In this latest Singapore MuleSoft virtual meetup, we took a deep dive into the recently launched Healthcare Accelerator understanding the industry context, and how it's addressing the growing connectivity challenge the Industry is facing. We also explored MuleSoft's security approach. Critical to Healthcare, but all other Industries also, ensuring APIs and data are kept secure, we discussed MuleSoft's approach to securing your API infrastructure as whole, APIs themselves and the information sharing they enable.

1. September 24th 2020
Singapore MuleSoft Meetup #6

2. All contents © MuleSoft Inc.
Our Partners
2

3. Agenda

4. All contents © MuleSoft Inc.
Agenda
4
• 4:00 pm: Welcome & Introduction
• 4:15 pm: Healthcare Accelerator, what’s under the covers?
• 4:40 pm: API Security with MuleSoft
• 5:10 pm: Events roundup and quiz
• 5:30 pm: Meetup concludes

5. Introductions

6. All contents © MuleSoft Inc.
Organizers
6
Julian Douch – Senior Director
Capgemini
Integration veteran of 20 years, transformation strategist, and digital leader, established WhiteSky
Labs in ASEAN, and now leading the growth of MuleSoft adoption across JAPAC with Capgemini.
Passion for growing talent and dispersion of knowledge, I'm now driving fast to similarly establish
the MuleSoft community also, forging relationships with the current developer community,
expanding the community by reaching new technologists who've a passion for building out a new
API-centric digital economy.

7. All contents © MuleSoft Inc.
Co-host
7
Greg McCreanor - Senior Manager,
Solutions Engineering ASEAN
MuleSoft
Greg has been recently promoted to SE Manager and was a Principal Solutions Consultant for
MuleSoft based in Singapore and has over 20 years of experience working in both core systems and
integration technologies. Since joining MuleSoft he has brought valuable insight to our customers and
prospects about their current technical challenges and how to move to the next generation of
solutions. In the last 3 years, he has worked extensively with our public and private sector customers
within Australia, New Zealand, and South East Asia

8. Healthcare Accelerator – What’s under the covers?
Monika Verma
Senior Manager, Capgemini

9. All contents © MuleSoft Inc.
Speaker
9
Monika Verma – Senior Manager
Capgemini
Monika is an Integration expert who has been working and delivering integration solutions for
Banking and Finance for 12+ years. She has experience as a solutions architect for
Customer Management and Payments platform.
She has extensive experience in system integration within the Banking, Finance and Retail
domain. She has led and delivered digital project for Banking and Finance clients.

10. All contents © MuleSoft Inc.
New accelerator launched June 2020

11. All contents © MuleSoft Inc.
11
Healthcare & Digitisation

12. All contents © MuleSoft Inc.
12
Healthcare Ecosystem
Health Providers Health Payers Third Party Systems
GP Clinic
Hospital Home Care
Labs Radiology
Pharma
Public Private
Patient
Apps Wearable
Scales Monitoring
Device

13. All contents © MuleSoft Inc.
13
Patient Journey
Clinical
Notes
EHR
Clinical
Notes
Billing
Lab OrdersLab Results
EPrescription
Billing
Imaging Order
EHR
Imaging
Results
BillingImaging Result in CD
EHR
Clinical
Notes
Lab
Results
EPrescription
EHR
Clinical
Notes
EPrescription
Billing
Billing
Payer
Claims Data/
Coverage
GP
Radiologists
Speciality Hospital
Speciality Hospital
Pharmacy
Lab
PMS
LIMS

14. All contents © MuleSoft Inc.
14
• Patient
• Lack of unified view
• No access to own data
• Provider
• No exchange of data
• No centralized view
• Payer
• No data transparency
Fragmented System Challenges
Dissatisfied Patient
Experience &
Limitations to Maximise
Clinical Care Outcomes

15. All contents © MuleSoft Inc.
15
Right Data, Right Hand, Right Time

16. All contents © MuleSoft Inc.
16
• Fast and agile by design.
Reusable building blocks with defined standards.
• Secure across endpoints
Built in security & governance with API policies.
• Low costs
Lower development costs through reuse.
API-led approach for Digitisation
API-led connectivity allows healthcare organizations to connect data, devices and applications quickly
through APIs and enabling the business to leverage technology to address patient needs.

17. All contents © MuleSoft Inc.
17
• Empower Salesforce health cloud (and other
Patient Management solutions) with real time
patient data
• Rapidly connect any application, datasource or
device with out of the box support for HL7 v2
and FHIR standard
• Build Fast Healthcare Interoperability
Resources (FHIR)-compliant APIs.
MuleSoft Healthcare Accelerator
Deliver connected healthcare experiences faster
Patient Providers Payers
Clinical Data
Non-Clinical
Data
Devices 3rd
Party
Healthcare Accelerator

18. All contents © MuleSoft Inc.
18
MuleSoft Healthcare Accelerator - Assets

19. All contents © MuleSoft Inc.
19
MuleSoft Healthcare Accelerator - Use Cases
Provider Payer
Patient 360
Self service portals
Improved clinical-decision making
with better access to patients
data.
Provide 360 view for customer
service agent to improve service
quality and efficiency
Better patient retention by
enabling on-demand referral
appointments & low operational
cost
Improve service by enabling
member to book in network
appointments through there
insurance
Patient Onboarding
Follow-up Reminders
Covid-19 Care
Acquire more customers with
easy, self-service member
enrollment.
Improved service quality and
efficiency with less paperwork &
reduced operational cost
Improved patient retention by
ensuring existing patients
return to the provider for new
or follow-up services
Optimize care cost with early
detection of disease
Improve public health with
control in virus spread
Optimize care cost
Patient
Better connected
healthcare
experience with
improved care
quality , reduced
wait time & value
for money.

