[MUSIC PLAYING]
MANOJ GUNTI: Hello, everyone, and welcome to today's webcast
on intelligence insights into API security.
My name is Manoj Gunti, and I'm the product marketing
manager for Apigee at Google.
Before we begin the webcast, I wanted
to take this couple of minutes to cover
some housekeeping items.
What you see on your slide should
resemble the webcast console, and at the bottom left corner,
you will see a Q&A console where you can post your questions.
Please note that you don't have to wait
until the end of this webcast to post your questions.
Please feel free to post them at any time during the webcast,
and we will take five to 10 minutes
at the end of the webcast to go through them.
Next to the Q&A console is the Resources section.
I will be making a lot of references
to some of the resources during this webcast,
and links to all of those resources
will be available in the Resources console
and for your reference.
So let's get started.
We will begin this webcast by talking
a little bit about the evolution of APIs
and how APIs have evolved from being agents of access
to powering digital transformation efforts
for several enterprises.
And we will learn what this means
for operations teams in terms of added pressure and some
of the challenges.
And we will be introducing you today
to Apigee's brand new feature called API security reporting.
We will learn about the key components of this feature,
and we will also do a deep dive demo into the functionality.
So Apigee has been traveling with several customers
along their digital journey, and all [INAUDIBLE] of time,
we have seen APIs evolving their role within our enterprise IT
systems.
If we take some of our customers, for example Equifax,
they have significantly accelerated the time
to market of the new products and services
by leveraging APIs and API programs.
Their partner onboarding time has significantly
reduced the defective use of API programs.
And several companies have built vast ecosystems
of developers and partners using the API programs.
Ticketmaster, for example, is today selling tickets not only
through their own portal, but also they
are leveraging their partners using API to sell their tickets
and improve the overall fan experience.
And digital companies, for example AccuWeather,
who has been a customer of Apigee
for a long period of time, has actually
opened up a new revenue stream using APIs.
Today they are exposing key weather data through APIs
to external developers, not only through a developer portal,
but also through third party marketplaces.
And they are also making those APIs available for businesses
to embed them into their business applications.
And all of this is happening through API programs,
and this has helped them unlock new revenue streams and open up
new markets.
So as APIs are powering innovation
across these segments, what does this mean for operations teams?
As you continue to follow your business critical applications
and services with APIs, there is an increasing pressure
on operations teams to stay on top of that,
especially from a security perspective.
So some of the challenges that they face today
are to gain complete visibility into the security attributes
of the APIs, to ensure that whatever developers
are building are compliant with the industry and organization's
compliance requirements.
They also want to make sure that whenever there is an incident,
they want to know about this incident,
even if it impacts their business.
And if at all there is an incident and that is impacting,
they want to be able to very quickly diagnose and identify
the root cause of the issue so that they
can take the most appropriate remedial actions
and resolve the issues faster and fast as possible.
On the other hand, what is also happening
is as you build and scale your API programs,
there is a goldmine of API data that
is being collected on the back end.
And API management platforms like Apigee
have a great opportunity to leverage
this data to actually help customers, one,
improve the availability and performance of the APIs,
and number two, to also ensure that the APIs are secure
and meet the compliance requirements.
So across the entire value chain,
all the way from your target back
end to front end consumers, there
is this large amount of metadata that Apigee is also
collecting at the back end.
So if you look at the Apigee API Management Platform today,
it is Google Cloud comprehensive full lifecycle management
platform, which includes a runtime layer, a mediation
engine, API analytics, and also provides you a developer portal
and monetization capability.
But the way we are leveraging the API data today
is by providing three different kind of metrics
for three different personas.
So for somebody like the product manager,
we provide developer engagement metrics,
and for a business persona, we are
looking at business metrics such as revenue
generation, et cetera.
And for an operations persona, today, we
have deeply integrated monitoring capabilities.
What we are introducing today is API Security Reporting,
which is a new added functionality which is also
leveraging the same API data.
