A presentation given by Aldo Pietropaolo, Director of Solutions Engineering at SGNL, at our 2024 Austin API Summit, March 12-13. Session Description: Securing APIs and ensuring you are protected from threats by implementing authentication and authorization while keeping the request context intact can be challenging. This session will show us how to leverage SGNL, Curity, and the Kong API Gateway to protect fictitious patient records. The session will be a technical session focused on the architecture and integration points for implementing continuous access management.

1. API AUTHORIZATION
Aldo Pietropaolo
Using an Identity Server and Gateway
Presented by
Director of Solutions Engineering, SGNL.ai

2. API Access Control
is Critical
Implementing a least-privilege
approach for five major
vulnerabilities of the top ten can
guard against common API
security exploits
API1:2023 Broken Object Level
Authorization
API2:2023 Broken Authentication
API3:2023 Broken Object Property Level
Authorization
API5:2023 Broken Function Level
Authorization
API8:2023 Security Misconfiguration
2
Copyright © SGNL.ai, Inc

3. Copyright, © SGNL.ai, Inc
API Defense in Depth
● Layered Approach for API
Security
● Mostly Comprised of Runtime
Capabilities
● Request Context is Single
Focus of Chain
● Every Request Must Pass
“green light” Each Layer
Three Layers
3
Copyright © SGNL.ai, Inc

4. Transport / OAuth2 /
OIDC
● Authentication User Principal /
M2M / MFA (JWT, API Keys, TLS)
● Coarse grained Authorization
(IDP Claims, Scopes)
● Token Encryption / Signatures
(JWE,JWS)
● Strict OAuth2 / OIDC Support
4
Copyright © SGNL.ai, Inc
Layer 1

5. 5
SGNL.ai, Inc. Proprietary & Confidential
API Gateway / Kong
● OAuth2 / OIDC Plugins
● Coarse grained Authorization
Plugins
● Request Proxy / Orchestration
● Continuous Access
Management Plugin (SGNL)
● Encryption / Signature plugins
● Other Authentication / Security
Plugins (Plugin Hub)
5
Copyright © SGNL.ai, Inc
Layer 2

6. Continuous Access
Management
6
Copyright © SGNL.ai, Inc
● Request Context Consistency
● Centralized Fine Grained
Authorization Policy
● Authorization Based on
Business Context
● Authorization on Every Request
Layer 3

7. Continuous Access Management
Zero Standing
Privileges
Dynamic
Enforcement
Context-Based
Policies
Auditable
by Default
7
Copyright © SGNL.ai, Inc

8. Copyright, © SGNL.ai, Inc
High Level Architecture
8
Copyright © SGNL.ai, Inc

9. Copyright, © SGNL.ai, Inc
Demo Flow
9
Copyright © SGNL.ai, Inc

10. 10
Copyright © SGNL.ai, Inc
Policy

11. LEARN MORE AT
sgnl.ai