Skip to main content

SAML SLAM.

While undergoing few interviews in the past few months I realised why we get so many breaches and issues in the industry. With so many qualified security professionals the obvious question to ask is:
"How is it possible with so many CISSP's, CISM's, CISA's etc. that almost every week we hear about new breach, new security issue and so on?"
Not trying to diminish the value of the certifications just pointing out on something that no certification will teach - imagination and thinking outside of the box.
During the interview with one well-known company SVP of security have asked me:
"So when would you use SAML instead of Oauth?"
I answered to the best of my ability and in the end pointed out that SAML is somewhat heavier with all SOAP message exchanges etc. and somewhat old protocol.
The question itself didn't make sense as SAML is used with Oauth in some cases :)
They can complement each other.
Then I asked question of my own:
"Is there an API Gateway in your architectural landscape?"
He laughed and said that there is no need as they don't expose their web services.
I froze a bit and from this point on tried to understand how I would fit into that organisation.
Do I have to drive to him that SAML is an exchange of XML messages just like web services are.
SOAP over HTTP :)
API Gateway or XML firewall as it is sometimes called absolute requirement to protect against fragmented XML messages and other nasty attacks.
Will that particular SVP know how to protect his company infrastructure?
I guess he will be SLAMed by SAML :)

Comments

Post a Comment

Popular posts from this blog

Fight for the Light within

Finally I understand. Or it seems that I do. There is no Attainment. My whole approach to life around me was and is wrong. The energies around me is not be controlled, they are to be adapted to and allowed to freely pass without interferring. John Lennon sang about it in his 'Fool on the Hill'. But his main theme was somewhat passive and reflective - 'See the world going round'. The true mastery is when you are riding the never ending 'merry-go-round' of life energies like a surfer - using high waves to propel you forward to the shore of your goals and destiny.  Inevitably will be the times when I will fall and will have to climb back on my board and attempt to catch the next wave.  Will be the times when I will be scared by the magnitude of the wave coming towards me and possibly the sharks swimming nearby.  I will see other people drowning and not reaching the shore and shouting to me: 'Its hopeless we will all drown'. Will be times...
Post a Comment
Read more

Bees and Honey

"Another challenge is that identity data is typically decentralized . The Department of Motor Vehicles issues drivers licenses, for example, while the Department of Homeland Security issues passports, banks track financial histories, and so on. Most of these organizations have isolated and centralized identity management systems, but the current landscape demands federation and single sign-on (SSO). This makes identity management, protection and verification very cumbersome, costly and risky for all industry enterprises and government agencies." Jai Singh Arun - Security and Blockchain Innovations Program Director, IBM Identity architectural landscape is changing and personally I can only think of this very simple analogy between identities and blockchain. Identities to the blockchain are what the bees are to the honey. . This is as simple as even your grandma would understand :) Bees (identities) all day collect honey somewhere in the fields. Coming back to thei...
Post a Comment
Read more

Future of IDAM

"Many of the technical choices we’re about to make will be strikingly political.   Who has access to what data?  Where is the line between human choice and machine intelligence? Why is one computer architecture better than another? These decisions—and the people who make them —will determine power’s new aspects ." "The Seventh Sense: Power, Fortune, and Survival in the Age of Networks" I was mesmerised when I read this. Started to frantically search the author name - Joshua Cooper Ramo.  No he is not an IDAM Architect. The book is not even about IDAM.  But it cuts to the core of what I do for my living and many many others as well. What a powerful thought:   Identity will be at the heart of power structures of the future. Hold it for a moment .    What about me? What about my identity? Those are all valid questions to ask in this context. Unwind to Sep 19 2016 when my friend Steve jokingly asked me: "where is your blog? where is your ...
Read more