PaaS includes services such as Force.com for development and runtime of cloud-based applications. Regardless of how an application is developed, the runtime security is much the same once it is deployed in the cloud. So in terms of network, application and data security, PaaS is very similar to IaaS.
On the other hand, PaaS is unique in that integration of security, data, process or management functionality requires infrastructure services that connect PaaS applications to on-premise systems. For example, applications developed in the cloud should not have their own identity silos in the cloud. Instead, they should be able to access identity, policy and entitlement data from on-premise identity management systems. (In other words, developers need an account service in the PaaS that can provide identity data from the corporate directory.)
Leading PaaS providers offer a library of standard infrastructure services, but the back-end integrations that connect these services to on-premise systems remain the responsibility of the enterprise. To securely integrate on-premise infrastructure services with PaaS, you will need to:
- Create cloud-ready REST-style APIs out of existing SOAP-based web services (or JavaAPI, JMS, MQ, PL/SQL or other legacy interfaces). Use technology like an API gateway to create, manage, deliver and secure these APIs so they can be safely exposed to the PaaS.
- Deploy an API gateway as a broker at the edge of the PaaS cloud to mediate the security and protocol requirements from on-premise API sources.
Learn more here.
The connected car is now one of the hottest use cases for APIs. APIs are used in all aspects of connected cars. Security, version management, and developer and app registration is core.
If you are interested in how APIs are central to the rise of the connected car, I recommend checking out the talk by Sebastian Mennicke of iC Consult at Odette 2014 in Lyon, France on 19 and 20 May. iC Consult is an Axway partner which has been to the fore of deploying secure API projects worldwide.
Sebastian is speaking about the usage of the Axway API Gateway for secure APIs, using the example of the BMW i series project. The abstract is below:
The move to the connected vehicle is already in full swing with all major automotive OEMs offering systems that connect vehicles to the Internet. And the BMW i series is already on the road proving this evolution. The market opportunity has the potential to be huge: according to research firm SBD and the GSMA, the global connected car industry will be worth €39 billion in 2018, up from €13 billion in 2012.
In order for manufacturers to truly cash in, they need to consider the potential challenges that arise from this new era of vehicle mobility. Automakers need to look at the next generation security and integration technologies so they can control exactly who has access to the vehicle. The key to this is API Management.
APIs are what connect the apps in connected vehicles to the services which they depend on. Therefore, there is a need to manage and govern the APIs that enable collaboration between a vehicle and an app, such as the registration of developers and apps, API key distribution and revocation, and API version management.
Sebastian Mennicke, Senior Consultant at leading Identity & Access Management Consultancy iC Consult, shows how the Axway API Gateway can help to integrate mobile apps with backend APIs by the example of the BMW i series project.
- Real world best practice use cases for integrating mobile apps on the car with enterprise data systems
- How an efficient API management strategy is fundamental to securing flow of data across a network of connected cars
- How to control the access to and from your car in the emerging Internet of Things
(Originally posted in slightly different form at soatothecloud.com.)