Lightbend thinks it can change that standard. The company says its Akka service delivers a model that allows software application development professionals to build a single cloud-native application for both cloud and edge environments.

Lightbend programming model is cloud-to-edge

This isn’t just another computer-aided design (CAD) program - it's one of the best architecture software tools you can get. Using AutoCAD, architecture professionals can expect greater efficiencies.

The best architecture software in 2023: Top software for architects and designers

computer security, software security and more. This cohort-based program trains computational specialists who can construct models, develop algorithms, and write software using state-of-the-art graduate-level knowledge and techniques. The program has been ...

Master's in Professional Computer Science

Despite economic fears, Gartner predicts spending on software will increase 11% in 2023, up to $879 billion from $790 billion in 2022. Why? The answer is simple. No business can survive in today ...

Four Crucial Steps For Successful Software Implementation

If you’re on a computer and you get a text on your phone, wouldn’t it be great if you could reply without picking it up? Yes, it would, and there are great apps and services that enable just ...

How to send a text message from a computer

TRIPS is an important treaty under the WTO. The TRIPS Agreement represented a major expansion in the scope of copyright protection for computer software. TRIPS brought software under the purview of the Berne Convention by defining it as a literary work.

Preserving national integrity: Shunning software piracy

Even without a sale, a savvy shopper can find a decent Windows-based laptop computer for less than $1,500 or a basic MacBook starting at around $1,000. But when these portable computers go on sale ...

How to save big on a laptop computer during Amazon's October Prime Day 2023

(Reuters) - AMD said on Tuesday it plans to buy an artificial intelligence startup called Nod.ai as part of an effort to bolster its software capabilities. In its race to catch rival chipmaker Nvidia, Advanced Micro Devices plans to invest heavily in the ...

AMD to acquire AI software startup in effort to catch Nvidia

When the Agile Manifesto came out in 2001, it stated that one of the 12 principles of agile software is that “the best architectures, requirements and designs emerge from self-organizing teams.”

Does Software Architecture Still Matter?

Get the most recent info and news about ProgrammableWeb on HackerNoon, where 10k+ technologists publish stories for 4M+ monthly readers.

The leading source of news & information about APIs, chronicling the evolution of the global API economy & providing the web’s most relied-on API Directory