20. API Security – the MuleSoft way
Argel Cabalag
Manager, Capgemini

21. All contents © MuleSoft Inc.
Speaker
2
1
Argel Cabalag – Manager
Capgemini
Argel is highly experienced in Systems Integration and Solutions Development with 11+ yrs
work experience and 8+ yrs of it in Telecommunication Industry as Application Engineer and
Solutions Architect.
He has extensive applied experience on integrations and deployment of multiple client
applications using MuleSoft, along with hands on experience on different setups of
deployment environment from on-prem, cloud based or hybrid setup.

22. All contents © MuleSoft Inc.
Security Considerations
Secure by design considerations
• Securing of underlying infrastructure between enterprise / application boundaries
• Securing of the APIs and who can / cannot use them
• Securing of access to the data in transmission
• Securing of the data itself in transmission
In addition, we must also consider prevention of other malicious activities -
• Denial of service threats by unauthorized users
• Mis-usage of the API services by authorized users
• Audit logging

23. All contents © MuleSoft Inc.
Anypoint Platform
Security Options

24. All contents © MuleSoft Inc.
Controlling Access to Anypoint Platform
By default, Anypoint Platform performs its own identity management
• Organization Owner – the first username used to register for the organization and
inherits the Organization Administrator role
• Roles - use to limit or allow access on products or features within Anypoint
Platform
• Business Groups - provides a way to separate and control access to Anypoint
Platform resources
• External idP (Identity Provider) – allow customers to integrate external idP but
Roles & Permissions are still controlled inside Anypoint Platform (ie: LDAP,
OpenID)
• Client Management – provides a way to authorize client applications that try to
access your API

25. All contents © MuleSoft Inc.
Improving Security with Modern APIs
Traditional Approaches to Security
• TLS,
• Firewalls,
• Reverse Proxies
• DMZs
Zero Trust Model – where APIs are
responsible for the following at every level
• Authentication,
• Authorization and
• Access Control.

26. All contents © MuleSoft Inc.
Securing Mule Applications
• Secure Communication – data in transmission cannot be intercepted by
3rd party or what we call MITM - ”Man-in-the-middle attack”
– Cryptography (Encryption / Decryption)
– Used of Digital Certificates or HTTP/s client & server
• One-way or Two-way SSL
• Credentials / Properties Placeholder
• Policies - enforced using API Manager
– Client ID Enforcement
– Authentication / Authorization
– Tokenization
– QoS (Quality of Service)
– Payload threat Protection and others

27. All contents © MuleSoft Inc.
Ways to Secure Data in Transmission
Format Preserving Tokenization
Application data validation logic work “as is”
No downstream application changes needed
Compliance scope reduction (PCI, HIPAA,
GDPR)
Information anonymization
Analytics without exposing sensitive data
Format Preserving Encryption
Data Masking
Sensitive data obfuscation
One-way process: Cannot get original value back

28. All contents © MuleSoft Inc.
Policy Level vs Application Level Encryption
Approach 1 - Policy Level Encryption
• Encryption managed at Policy Level and applied to APIs pre-
deployment
• Leverages the MuleSoft Security Edge / Tokenisation capability
• Tokenized field via Selector Expression
• Prerequisites:
- Installed Runtime Fabric
- Edge / Tokenisation service enabled
Approach 2 – Application Level Encryption
• Encryption managed at API/App Level and embedded within
the API
• Encrypts/Decrypts/Mask Data based on selected field using
API implementation flow features
• Can be in Cloudhub or Runtime Fabric – does not require
edge / tokenization service

29. All contents © MuleSoft Inc.
Demo : Applying Tokenization Policy

30. All contents © MuleSoft Inc.
Demo : Creating a Custom Policy

31. All contents © MuleSoft Inc.
How will this relate to
Zero Trust Model?

32. All contents © MuleSoft Inc.
Audit Logging & Application Logging
Audit Logging – provides history of
actions performed within Anypoint
Platform
Application Logging – helps
user to monitor and
troubleshoot apps and
the Mule Server

33. All contents © MuleSoft Inc.
Securing Network & Infrastructure
Anypoint VPC – allows user to create private VPCs to isolate network in the cloud
and to host Mule Workers (Cloudhub Workers)
• Usually a VPC uses one or more Load Balancers to route traffic with external and
private network
• By default, Cloudhub provides Shared Load Balancers but a Dedicated Load
Balancers can also be purchased and assigned to a VPC
• How VPC typically used?
– Firewall Rules
– Connect corporate intranet
– Connect your VPC to another AWS VPC