What we have seen in most of our customers
is that, depending on the size of the customer-- depending
on the nature of their business--
they have either an ops person looking into the security
attributes, or there is a SecOps person dedicatedly looking
at the security attributes.
So this feature essentially targets both
the current IT admin or office persona and also
the SecOps persona.
So let's learn a little bit about this new feature
that we just added.
What is API Security Reporting?
It provides deep insights for operations teams
to basically do three very important things.
One is to ensure that all of the APIs
that are being developed by the development teams
are adhering to the security and compliance requirements.
Number two is to ensure that the sensitive data
within the organization is not abused
by internal or external users.
And number three is when there is an incident,
it provides you the capabilities to quickly
identify and diagnose the root cause
and quickly take remedial actions to solve it.
Let's get into each of these functionalities in detail.
Security compliance is essentially
a functionality that addresses the design time
governance of the product.
It is about ensuring that developers
who are the core power users of our platform
are building APIs that incorporate
all the policies required by the compliance teams.
In many cases, we have seen customers
who think that the APIs that are being built
are by default adhering to all the policies.
But only when something breaks, they actually
realize that that's not really happening on the field, right?
With this feature, users can quickly
identify proxies that do not adhere to traffic security
and extension policy requirements,
and users will also be able to very quickly review
what are the shared flow configurations
and revisions for each of those proxies.
And you can also analyze which hosts,
which virtual hosts and ports are
open to receiving secure traffic,
as compared to unsecure traffic.
As we discussed earlier, several enterprises
are today covering business critical applications
through APIs.
So there is a lot of sensitive data
that is actually involved in these APIs.
For example, developer information, trade sessions,
API keys--
all of these are attributes that are
vulnerable to abuse from internal and external users.
So with this new feature, users can very closely
monitor who within your organization
is actually accessing this sensitive information,
and if there are any anomalies in that access [INAUDIBLE]
you can discover or detect those suspicious behavior.
Apigee by default also provides ways for you
to extract information outside of the platform
through management APIs, and it becomes
extremely critical for your operations teams to make sure--
to monitor those users who are actually extracting
this data out of the platform.
So on top of all the logging capabilities
that Apigee offers today, data protection
is one additional feature that helps
you to look at all the user activity that
is happening inside your ops.
And the third capability that we've got
is precision diagnosis.
Precision diagnosis essentially address the runtime governance
with software security.
It gives you the insights into what percentage of traffic
is secure versus nonsecure, and when there is a security
incident, you can quickly analyze
which apps are causing those security incidents
and which back end targets are actually getting
affected because of that.
You can also identify anomalies in traffic patterns,
identify the root causes for those anomalies,
and basically take the most appropriate remedial actions
to solve this.
What is happening with this capability
is that a lot of operations teams
find it very useful in terms of overall
reducing their overall mean time to diagnose an issue, and also
the mean time to take remedial actions.
So with that, let's just take a quick break from the slides
and actually go into the product and take a quick demo.
So this is the Apigee API Console,
and if you go to the Analyze section on the left menu,
just below the API Monitoring, which we launched last year,
there is API Security Reporting.
This is the new feature.
Go to the Overview page.
So there is a functionality for users
to actually look at this from four different timelines.
You can look at the last one hour, the last one day,
seven days, and even 30 days.
So let's look at the last seven days' data.
So what you see at the first glance
is the northbound traffic.
This is the traffic that is coming into the Apigee API
platform, and you can see across different environments what
are the number of proxies that are deployed.
What you see here as active proxies
are the proxies that are actually receiving traffic.
And 16 is essentially the number of proxies
that have been deployed.
And against each of these environments,
you can see the amount of traffic that is coming in
and what is the percentage change.
So if you kind of predict that this kind of change
that you see in this environment,
there's something very alarming or it is uncommon,
then you can quickly look at the runtime reports
and see what's actually happening there.
We will see that just in about a minute.
We will also see the traffic for region.
This is especially useful for customers
who have proxies deployed across several regions,
and when there is traffic coming from various regions.
