Showing posts from December, 2017

Authorization for a Multi-Cloud System

This is a project design I am currently working on to consume SPIFFE(Secure Production Identity Framework For Everyone) bootstrapped trust and identification to provide authorization in a dynamically scaling, heterogeneous system, inspired by Mr. Prabath Siriwardena from WSO2 and under the supervision of Prof. Gihan Dias from University of Moratuwa. An enterprise system running across multiple clouds, as in the hybrid cloud, is an obvious example that will be benefitted from this. The objective is to open doors for the SPIFFE standard based systems to co-exist with rest of the systems with minimal effort, without compromising on security aspects while having an authorization solution based on SPIFFE.
What is SPIFFE? In brief, it is a trust bootstrapping and identification framework, submitted as a standard and accepted by CNCF(Cloud Native Computing Foundation)[1]. As of now, this standard has two main implementations as SPIRE and Istio[2], a platform that supports service mesh archit…

Identity Mediation for PSD2

Partners, mergers, legal entities, government entities, customers all need to work together in this era, while honoring the boundaries they should work within. This is with link to my previous post on challenges of future IAM requirements arising with increased interchangeability requirements between diversified parties.
Challenges of Future IAM (concerned with Mergers , Acquisitions, Startups) - of Identity and Access Management (IAM)- This need is much more emphasized with the new regulations such as PSD2 in EU region that is putting foundation for Open Banking. While these standards define guidance for implementation interfaces,  End user authentication and authorizationThird party authentication and authorizationIdentity mgt of internal staff,  has hidden needs of identity mediation. Federated authentication i…

Building a Fool Proof Security Strategy for PSD2 Compliance

Following are the slides I used in a webinar by WSO2 to look at the IAM and overall security aspects of a fully PSD2 Complaint Solution. While it lists down the basic requirements to be PSD2 complaint, it also explains the requirements that are not visible out in the surface, but very valuable in building a comprehensive and robust solution that will have a long term vision while being PSD2 complaint as per the urgent need.

Building a Fool Proof Security Strategy for PSD2 Compliance from WSO2 Inc.

The webinar recording is available at