Skip to main content

SAML SLAM.

While undergoing few interviews in the past few months I realised why we get so many breaches and issues in the industry. With so many qualified security professionals the obvious question to ask is:
"How is it possible with so many CISSP's, CISM's, CISA's etc. that almost every week we hear about new breach, new security issue and so on?"
Not trying to diminish the value of the certifications just pointing out on something that no certification will teach - imagination and thinking outside of the box.
During the interview with one well-known company SVP of security have asked me:
"So when would you use SAML instead of Oauth?"
I answered to the best of my ability and in the end pointed out that SAML is somewhat heavier with all SOAP message exchanges etc. and somewhat old protocol.
The question itself didn't make sense as SAML is used with Oauth in some cases :)
They can complement each other.
Then I asked question of my own:
"Is there an API Gateway in your architectural landscape?"
He laughed and said that there is no need as they don't expose their web services.
I froze a bit and from this point on tried to understand how I would fit into that organisation.
Do I have to drive to him that SAML is an exchange of XML messages just like web services are.
SOAP over HTTP :)
API Gateway or XML firewall as it is sometimes called absolute requirement to protect against fragmented XML messages and other nasty attacks.
Will that particular SVP know how to protect his company infrastructure?
I guess he will be SLAMed by SAML :)

Comments

Post a Comment

Popular posts from this blog

Artificial I

Yes not misspelled and my title is right: Artificial I . Lets us zoom for a second on 'why' and 'what' and then we can have a look at 'when'. Why ? Look at yourself in the mirror for 1 min. until you have your image in your memory. (Warning: to some the experience may be to much to take. I am not joking or alluding to anything here. Simply stating the fact that this process is deeply personal and may evoke number of complex emotions. Some of them may be not as pleasant as you would expect it.) Then sit yourself somewhere comfortably and close your eyes. Concentrate and try to bring your image back. You may succeed or you may not. It all depends on your brain ability to recall the images quickly and reliably over time as well as strange desire and ability to forget certain images. Now you probably slowly starting to realize by yourself is 'why' :) We need some sort of third party involvement here to help us along way as we have our limitations
Post a Comment
Read more

White Hat

Was talking to my friend 'White Hat' He is still hopefull and optimistic. Alone as everyone left to the BlackHat he still picking at his bugs and whatever he can find there. Will he be able to deliver on the promise and save us from Darth forces? I hope he will.
Post a Comment
Read more

Linus hasn’t received any recommendations yet.

I find it extremely interesting that Linus Torvalds Linkedin profile doesn't have any 'Recommendations: Received (0) Given (1) Linus hasn’t received any recommendations yet.' You may say he doesn't need it. Everyone knows he invented Linux. Well almost everyone :) But it also shows and reflects the world we are living. You barely hear his name and he is not in the news. I know people with 10, 100 recommendations. It is all about building and maintaing your connections. So the old saying goes: "Its not what you know, its who you know" It works amazingly well even nowadays in the age of knowledge. I think of the Linus legacy and I think of: Security and stability Extensibility and simplicity I think of Bill Gates legacy and I think of: Unsecure and untrustworthy Proprietory and complex One is humble and down to earth creator The other is shrewd and cunning businessman One is doing OK The other is billionaire You can now run Linux on Windo
Post a Comment
Read more