Platform Security that will Last for Decades
summary
Identity is the single biggest bottleneck for platforms over decades and the practical solution is a standards-based stack: OAuth2, OpenID Connect, HTTP/2 and JSON Web Token for token exchange, plus SCIM for user CRUD and WebCrypto/CWT/COSE for compact IoT tokens. Architect the platform as three subsystems—identity management (user service, federation, security token service, authentication), API management (API security gateway, integration) and entitlement (attribute‑based access control). Start with a gap analysis, pilot HTTP/2 and migrate legacy WS-* integrations to OpenID Connect.
AI-written summary · about
chapters (15)
- 0:00Intro
- 2:55Drones
- 5:07Space Tourism
- 8:46Identity Relationships
- 10:55Open Standards
- 13:00Identity Management
- 13:45Components of Identity Management
- 15:52Authentication Service
- 17:21API Management System
- 19:40Architecture
- 22:01JSON Web Tokens
- 23:07OAuth
- 26:10Additional Resources
- 27:32Summary
- 29:18Questions
related talks
21mBuilding Neo-security Platforms: Securing APIs using modern standards
24mTransforming into a Platform for Innovation and Agility
27mIntegrating API Security Into A Comprehensive Identity Platform
32mSecuring Value in API Ecosystems
14mArchitecting Secure and Scalable Integration Platforms for FinTech
19mIdentity:The missing link in API security
18mAPI Security Simplified: A 5-Pillar Approach
29mAPI Security in 2017