ProgrammableWeb

98 Stories To Learn About Best Practices

184 Stories To Learn About Rest Api

While Web3 is screaming decentralization, the likes of Facebook, Amazon, and Google are hoping it's just a false alarm. As the internet moves closer to the era of decentralization with Web3, it's important to understand clearly how data control will be affected and the likely turn data engineering will take. The internet has welcomed many stages of evolution since its inception with the internet moving from being merely a news board to a place for interaction through the medium of social media. As human experiences are being gradually improved upon, there are concerns about how much data one can control in the bid to enjoy personalized services. What will be the fate of the numerous tech giants that depend on vast quantities of user data to offer personalized user experiences, which is undoubtedly a guaranteed strategy for success? This is the best time to quote Aaron Swartz briskly: Information is power, but like power, there are those who want to keep it to themselves. Web 3 appears to offer a safer online environment with improved data privacy and security. Although adoption is still in its early stages, it is crucial to prepare for what to anticipate in the wake of the next wave of the 21st-century internet. This is a tale of the data control dilemma with the encroachment of decentralization and loudly preached transparency. Let the tales begin! We will start with the basics. ? What Is Web3 Web3 is the next stage of the internet evolution. Powered by technologies like the blockchain, decentralized protocols, and cryptographic systems which store data using to ensure the data is secure, Web3 moves from the era of a centralized web as seen in Web2 to that of a decentralized web. cryptographic algorithms Still in doubt? Listen to Aya Miyaguchi, the Executive Director of Ethereum. Web 3 is about creating a more decentralized and open internet where and interactions, without relying on centralized intermediaries for access and validation. users have control over their data ? What Are Cryptographic Algorithms Imagine you have a secret message to send to your friend. You want to send it through the internet, but you're not sure of the safety of that message. You don't want anyone else to know what it entails, so you decide to use a special code that just you and your friend can comprehend to write the message. Based on the level of your friendship, you may decide to twist some words to mean something else that can only be decoded between you and your friend. That's where cryptography comes in. Adding an algorithm would be including a special set of rules to your codified message to enable your friend to understand it. Now, let's get a definition. Cryptographic algorithms are rules that turn secret messages into secret codes that only the parties involved in the interaction can understand. and cryptographic algorithms used to store data on the blockchain ensure the security and confidentiality of personal information. Privacy is a fundamental pillar of Web 3, By prioritizing privacy and security, Web 3 empowers individuals to take control of their data and protects them from the invasive practices of centralized entities. What Is a Decentralized Web? This term describes an internet environment that doesn't rely on a single entity like Google, Facebook, or Yahoo for control. Instead, it uses blockchain technology to enable direct interaction between users- all the computers and devices are equal and can communicate seamlessly. peer-to-peer In the Web 3 world, we don't need middlemen to trust each other. We can trust the system itself. - Joseph Lubin, Co-founder of Ethereum & CEO of ConsenSys Imagine walking into a room and interacting with everyone without hassle, that's what - feels like! peer to-peer Web3 Is Coming… Thanks to the early adopters of Web3, there are gradually more promising Web3 alternatives for day-to-day tasks that pledge to provide better experiences in terms of data security and speed such as: Brave for browsing Metamask to send money Opensea for buying and selling Mastodon to have more control over your data while still enjoying the benefits of social media. Filecoin to store and manage data rather than uploading to your Google Drive Data storage already has Web3 alternatives. Yeah! An anonymous person source says, " " Rightly so! Whoever controls the data, controls the truth. Web3 is giving more control to individuals so can have a stake in decision-making, and that's how life should be! Data is a valuable asset at times termed as especially in this present era where data is used to improve user experience and help businesses make decisions that lead to growth. you gold, The principles of centralized data management nullify the need for democracy and transparency when dealing with data in the Web2 space. Centralization is not bad We have all benefited from personalized services like having Amazon suggest what you might like based on the last thing you searched for or even bought. Web3 is a new layer of the internet that largely leans on the efforts of centralization to make data more accessible and secure. Decentralization doesn't always mean private Like many newbies in this ecosystem, it's easy to take on the thought that decentralization guarantees privacy. No, it doesn't. " ." Many decentralized applications (dApps) and smart contracts built on decentralized networks like Ethereum collect and store data in transparent, publicly accessible databases Too Many Broken Trusts Many times we have been forced to trust like Facebook with our data, and oftentimes they keep breaking it. tech lords Take the in March 2018 where millions of Facebook users had their data collected without their consent for political advertising reasons. Facebook Cambridge Analytica scandal It was quite easy for Cambridge Analytica, a British political consulting firm, to obtain tons of people’s data through a third-party app - . Your Digital Life The app helped the firm obtain personal details