34. All contents © MuleSoft Inc.
Deployment Models

35. All contents © MuleSoft Inc.
Saas Deployment Model (Cloud)

36. All contents © MuleSoft Inc.
Hybrid Security Models

37. All contents © MuleSoft Inc.
Best Practices
Platform Guidelines Auth Model Design Guidelines
Preferred model can be Hybrid with
Control Plane in the cloud and
(Runtime) data plane On-Premise.
MuleSoft’s Control plane in Cloudhub
as part of the Hybrid model manages
risk & compliance in following way
• MuleSoft’s Control Plane follows
FIPS 140-2 requirements
• MuleSoft uses encryption in transit
(TLS 1.2) and at rest (AES 256,
recommended by FIPS 140-2
• MuleSoft’s API Manager Data (API
Analytics); Encrypted using AES
256
• Mule App Configurations; Encrypted
using AES 256
• Mule App Secrets; CSM Hashicorp
Vault
Full on-premise deployment is suited
when enterprise has strict PII
processing AND metadata
requirements.
§ Use effective authentication
and authorization models
§ Recommended protocols are
API Key, Oauth2 & OpenID
Connect (with JWT)
§ Enforce HTTP Methods which
correlates to the action, user is
attempting to perform.
§ Validate the type of content
being sent in API requests
§ Based on the need and
security requirement fine
grained, attribute level, role-
based authorization should be
used for entitlement
§ Validate all incoming data
against Cross Site Scripting
(XSS) and SQL Injections.
§ Sanitize data sent to other
systems
§ Ensure functional and user-
friendly error messages,
remove stack traces
§ Enable Info logging in
Production. Only log information
that is required for resolving
technical issues and do not log
PII or sensitive information
§ Adopt CICD with full dev/deploy
traceability
§ Ensure all login, access control
failures, and server-side input
validation failures can be logged
with sufficient user context to
trace any mis-use

38. All contents © MuleSoft Inc.
Summary
MuleSoft Anypoint Platform – Security provides various of security
features enabling -
– Securing of your Anypoint Platform Account
– Securing of your Mule Applications, adopting a ”zero trust
model”
– API and user activity monitoring providing identification and
auditing / traceability for any possible security breaches
– Different types of Deployment Models to fit into a business’s
security topology

39. Info & Upcoming Events

40. All contents © MuleSoft Inc.
MuleSoft CONNECT: Now – APAC 2020
- MuleSoft CONNECT: NOW is going virtual again in APAC
- 20 October 2020 | 1:00pm - 2:30pm AEST (11:00am – 12.30pm
SGT)
- Digital conference only with Keynote + breakout sessions covering
5 different talk tracks (Retail, Banking, Insurance, Public Sector,
Technology)
Register here to reserve your place.

41. All contents © MuleSoft Inc.
Certification Week Training Special Promotions Technical Seminars
AUDIENCE - All those that have attended training and not
yet certified
ACTIVITIES
Developer Exam Readiness Sessions:
● 1st October, 10am AEST
● 15th October, 11am AEST
Architect Exam Readiness Sessions:
● 6th October, 10am AEST
“Path to Cert” bundle
Audience: net new to MuleSoft Training
Offer: Sign up for self-paced Dev Fundamentals,
earn a free exam attempt, and get exclusive
attendance to instructor office hours.
Sign up to register for the bundle on the day to
enter into raffle for a free seat.
Friday 23rd October
● Titanium Workshop
● Monitoring Workshop
Training
41
CERTIFICATION WEEK: 19th - 22nd October
- CERTOBER Registration
Certification Appreciation
Certification Quiz with prizes

42. All contents © MuleSoft Inc.
A Developer’s Learning Journey...
- Exam Readiness Workshop
- Self-assessment quiz
- Do-it-yourself exercises
- Register for an online
proctor exam
- Sign up for the Mule.U courses
- Attend the Technical
Introduction Workshop
- Dates: 1st Oct, 15th Oct and
22nd Oct
- Mulesoft Training Forum
- Tutorials

43. All contents © MuleSoft Inc.
Other events
• API Days Hong Kong - 8th October 2020
• API World – 27th October 2020
• Fintech Festival Singapore – w/c 7th December

44. All contents © MuleSoft Inc.
Next MuleSoft Meetup
- Next MuleSoft meetup will on Thursday 10th December 2020
- Agenda
– 4:00 pm: Welcome & Introduction
– 4:15 pm: TBC - Looking for speakers!
– 4:40 pm: TBC - Looking for speakers!
– 5:10 pm: Quiz & prizes
– 5:30 pm: Meetup concludes
Please contact Julian Douch if you would like to present a topic at the next Meetup

45. Competition Time

46. All contents © MuleSoft Inc.
• How attentively have you been listening … and how quickly can you
type?!
• First 3 correct answers for each question will receive a MuleSoft
prize
• All winners will be contacted by email.

47. Picture Time

48. See you next time
Please send topic suggestions to the organizer