And when there is a security incident,
it will be very easy for the ops person
to look at the abnormalities in the specific region
and quickly drill down into that region
and see what exactly is happening on there.
And if you have logged into this platform
as an org admin, what you will also see is user activity.
And by the way this feature is available only
for the org admins.
You can quickly see who are the users that
are accessing the platform, and this is for the time window
that we've selected here, which is seven days.
You will see the number of UI things,
and you will see the number of API usage
and also see the change in the activity,
and what are the sensitive operations
that they are accessing.
Let's learn a little bit about user activity.
So again, I come to User Activity
and selecting the last seven days' data.
So what you see here is a list of all the users
that in this particular org which
is selected who have been accessing
the org for the last seven days.
And you can see here the number of logins, number
of UI operations, and APIs is essentially
the management APIs that have been accessed by users
over this period of time.
And when there is a change in activity,
you can see the normal hits here,
and this is where exactly you will
see the sensitive operations of the user.
So what are sensitive operations?
The way they have defined sensitive operations
is when a user is accessing information
that contains either developer information, app
information, virtual hosts, trace sessions, or custom
reports.
And let's say if there is one particular user who
has accessed a lot of sensitive data,
and if you feel that the user is not
supposed to be accessing that, you
can very quickly contact that user
and take the most appropriate action.
What we also have here is the Compliance page.
This is the design time governance aspect
that I was talking about earlier.
So here, the first thing that you can do
is look at the various environments
and select the right environment that you want to look in.
And then you will see the list of all the proxies,
as well as their relevant provision number against that.
And what you also see here is the number
of policies that have been configured
for each of these proxies.
These policies include traffic policy, security policy,
as well as the extension policy.
What you will also see is the number
of shared flows that are configured
for each of the proxies, and you will also
be able to see whether this particular proxy has been
receiving secure traffic HTTPS or if there's
unsecure traffic on non-HTTPS.
And let's click on one of these and see
what additional information you can see here.
So when you click on this, on the right hand panel,
you will also see the details of the policies that
have been configured against these policies.
On the Shared Flows, you will basically
see the list of all the shared flows that
have been configured, and when you select that shared flow,
you will also see the policies that
are configured against this particular shared flow.
And what we also have here is the Target view.
And Target view essentially will give you
information about that particular [AUDIO OUT]
has received secure traffic or if it's nonsecure traffic.
In several cases, we have also seen
that customers have realized that some of the targets
have been configured to receive non-HTTPS traffic,
and after using this feature enough,
they kind of very quickly were able to change
the configurations to ensure that it receives
only the secure traffic.
And the third component that I want to talk about is runtime.
This is the runtime governance aspect.
And just like compliance, you can also select the environment
that you want to look at.
You can change the timeline here.
And you can also select regions, if you have multi regions,
and look at the traffic that is flowing
into each of these proxies.
So what you see here is the traffic over the selected
period of time and the percentage change,
and what percentage is HTTPS versus non-HTTPS.
You will also be able to quickly see
what other aspects are accessing this proxy,
and if there is any of [INAUDIBLE]..
So let's take a situation and understand
this a little better.
If there is a high percentage change
in the traffic that is coming to a particular proxy,
and [INAUDIBLE] I add an ops person, I add a SecOps person.
I understand that this is something that is not supposed
to happen, and that that is coming mostly from a nonsecure
forward, then I will be very quickly
able to understand which app is causing the traffic.
And once I know that, I'll be able to take
the most remedial actions.
And to mitigate the damage that is happening,
I can also look at which target is actually being affected
because of the [INAUDIBLE].
So this kind of significantly reduces the overall time
to understand what is going wrong
with that particular proxy, and take the most remedial action.
So that is all about the new security
reporting feature that we launched.
If you have any further questions,
please feel free to reach out to us.
And if you are not an Apigee Edge customer,
please do download the free trial and start using this.
Thank you so much for joining us, and have a nice afternoon.
[MUSIC PLAYING]