Case Study: Aaramshop—Top Five Lessons Learned About Accelerating E-Commerce With Data and APIs

World®’16

CaseStudy:Aaramshop—TopFiveLessonsLearnedAboutAcceleratingE-CommerceWithDataandAPIsJin Zhang- Founder- Forty2.ioScottMorrison- DistinguishedEngineer- CATechnologies

DO3X15S

DEVOPS

Thecontentprovidedinthis CAWorld2016presentationisintendedforinformationalpurposesonlyanddoesnotformanytypeofwarranty. The informationprovidedbyaCApartnerand/orCAcustomerhasnotbeenreviewedforaccuracybyCA.

ForInformationalPurposesOnlyTermsofthisPresentation

Abstract

Aaramshop isanonlinestorethatpromoteslocalandorganicsupplies.Intheone-yearjourneysinceCAWorld2015,Forty2.io,aCAAccelerator,hasworkedcloselywithAaramshop toidentifybusinessgrowthopportunities.Thetwoalsocollaboratedtoalertwebapplicationbottlenecksandtoprotectwebresources,includingAPIs.Allofthesearefueledbydata-drivenpredictionandprescription,includingpatternrecognition,anomalydetection,automaticshieldagainstAPIhijacking,scalingandabuse.Inthissession,wesharelessonslearnedabouthowyourbusinesscantrulybenefitfromdataandAPIs.

ScottMorrisonCATechnologiesDistinguishedEngineer

JinZhangForty2.ioFounder

Agenda

AARAMSHOPANDFORTY2.IO

5LESSONSLEARNED

WHATWEAREEXPLORINGNEXT

AboutCAAccelerator

“Enterprisestartups”

CA’sinnovationengine

Visitca.com/accelerator

FocusonOrganicProductInnovation

§ Listentocustomers

§ USEastandWestincubation

§ Failfast– andsafe

§ Freshblood

§ Reviewprocess,justlikeventurecapitalistsJ

§ Forty2.ioisoneoftheincubationprojects

DigitalTransformation

Creatingsomethingnew—newmarkets,newproductsandnewareasofgrowthandrevenues.

=OpportunitiesforCompaniesThatEmbraceIt

Companieswhoarenotembracing thischangearequicklybecomingirrelevantandwilllikelynolongerplayasignificantroleinthenext5–10years.

Protectionofrevenue,brandanddata

MaximizationofITutilization:costsavings,abilitytoservemoretocustomers

Increaseofproductivity:abilitytoidentifyrisksandtheftsquicker

ASolution:forty2.io

forty2.io isananalyticsdrivenappwhichprotectsdigitalbusinesseswithoneclickresolution:

Aaramshop

§ AimingtobetheUberforgrocers

§ Aplatformconnectinglocalgrocersandconsumers

§ Fresh,easy,local,relationship-based

§ MobileappcampaignfollowingDiwaliseason

OurLearningandDiscovery

GrowthOpportunity CustomerExperience GTMChannel

ThreeInitialDiscoveries– GrowthOpportunity

ThreeInitialDiscoveries– CustomerExperience

ThreeInitialDiscoveries– GTMChannel

WhatWeAreExploringNext

§ Singlepaneofglass

§ Moregrowthopportunity

§ APIProtection– APIHijacking– ScriptInsertion– SQLInjection

APIsAreBasedontheArchitectureoftheWebSocanwejustre-useourwebsecuritystrategies?

Weneedtobewaryofbadwebdevelopmentpracticesmigratingto

APIs…

APIDevelopment!=WebDevelopment

TraditionalWebAppsConstrainInteraction

HTTPServer

UsersBrowser App

ServerDatabase

Pages Objects RecordsRenderedView

ConstraintSpace

Firewall1 Firewall2

APIsinContrastOfferaMoreDirectConduittoData

HTTPServer

AttackerBrowser App

ServerDatabase

Objects RecordsRenderedWebView

Often:• Self-documenting• Closelymappedtoobject

space,datastructure,etcAPIscanleakinformation

APIsIncreaseAttackSurfaceHTTPServer

AttackerBrowser

AppServer Database

UsersBrowser

TraditionalWeb

GranularityBoundary

InsertionAttacksAreACommonAttackVector

Source:https://xkcd.com/327/

ExploitsofaMom

Insertionattacksarereallyaboutusingleveragingunconstrainedparameterstoexploitremoteprocessing

engines(bothserverorotherclients)

SoAreMan-In-The-MiddleAttacks

HTTPServer

UsersApp App

ServerDatabase

Breechesin:• Integrity• Confidentiality

TheBestPracticeIsToUseAPIGatewaysForSecurity

APIGateway

UsersApps

TakesCareof:• Authentication• Authorization• Integrity• Confidentiality• Audit

• KeyManagement• IAMintegration• Parameterhygiene• Filtering• etc…

Case Study: Aaramshop—Top Five Lessons Learned About Accelerating E-Commerce With Data and APIs

Technology

Transcript of Case Study: Aaramshop—Top Five Lessons Learned About Accelerating E-Commerce With Data and APIs

Managing APIs and microservices - axway.com · axway.com 2 Understanding the business climate for APIs and microservices Businesses face an accelerating pace of change and technological

APIs Are Forever - How to Design Long-Lasting APIs

Brochure: Drug Development - Accelerating time to market · Active Pharmaceutical Ingredients (APIs), to the delivery and application characteristics of creams and ointments for product

Championing Nanotech Innovation: Lessons Learned Presented by Christine Peterson Vice President, Foresight Institute Accelerating Change 2004 November.

Managing private, partner & public APIs (Nordic APIS April 2014)

The Forrester Wave™: Global API Strategy And Delivery ... · APi project can deliver value, true success with APis is a portfolio-level phenomenon, with value accelerating over

APIS DHS NCTC APIS Memorandum of Agreement (Redacted)

Growth Hacking APIs (Nordic APIs conference 2014)

Accelerating Smart City Transformation · implementation and integration with existing systems. Integrate key city data into the data model using REST APIs to speed integration, including

Successes, Challenges and Lessons Learned in Accelerating ... · international stakeholders including the Inter Agency Coordinating Committee (ICC), GAVI Alli-ance, WHO, University

RESTFul APIs

Accelerating and Protecting APIs | Akamai · ACCELERATING AND PROTECTING APIs WITH AKAMAI ... For a deep dive into accelerating and securing your APIs, check out this …

Webhooks do's and dont's: what we learned after integrating +100 APIs

Introduction to GraphQL (or How I Learned to Stop Worrying about REST APIs)

Google APIs

Mediating Mature Services, ESBs and APIs: Lessons Learned from Five Years of API Management Implementation Success at Unum

Accelerating Teacher Effectiveness: Lessons Learned from ......Accelerating Teacher Effectiveness: Lessons Learned from Two Decades of New Teacher Induction 14 Kappan Octollcr 2009

APIs in the Enterprise - Lessons Learned

New Accelerating and Protecting APIs | Akamai · 2019. 9. 5. · Akamai’s massively distributed platform is unparalleled in scale with over 200,000 servers across 130 countries,

What I learned about APIs in my first year at Google