Protect the API Keys to your Cloud Kingdom

API keys to become first class citizens of security policies, just like SSL keys

Much lip service is paid to protecting information in the Cloud, but the reality is often seat-of-the-pants Cloud security. Most organizations use some form of API keys to access their cloud services. Protection of these API keys is vital. This blog post will explore the issues at play when protecting API keys, and make some recommended solutions.

In 2011, the sensitivity of API Keys will start to be realized, and organizations will better understand the need to protect these keys at all costs. After all, API keys are directly linked to access to sensitive information in the cloud (like email, sales leads, or shared documents) and pay-as-you-use Cloud services. As such, if an organization condones the casual management of API keys they are at risk of: 1) unauthorized individuals using the keys to access confidential information and 2) the possibility of huge credit card bills for unapproved access to pay-as-you-use Cloud services.

In effect, easily accessed API keys means anyone can use them and run up huge bills on virtual machines. This is akin to having access to someone’s credit card and making unauthorized purchases.

APIs – Let’s take a look at APIs. As you know, many Cloud services are accessed using simple REST Web Services interfaces. These are commonly called APIs, since they are similar in concept to the more heavyweight C++ or Visual Basis APIs of old, though they are much easier to leverage from a Web page or from a mobile phone, hence their increasing ubiquity. In a nutshell, API Keys are used to access these Cloud services. As Darryl Plummer of Gartner noted in his blog, “The cloud has made the need for integrating between services (someone told me, “if you’re over 30 you call it an ‘API’, and if you are under 30 you call it a ‘service’”) more evident than ever. Companies want to connect from on-premises apps to cloud services and from cloud services to cloud services. And, all of these connections need to be secure and governed for performance.” Continue reading…

Related Posts

Google Books Decision: “The Privacy Concerns are Real” A federal district court in New York today issued a long-awaited ruling in the Google Books case, Authors Guild v. Google, rejecting the proposed sett...
Apps is the new Web: sowing the seeds for Web 3.0 Billions of downloads. That’s how the success of software platforms is measured today. And while downloads is not a currency (it does not necessarily ...
A general public license for seeds? “The same multinational corporations that are putting their proprietary, genetically modified plants into the environment and onto our tables are also...
webOS: The latest open source, Linux distribution Elation does not come close to describing what I am feeling right now. Euphoria does not even do it justice. Every cell in my being is in a state of e...
Wikileaks: Lessons For Consumer Privacy The website Wikileaks recently published hundreds of thousands of confidential State Department cables. These communications apparently reveal the de...
Tracking Protection Lists: A privacy enhancing technology that complements Do Not Track Yesterday, Microsoft released version 9 of Internet Explorer, which includes two significant new privacy features: Tracking Protection Lists (TPLs) an...

We Recommend These Vendors

Launch an SSD VPS in Europe, USA, Asia & Australia on Vultr's KVM-based Cloud platform starting at $5:00/month (15 GB SSD, 768 MB of RAM).

Deploy an SSD Cloud server in 55 seconds on DigitalOcean. Built for developers and starting at $5:00/month (20 GB SSD, 512 MB of RAM).


Leave a Comment

Your email address will not be published. Required fields are marked *

*