of individuals who signed up as well as details of their friends on Facebook all without their consent. After that incident, which had over 87 million users' data , it became more glaring to the public that Facebook owns and controls the data of everyone on its platform. Till now, users have little visibility on how accessible their personal data is. hijacked Web3 exists to prevent such scandals by giving you the power to control your data. It also promises you that your data is safe by eliminating third-party centralized networks for data storage which are vulnerable to attacks. Talking about centralized networks/servers, I think this is the best time to bring in the discussion on the synergy between big data, data engineering, and centralized servers. Data Engineering & How It Plays Out in Web2 Data engineering refers to the process involved in building an infrastructure with tools such as , , and to collect and transform big data for the benefit of business use which will result in growth. Apache Spark Hadoop Cassandra Big data, on the other hand, refers to large amounts of data- structured, unstructured, and in some cases, semi-structured, generated daily through the internet by individuals and businesses. The importance of data engineering cannot be overlooked- tons of data (big data) are constantly collected, harnessed, and processed through pipelines to provide valuable business insights and decisions. Now, a major limitation of this is that data engineering relies on centralized systems for data storage hence, is prone to a single point of failure - centralized networks have data processed and stored by a single node; in a case where the primary server crashes, there would be a general downtime which could lead to data loss. Also, individuals/businesses have little or no control over their data, and virtually every business now employs centralized servers. What do they say about times and seasons? Well… Here are some limitations of centralized cloud computing: Users' data can be stored and used without their consent. In the place of Google, personal data such as search history, personal preferences, and also location can be arbitrarily used. Data is prone to hacking by third parties just like the Facebook scandal. The operations will be slower leading to stifled scalability- following the dependency on primary servers(less division of labor). Servers are vulnerable to a single point of failure as explained above. Is that the path data management should continue in? I don't think so. There seems to be a way out -thankfully, with the "decentralized mandate" on Web3, multiple nodes can process and store large amounts of data. Now, let me help you understand this. Decentralized storage protocols can be likened to keeping your eggs safe in different baskets- all in the same room each stored in a well secure basket that can only be accessed with permission (on-chain). Centralized storage servers can be likened to keeping all your eggs in one basket relatively safe. The safety of the eggs can be easily tampered with when it's in one basket. That's how vulnerable centralized servers are. Notice that I highlighted that, in the first case scenario, these eggs are in the same room, so there's still a connection between them - that explains the interconnection between decentralized nodes. Just like the eggs in scenario 1, all placed in different baskets interconnected nodes or blocks are more secure and easy to detect when something goes wrong. But then, there's still a problem. Navigating the Early Stage of Innovation Illuminates a Myriad of Challenges The emergence of true data sovereignty in a decentralized environment has uncovered many holes that should be filled. At this current stage where Web2 is still fully in existence, many applications utilize centralized servers including Web3 dApps because there aren't yet fully equipped decentralized storage protocols to handle massive data . yet Web3 developers crave a more sophisticated decentralized database environment following the massive and complex nature of data generated in the ecosystem. Let's face it; with millions of transactions and blocks added daily, developers need to access and query data in real-time. Speed is of necessity for dApps to scale efficiently. Here are some of the problems faced by developers: Some existing decentralized storage protocols like and are limited to the storage of only static files. Arweave IPFS The abundance of Web3 applications means more complex data to deal with like NFT data, tokens, wallets, etc. Following the dynamic nature of Web3 data, these distributed protocols make it difficult for developers to easily query data, leaving most of the data stored in silos unused. Also, such a rigid storage environment slows down deployment. These vast amounts of data lying fallow in silos, which are not maximized are kept to waste because they can't be easily accessed when needed - in real-time. This affects the application lifecycle. : The time and expense required to build a robust database infrastructure to tally with the demands of Web3 complexities will give Web3 developers a second thought to continue with centralized databases which they are even more familiar with. It is a complex process to build from scratch, and there is scarce time to do that while trying to scale. Cost implications One of the pillars of a Web3 environment is . Developers need to trust that they can get reliable data from the emerging decentralized storage infrastructures available. trust Using blockchain specifically to store data takes a lot of time and isn't any different from using centralized servers; transactions are slower and take longer time to validate. In a bid to solve this, developers might resort to building a decentralized on-chain database. While this would be more effective, it is an extremely complex task to get started with. Who Owns the Data in Web3? Various Web3 projects may have distinct approaches to data ownership. However, ownership of data is distributed across nodes or computers to enable