case study: aaramshop—top five lessons learned about accelerating e-commerce with data and apis

World®’16

CaseStudy:Aaramshop—TopFiveLessonsLearnedAboutAcceleratingE-CommerceWithDataandAPIsJin Zhang- Founder- Forty2.ioScottMorrison- DistinguishedEngineer- CATechnologies

DO3X15S

DEVOPS

2 ©2016CA.ALLRIGHTSRESERVED.@CAWORLD#CAWORLD

©2016CA.Allrightsreserved.Alltrademarksreferencedhereinbelongtotheirrespectivecompanies.

Thecontentprovidedinthis CAWorld2016presentationisintendedforinformationalpurposesonlyanddoesnotformanytypeofwarranty. The informationprovidedbyaCApartnerand/orCAcustomerhasnotbeenreviewedforaccuracybyCA.

ForInformationalPurposesOnlyTermsofthisPresentation


Abstract

Aaramshop isanonlinestorethatpromoteslocalandorganicsupplies.Intheone-yearjourneysinceCAWorld2015,Forty2.io,aCAAccelerator,hasworkedcloselywithAaramshop toidentifybusinessgrowthopportunities.Thetwoalsocollaboratedtoalertwebapplicationbottlenecksandtoprotectwebresources,includingAPIs.Allofthesearefueledbydata-drivenpredictionandprescription,includingpatternrecognition,anomalydetection,automaticshieldagainstAPIhijacking,scalingandabuse.Inthissession,wesharelessonslearnedabouthowyourbusinesscantrulybenefitfromdataandAPIs.

ScottMorrisonCATechnologiesDistinguishedEngineer

JinZhangForty2.ioFounder


Agenda

AARAMSHOPANDFORTY2.IO

5LESSONSLEARNED

WHATWEAREEXPLORINGNEXT

1

2

3


AboutCAAccelerator

“Enterprisestartups”

CA’sinnovationengine

Visitca.com/accelerator


FocusonOrganicProductInnovation

§ Listentocustomers

§ USEastandWestincubation

§ Failfast– andsafe

§ Freshblood

§ Reviewprocess,justlikeventurecapitalistsJ

§ Forty2.ioisoneoftheincubationprojects


DigitalTransformation

Creatingsomethingnew—newmarkets,newproductsandnewareasofgrowthandrevenues.

=OpportunitiesforCompaniesThatEmbraceIt

Companieswhoarenotembracing thischangearequicklybecomingirrelevantandwilllikelynolongerplayasignificantroleinthenext5–10years.


Protectionofrevenue,brandanddata

MaximizationofITutilization:costsavings,abilitytoservemoretocustomers

Increaseofproductivity:abilitytoidentifyrisksandtheftsquicker

ASolution:forty2.io

forty2.io isananalyticsdrivenappwhichprotectsdigitalbusinesseswithoneclickresolution:


Aaramshop

§ AimingtobetheUberforgrocers

§ Aplatformconnectinglocalgrocersandconsumers

§ Fresh,easy,local,relationship-based

§ MobileappcampaignfollowingDiwaliseason


OurLearningandDiscovery

GrowthOpportunity CustomerExperience GTMChannel


ThreeInitialDiscoveries– GrowthOpportunity


ThreeInitialDiscoveries– CustomerExperience


ThreeInitialDiscoveries– GTMChannel


WhatWeAreExploringNext

§ Singlepaneofglass

§ Moregrowthopportunity

§ APIProtection– APIHijacking– ScriptInsertion– SQLInjection


APIsAreBasedontheArchitectureoftheWebSocanwejustre-useourwebsecuritystrategies?

Weneedtobewaryofbadwebdevelopmentpracticesmigratingto

APIs…

APIDevelopment!=WebDevelopment


TraditionalWebAppsConstrainInteraction

HTTPServer

UsersBrowser App

ServerDatabase

Pages Objects RecordsRenderedView

ConstraintSpace

Firewall1 Firewall2


APIsinContrastOfferaMoreDirectConduittoData

HTTPServer

AttackerBrowser App

ServerDatabase

Objects RecordsRenderedWebView

Often:• Self-documenting• Closelymappedtoobject

space,datastructure,etcAPIscanleakinformation


APIsIncreaseAttackSurfaceHTTPServer

AttackerBrowser

AppServer Database

UsersBrowser

TraditionalWeb

APIs

GranularityBoundary

GranularityBoundary


InsertionAttacksAreACommonAttackVector

Source:https://xkcd.com/327/

ExploitsofaMom

Insertionattacksarereallyaboutusingleveragingunconstrainedparameterstoexploitremoteprocessing

engines(bothserverorotherclients)


SoAreMan-In-The-MiddleAttacks

HTTPServer

UsersApp App

ServerDatabase

Breechesin:• Integrity• Confidentiality


TheBestPracticeIsToUseAPIGatewaysForSecurity

APIGateway

UsersApps

TakesCareof:• Authentication• Authorization• Integrity• Confidentiality• Audit

• KeyManagement• IAMintegration• Parameterhygiene• Filtering• etc…

Directory


APIMBringsAboutaPositive ShiftinResponsibility

Developers SecurityPros


Summary

CAAcceleratorsLeanStartup

AaramshopLearning

APIProtectionMitigationtipsSolverealproblem,fast


RecommendedSessions

SESSION# TITLE DATE/TIME

SCX71STheanswerisForty2- HowAnalytics-backedBotMitigationHelpedInsillicum

11/16/2016at03:00pm

DO3T05S

CaseStudy:LG&E/KU—HowMobileApps,APIsWithMicroservices andCAAPIManagementareHelpingtoShapetheCompany’sFuture

11/16/2016at03:45pm

IET02TLeveragingMachineLearningtoProtectwebAppsfromCyber-attacks

11/17/2016at03:00pm


MustSeeDemos

APIInsightsCAAPIManagementDevOps– APIManagement

ProtectAPIs IntegrateIoTCAAPIManagementDevOps– APIManagement

LaunchFasterCAAPIManagementDevOps– APIManagement


Questions?


Thankyou.

Stayconnectedatcommunities.ca.com


DevOps– APIManagementandApplicationDevelopment

FormoreinformationonDevOps– APIManagementandApplicationDevelopment,pleasevisit:http://cainc.to/DL8ozQ

case study: aaramshop—top five lessons learned about accelerating e-commerce with data and apis

Technology