Commentary

Protect the API Keys to your Cloud Kingdom

API keys to become first class citizens of security policies, just like SSL keys

Much lip service is paid to protecting information in the Cloud, but the reality is often seat-of-the-pants Cloud security. Most organizations use some form of API keys to access their cloud services. Protection of these API keys is vital. This blog post will explore the issues at play when protecting API keys, and make some recommended solutions.

In 2011, the sensitivity of API Keys will start to be realized, and organizations will better understand the need to protect these keys at all costs. After all, API keys are directly linked to access to sensitive information in the cloud (like email, sales leads, or shared documents) and pay-as-you-use Cloud services. As such, if an organization condones the casual management of API keys they are at risk of: 1) unauthorized individuals using the keys to access confidential information and 2) the possibility of huge credit card bills for unapproved access to pay-as-you-use Cloud services.

In effect, easily accessed API keys means anyone can use them and run up huge bills on virtual machines. This is akin to having access to someone’s credit card and making unauthorized purchases.

APIs – Let’s take a look at APIs. As you know, many Cloud services are accessed using simple REST Web Services interfaces. These are commonly called APIs, since they are similar in concept to the more heavyweight C++ or Visual Basis APIs of old, though they are much easier to leverage from a Web page or from a mobile phone, hence their increasing ubiquity. In a nutshell, API Keys are used to access these Cloud services. As Darryl Plummer of Gartner noted in his blog, “The cloud has made the need for integrating between services (someone told me, “if you’re over 30 you call it an ‘API’, and if you are under 30 you call it a ‘service’”) more evident than ever. Companies want to connect from on-premises apps to cloud services and from cloud services to cloud services. And, all of these connections need to be secure and governed for performance.” Continue reading…

Related Posts

Apps is the new Web: sowing the seeds for Web 3.0 Billions of downloads. That’s how the success of software platforms is measured today. And while downloads is not a currency (it does not necessarily ...
Is Microsoft buying Nokia? An analysis of the acquisition endgame The Elop and Ballmer duo on stage on February 11th was the main topic of discussion at this year’s Mobile World Congress. The reverberations of the Mi...
Tracking Protection Lists: A privacy enhancing technology that complements Do Not Track Yesterday, Microsoft released version 9 of Internet Explorer, which includes two significant new privacy features: Tracking Protection Lists (TPLs) an...
EFF’s Guide to Protecting Electronic Devices and Data at the U.S. Border Amid recent reports that security researchers have experienced difficulties at the United States border after traveling abroad, we realized that it's ...
MasterCard’s Support for COICA Threatens A Free And Open Internet In the last months of 2010, the WikiLeaks wars reminded transparency activists of something copyright and trademark lawyers know all too well – online...
Open source software fundamental to success in the mobile and consumer electronics markets By Ari Rauch, Linaro board member: Today more than ever before, our industry views open source software (OSS) as fundamental to success in the mobile ...

We Recommend These Vendors and Free Offers

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).

Want to become an expert ethical hacker and penetration tester? Request your free video training course of Online Penetration Testing and Ethical Hacking

Whether you're new to Linux or are a Linux guru, you can learn a lot more about the Linux kernel by requesting your free ebook of Linux Kernel In A Nutshell.


Leave a Comment

Your email address will not be published. Required fields are marked *

*