transparency, censorship resistance, and immutability. This distribution is carried out by decentralized systems including blockchain technology. Individuals have full control of their data and can decide which data they want to share. How Is Data Stored in Web3? Data storage in Web3 is usually carried out with decentralized technologies like the blockchain, distributed storage networks, and decentralized file systems like (InterPlanetary File System) Now we will take them in bits so you can understand: : A strong force to be reckoned with in the Web3 ecosystem that allows you to store data in blocks and link them securely through cryptography. (Remember the definition above) Blockchain It is usually used to store transactional data through an immutable chain, hence its name- blockchain. :  This decentralized storage type leverages the collective storage ownership of participants in the network and incentivizes them to share more of their unused storage space. The storage space is then broken into bits and distributed across multiple nodes. Distributed storage networks : A peer-to-peer distributed storage environment that leverages on content addressable model: a way to recognize files by their cryptographic hash. It helps in the storage and retrieval of files. Decentralized File Systems (IPFS) Which Web3 databases Are Available? As Web3 is buzzing, many developers have discovered a missing tech stack in the ecosystem, a database for Web3; below are a few emerging databases you can use: Polybase Glacier Ceramic WeaveDB IceFireDB Kwil Space and Time (Web3 data warehouse approach) Thus Far… Some Web3 databases have emerged to solve major pain points that Web3 developers face to scale their dApps efficiently. From the likes of a handful of examples listed above amongst others, their approach in ways is similar by providing: : A better interconnected organized space for Web3 data that allows for easy access and allows developers to build on the infrastructure seamlessly. Programmable composable data network :  With traditional databases rigid on structured data i.e., having rows, tables, and columns, it eliminates the chances to maximize Web3 data which comes in more complex forms. NoSQL databases will help handle Web3 data in any form with more flexibility and efficiency. Using the NoSQL database structure, different types of data can be stored without necessarily fitting into a predefined schema. NoSQL database : Just like building blocks, different parts of the environment can be easily put together or taken out to meet needs per time- it's customizable and dynamic in nature. Modularity : A robust tool that meets the heavy data demands of massive Web3 data without getting overwhelmed or reducing efficiency. Scalable infrastructure : This is one word you may struggle to pronounce but will regularly come across when talking about Web3 applications. I'll try to help you understand it in the best way possible 🙏 Interoperability Imagine that you have a flash drive that can easily connect to 3 computers. That drive is able to share information easily with each of the computers. That's how it works too in Web3- various dApps can share information with each other and work together even if the applications were built by different people. It's more like a meeting point of agreement despite the uniqueness of the applications. Emerging Web3 databases are receptive to allowing various dApps to interact and collaborate seamlessly on their platform. Business applications can interact without intermediaries. Glacier particularly, intends to with the ownership of Web3 data to bring to reality the monetization of Web3 data subsequently. Data monetization: combine NFT technology Exciting Times Ahead for Data Engineers As Web3 gradually encroaches into the way everything on the internet is done, data engineering will also experience interesting steps towards decentralization. Data engineers, the core architects of data pipelines, will have to learn new ways to design and maintain decentralized environments that meet the demands of data sovereignty which covers security, integrity, and privacy through immutability. Also, businesses will garner more trust seeing that their data is protected from unauthorized access, deletion, or manipulation. The smooth transition from Web2 to Web3 is also not leaving out Web2 applications, some of the databases listed above like IceFireDB, is providing a solution for Web2 and Web3 applications to access decentralized storage. Automation is a one-time button for repetitive tasks. Data engineers can employ smart contracts - programmable self-executing contracts to automate some data management practices. How Will Tech Giants React to the Full Unfolding of Web3? Like many things that trended within a particular time frame in the past, there came a time they also had to fade because they weren't able to successfully withstand change. That's the same way this will play out. Facebook, Amazon, and Google may not disappear entirely if they can adapt and implement the necessary changes to transition towards a more open and transparent internet. Facebook has gradually shown support for certain aspects of the Web3 sphere, such as the metaverse and NFTs, despite its to shut down its NFT platform for Facebook and its sister platform, Instagram. recent decision Everyone needs to learn constantly about the evolving direction of the internet because this next phase is really about and you do have a stake. you, Additionally, there would be a more transparent approach to handling consumer data as a business, ensuring direct consent through a decentralized web. It's truly an incredible journey to anticipate, albeit at a leisurely pace. Takeaway Just as you wouldn't be needing another person's phone to make calls, Web3 developers crave an environment for decentralized storage that fully exceeds expectations rather than blindfolding themselves to the many limitations of centralized facilities. Get excited about the new wave of the internet -Web3, where you are more involved and protected.

