY DO YOU HAVE?
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.7 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.7

8. FOUR DATA OBSTACLES
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.8
1. Data is detailed and complex.
2. It’s everywhere and accessed many ways.
3. Multiple stakeholders, moving targets and
ever-changing landscape of data security
policies and regulation
4. Data transactions are subjected to different
layers of authorization decisions

9. THIS IS A REAL PROBLEM
 OWASP Top API Security Top 10 Risk
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.9
https://www.owasp.org/index.php/OWASP_API_Security_Project

10. WITH REAL-LIFE CONSEQUENCES
 In 2018, a research fellow with Mozilla Foundation
scraped nearly 208 million transactions on peer-to-peer
payment app Venmo revealing purchase profiles of its
users
 In June 2019, another 7 million transactions were
scraped using the company’s developer API over six
months
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.10
Sources: https://www.darkreading.com/application-security/apis-get-their-own-top-10-security-list/d/d-id/1335786
https://22-8miles.com/public-by-default/
https://www.wired.com/story/i-scraped-millions-of-venmo-payments-your-data-is-at-risk/

11. WHO IS RESPONSIBLE?
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.11 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.11
DEVELOPERS? CLIENTS?
X X

12. ENTER IN … A TIDYING LAYER
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.12 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.12

13. WHAT IF TIDYING WAS APPLIED
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.13
Scopes
Identity Attr
Privacy
Preferences
User Consents
Data
Regulations
Zero Trust
Business Defined
Policies
DEVELOPERS
CLIENTS

14. WHAT IF YOU COULD PULL FROM ANY SOURCE
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.
14
Scopes
Identity Attr
Privacy
Preferences
User Consents
Data
Regulations
Zero Trust
DBs
Directory
Other APIs
Any state
Any attribute
Any authz data
source

15. WHAT IF THE ARCHITECTS COULD WRITE THE POLICIES
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.15
Business-Derived
Policies

16. WHAT IF ACCESS CONTROLS WERE APPLIED
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.16
Allow?
Block?
Filter?
Obfuscate?
CLIENTS
FirstName
LastName
AccountNumber
Balance
FirstName
LastName
AccountNumber
Balance
OR
…

17. DECOUPLING AUTHZ FROM IMPLEMENTATION
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.17
API Layer that enforces fine grained access control

18. DECOUPLING AUTHZ FROM IMPLEMENTATION
Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.18
Marie Kondo API
Layer
Driver/Obstacle Benefits (How it Helps)
1.
Fine-grained
authorization
policy engine
Diff layers of authz
decisions
Remove developers from managing authz at the individual API level, and remove
clients from filtering data themselves at the individual API level
Reduce top API
security risk
Centralize authorization decisions, regardless of authorization data sources, and re-
use authorization policies across multiple APIs
Privacy Preferences &
Consents
Policies can enable delegated consent to data access & preference lookups and
enforce data access decision based on customers’ wishes.
Consumer Data
Regulations
Policies can enforce compliance with new and changing consumer data protection
legislation; sometimes requiring consents.
Zero Trust Set up micro-segments of data, even down to the data attribute, to enable least
privilege access for sensitive data.
Securing APIs Check and enforce policies and customer consents for data being accessed by a
third party through a customer data API.
Data is detailed Enables granular, attribute-by-attribute access control capabilities
2.
GUI
Trust
Framework
Data is everywhere Real-time connections to policy attributes anywhere (e.g. risk scores)
[All Drivers] Need for ABAC & dynamic authorization
Policies
Many stakeholders Externalizes authorization to users for collaborative policy design
Reconciling reqs Lifts burden on developers, no need to reconcile or write code

19. Does your API authorization model spark joy?
19 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.

20. PINGIDENTITY.COM
20 Confidential | Do not distribute — Copyright ©2019 Ping Identity Corporation. All rights reserved.