Lately I've been working on designing authentication (authN) and authorization (authZ) services for an API Gateway layer sitting on top of a collection supposedly RESTful APIs written by a diverse and disconnected population of developers. One of the many challenges I've faced is that it turns out that "REST" means different things to different people. I've been looking for a simple way to explain to developers what a high quality RESTful API looks and functions like. While I have found some good material, I felt I needed pull together a few different concepts, so I wrote this. Why is being fully RESTful important? Turns out that poorly designed and implemented, RESTful APIs are harder to design authentication and authorization services. First I want to discuss RESTful APIs in general, so we can agree on what they are and are not. Then I will explain why weakly RESTful APIs are harder to implement authN/Z. Reading the documentation for supposedly "RE...
The data is beginning to paint an interesting picture about the relationship between security and developer happiness. The 2020 DevSecOps survey from Sonatype indicates that happy developers are 3.6 times less likely to neglect security in their code. And 2.3 times more likely to set up automated security tools, and 1.3 times more likely to follow open source security policies. In addition, developers working within a mature DevOps practice are 1.5 times more likely to enjoy their work, and 1.6 times more likely to recommend their employer to their peers. These last conclusions about the relationship between DevOps maturity and developer happiness are also supported in multiple versions of the DORA State of DevOps survey data. Businesses actually want five things from developers, but usually only ask for one and assume the other four take care of themselves. What they want, and ask for the most are new features. The next ask is improvements in new feature velocity. Rarely do they...
There are many types of security breaches. Some attackers want your data. Some want your money. Some want your intellectual property. Others want chaos. Not matter what they want, a breach is going to cost you money. But how much money? IBM has a Cost of Data Breach Calculator . Data records are stolen at a rate of 58/sec. And with an annual average cost of $3.6M per breach that works out to $141 per record. But what about other costs? Yahoo lost $350M in their deal with Verizon because of a data breach. In recent years, three high profile companies were put out of business from security breaches: Code Spaces Nirvanix MyBizHomepage And 60% of small businesses fail within 6 months of a security breach. The cost to recover are high and the damage to reputation can be too. How common are security breaches? Last year 43% of companies had a data breach. While security breaches may be costly, so is preventing them. Worldwide spending on information security product...
Comments
Post a Comment