Who Will Eventually Control Big Data in Web3?

117 Stories To Learn About Heroku

Explanation of How to Expand API Security From Defense-in-Depth to Zero Trust Model “The pandemic placed immense urgency on businesses to get all kinds of digital transformation projects live as quickly as possible, and that is almost certainly a driving factor behind this surge in attacks,” — , Director of Technology at . Peter Klimek Imperva DYKT APIs have been used for more than 20 years. Since then, APIs have evolved drastically — from a limited set of companies using APIs to tackle specific needs to, recently, an endless collection of use cases in DevOps environments of all sizes. APIs can be found across App Developments — agile development, connecting customers and partners with services, and powering digital transformation initiatives. But regarding cybersecurity, according to research by , . Yet, with broader adoption, APIs expose more sensitive data today than ever, making them a valuable target for attacks. ProgrammableWeb an average of 220 new APIs have been added every month since 2019 This post is an introduction to how to map the requirements of API Security, from Defense-in-Depth to Zero Trust Model. Background -The State of API Security Before entering how to secure the API, let's look at the current threat landscape of API Security. According to the State of API Security Report by Salt Security: API Attacks Increased by 681% in the Last 12 Months 95% of respondents have experienced an API security incident within the last year 34% of respondents lack any API security strategy 62% of survey respondents acknowledged slowing down the rollout of a new application because of API security concerns In short, we can tell that most enterprises are unprepared for an API-based attack. Also, reliance on existing security and API management tools, e.g., web application firewalls (WAFs) and API gateways, could have effectively prevented security incidents and provided a false sense of security. What About Shift-Left? The report highlights that shift-left tactics are not helping, at least on API security. Over 50% of respondents said that developers, DevOps, or DevSecOps teams are responsible for API security. Companies that spend more on pre-deployment efforts include: secure coding best practices, code scanning, and manual test However, - Proving that these DevOps security practices, while important, are not enough. 85% acknowledged that their security tools are ineffective in API attack prevention So, what protection should an organization build or adopt to defend against API attacks? To answer this question, first, we need to understand the common attacks against API. The Current Threat Landscape In the recent report on , the sources of API security threats are: API security by Google Cloud Misconfigured APIs (40%), Outdated APIs, Data, and Components (35%), Spam, Abuse, Bots (34%). “Misconfigured APIs” or “security misconfigurations,” as a category, are the most identified threat source. According to another study by , which jumped by 271%. Hackers use RCE or RFI attacks to steal company information, compromise servers and website defacement, or even take control of the websites. Imperva Research Labs the most significant attack rises Remote Code Execution (RCE) or Remote File Inclusion (RFI) Other API vulnerabilities are, according to OWASP API Security's top 10: API DDOS fan-out, zero-day API attacks, stolen credentials, perimeter breaches, lateral movement of breaches, data leak at the egress, or resource hijacking Cybersecurity: API is the New Endpoint As mentioned above, the first reason for the increased security risk of APIs - many APIs in an environment. For example, a Kubernetes application has hundreds of pods and microservices. Each of them is managing half a dozen or more APIs. (That's a typical scenario in a DevOps environment). is the explosion of adoption Now add that these microservices workloads (and hence the API calls) are temporary, run across clouds, are written in a multilingual fashion, and use different protocols. Or in short, APIs create a complex environment and challenging for the security team to oversight the API operation. Secondly, APIs were never meant to be exposed to the outside world. Yet, this is what we faced with the vulnerabilities found inside network protocol stacks. Those developers would never imagine their works would be adopted on the scale today. As a result, APIs have innate vulnerabilities and risks built within them. Thirdly, attacks and breaches have gotten increasingly sophisticated, especially those executed in the post-authentication and authorization phase. They are also more profound within the API data payload. Therefore, there is a need to look at security beyond authentication and authorization, also the application and API data payload layer. One way to do that is to think of API Security as analog to our traditional Endpoint security. DiD (Defense-in-Depth), Again! Security problems also happen in our daily life outside of computers. From the early stage of human history, various countries have been exploring and practicing multiple defense mechanisms and fortifications. These experiences and ideas also apply to endpoint, network, and API security. Let's say Endpoint Software is analogous to the castle: Identity authentication is equal to the commanders' ID proof, and Honeypots (or decoys at war) lure attackers away from high-profile targets. Among these war strategies, one of the most effective ways is Defense-in-Depth (DiD). The DiD approach can be divided into two areas: Boundary Defense (Anti-malware Signatures) Intrusion Detection/ Prevention (IDS/ IPS/ EDR) I'll explain API security with these DiD areas one by one. 1# Boundary Defense Boundary defense is the most basic type of defense. Almost all companies invest in boundary defenses. In endpoint security, we use signatures and IP denylists to defend against known attack methods. As the front line of protection, this layer aims to stop 90% of all attacks, non-targeted and initiated by unskilled individuals who do not have solid technical know-how or a hacker mindset. In this scenario, boundary defense can resist these indiscriminate attacks well enough. In API Security, WAF is doing an excellent job in this area. It offers standard features for boundary defense: ·         IP allowlists and denylists, ·         WAF rules engine, ·         Rate limiting, and ·         fault injection/ fuzzing. When in combination, it can block almost all commodity attacks. 2# Intrusion Detection (++) Security visibility is a critical element of attack prevention. After a hacker has breached the perimeter, we need a proper way to identify which file/ process/ traffic is likely related to the malicious attack. In Endpoint Software, we have to inspect all requests passing through the front gate. host-based IDS/ IPS Some other detection methods, such as APT detection and machine learning, could be more intuitive to evaluate against targeted attacks. Other typical ways of implementing behavior analysis are: ·         Honeypots, ·         EDR (Endpoint Detection and Response), and ·         Threat intelligence (file & process). Among all those methods, honeypots are one of the oldest (since the beginning of wars). By luring some high-value targets into traps/ decoys, they can analyze the enemy’s behaviors and even help locatei them. Nowadays, we adopt these tactics and turn them into deception techs. In the modern world, API security solutions provide combinations of the mentioned techniques; for example, artifacts collected in honeypots can then send into the threat intelligence feed for WAF or Web Application and API Protection (WAAP) consumption. In this layer, we have similar techniques to enhance visibility and the speed to stop an attack: ·         Network Honeypots ·         NDR (Network Detection and Response), and ·         Threat intelligence (payload & network). Using bots to execute "credential-stuffing" attacks is another common attack tactic. It attempts to steal high-value assets. The strategy is to find a way to get login information, such as leaked emails/passwords, and then try to access network locatons in batches (lateral movement). By far, the most efficient defense to combat credential stuffing is from the source: identify the bot from real users to intercept all requests made by the bot. As such, some AppSec tools also equip anti-bots features, a specific type of behavior detection as part of API security. When API Security Meet Zero Trust I am not saying DiD is useless. API and Application Security solutions such as WAF protection for organizations from commodity attacks. However, as mentioned, API creates a complex environment, and misconfiguration worsens the problem. With an uncleared perimeter, there may need to be more than DiD approach. Zero Trust essentially puts obstacles everywhere for the attackers, making it impossible for them to move laterally within the environment. Zero trust is a comprehensive security framework and strategy. It requires strict and unified verifying steps for all terminals, BYODs (Bring Your Own Devices), servers, APIs, microservices, data storage, and internal services. The main idea of Zero Trust is , including APIs. Whether it is an internal access external request, a mobile phone or a PC, an API call or HTTP request, an ordinary employee or a CEO, none can be trusted. to turn the centralized enforcement point into multiple micro checkpoints in every path of your applications To effectively achieve such a goal without stopping or slowing your applications, would be the critical determining steps. orchestration and automation Why Orchestration and Automation are Crucial for Zero Trust API Security? ZTA, NIST SP800–207 | Image by the author To explain the necessity of the two, let’s take a closer look at one pillar of Zero Trust Architecture — . This defense method is similar to showing your passport at the airport checkpoint and your ID cards to purchase alcohol. User/ Device access trust Without the corresponding identity and authority, it is impossible to enter the related system. This is where an API Gateway comes in strong, as it provides some key authentication features: Automatic rotation of keys Integrating with multiple authentication systems such as OKTA and Auth 2.0 Support TLS and mTLS encryption of traffic There are two core components of User and Device Trust: Identity and Access Management API Gateway with integrated security , such as airports and high-speed railways. You must also understand all the routes to and from all transportation hubs and implement safeguards. Imagine adding identification equipment in all transportation hubs In a large enterprise, there will be hundreds of systems, tens of thousands of APIs and microservices, and hundreds of thousands of clients. Unless we have unlimited resources and time, the DevOps, Security, or Application team can’t define and manually add hundreds of thousands of micro-identification checks in modern applications. All the other pillars of Zero Trust also require the same logic for adoption. The need is a solution that: Architecture, Application, Workload, and Data It uses modern architecture, Works in heterogeneous environments, Mitigates these risks (not just the commodities), and Does all this in an automated manner across multi-cloud environments (optional) open-source, such that to enable technology agility and creativity. What’s the Idea Zero Trust API Security Look like? To adopt the complex and heterogeneous environments in API, the Zero Trust API Security solution , for example: must be able to be deployed as multiple formats and thus support different settings Docker Container, A standalone reverse proxy, Agent for web/ application server, or Embedded in Kubernetes Ingress Controller. With the support of the cloud and modern application architecture, automation and scalability would be taken care of. But to maintain orchestration, the “agent” (or micro-enforcement point) must be able to be deployed while ensuring minimal latency and maximum control. on top of an existing application without changing existing architecture After considering the deployment and architecture form factors, it is also essential that the security level is not degraded. To be genuinely Zero Trust adopted, without transmitting to other clouds or engines, such as a cloud sandbox for analysis. security processing should be done locally If external parties are not in our control, verifying the Data / Network access trust is difficult. There are some other benefits of doing such locally, such as: Sensitive data does not leave the protected environment. You don’t need to share certificates and private keys with third parties. No dependency on 3rd party uptime for processing traffic. Ideally, we need a solution that can infuse into the application environment while an orchestrator can manage those agents and take care of the following operations: The last part is to consider orchestration. agents registration/ deregistration policy update configuration update software update logging and Data synchronization. In short, Zero Trusted API Security should be in various forms to infuse into modern app environments. Meanwhile, the best solution should be able to provide orchestration and all the security functions that traditional solutions can provide. So as you know, zero trust is not flawless. Zero-trust solutions cannot fully defend against zero-day or social engineering attacks, although they can significantly reduce the attack surface and impact. To learn about Zero Trust Architecture: . Introduction to the Zero Trust Security Architecture — a Concept, Not A Product Final Words APIs have become the central nervous system of modern applications, bringing critical information and data from one part of the application to another or from one application to another. As a result, API security should be the priority when securing applications. This is particularly true for public APIs, with users worldwide accessing software components and sensitive data. Adopting Zero Trust Framework shifts the focus from a single safeguard to different pillars (Users, Devices, Networks, Applications, and Data). That can help you ensure that every part of API access, whether inside or outside the perimeter, is under the least privileges approach and continuously monitored. Thank you for reading. May InfoSec be with you🖖.

How to Use Zero Trust Framework for  API Security

¿Cómo usar Zero Trust Framework para la seguridad de API?

Comment utiliser Zero Trust Framework pour la sécurité des API ?

एपीआई सुरक्षा के लिए जीरो ट्रस्ट फ्रेमवर्क का उपयोग कैसे करें?

API セキュリティにゼロトラスト フレームワークを使用するには?

Como usar o Zero Trust Framework para segurança de API?

Cách sử dụng Zero Trust Framework để bảo mật API?

如何使用零信任框架实现 API 安全？

Introduction: What is Web3.0? Web3.0 is the next generation of the internet. It is an internet that is decentralized and democratized, with a focus on privacy, security, and user-centricity. The structure of the internet has gone through many iterations, most recently, with the arrival of Web 2.0, we saw personalization and social media apps being introduced to make the web a better place for users. The next iteration Web 3.0—is not so much about a new type of site or app as it is about a new way for people to use the sites and apps that already exist. The idea of Web 3.0 is based on —these are things that are important to users who want to participate in a decentralized world by using tools like social media platforms and virtual reality headsets. trust, control, and privacy One big contrast between Web 2.0 and Web 3.0 is a lack of centralized control. Here is a delightful little illustration of how the web has evolved since the 1990s: Web 1.0 - 1990s, things like email and search engines were in their infancy and there was no real concept of 'the internet'. Web 2.0 - 2000-present, personalization and social media apps were introduced to make the web a better place for users. The next iteration—Web 3.0—is not so much about a new type of site or app as it is about a new way for people to use the sites and apps that already exist. Web3.0 has been called “ ” or “ ” because it has evolved from the current web (or Web2.0) which is centralized and controlled by corporations like Facebook, Google, Amazon, etc. the new Web the decentralized web What is the Difference Between Web3.0, Web2.0, and Web1.0? Web3.0 is the next evolution of the Internet that is set to change the way we live and interact with one another. The World Wide Web of today is a web of documents, where each document lives in isolation on a server somewhere on the Internet. Web2.0 is characterized by social networks, wikis, and collaborative content creation. The first generation of the web was a web of documents, but Web1.0 was about connecting people. Web3.0 will be about connecting people and data to power new applications and opportunities for everyone on earth- from governments to NGOs to multinational corporations to startups Web2 - The Present of the Internet The web is a place of constant change, and the internet is no exception. The web has gone through three major revolutions in its lifetime, each with a different impact on the internet. Web 1.0 took place in the early 1990s and was characterized by static HTML pages that were difficult to update and did not allow for interactivity. Web 2.0 revolutionized the internet by using dynamic pages that could be updated quickly, allowed for interactivity, and had social media integration. Web 3.0 is what we are currently seeing today with the increased use of artificial intelligence in our daily lives. Web1 - The Past of the Internet The internet is a vast place with millions of pages and content. It is hard to keep track of everything that is happening on the web, but there are some websites that try to do just that. One of these websites is called Web1, which was created by a group of MIT students in 1995. The website was designed as a way for users to explore the history of what has happened on the internet so far. Web1 started out as an online scrapbook for people's old websites, but it has evolved into an interactive timeline with many different features like maps and search bars. This website has been around for over 20 years and it still continues to grow as more websites are added each day. Web3 - The Future of the Internet The internet of today is a centralized system that is dominated by a few key players. Web3 will change this by creating a decentralized network that will be more secure, more private, and more equitable. Web3 is the future of the internet, and it will change everything. It’s not just about decentralizing the web – it’s about decentralizing everything. Web3 means being able to access information without going through an intermediary, like an ISP or Google, or Facebook. It means being able to interact with one another without having to go through a central authority. It means all of us being able to own our data, instead of handing over all of our data to big companies like Facebook and Google in exchange for “free” services. And it means building systems that What are the Benefits of Web3.0? Web 3.0 is the next generation of the World Wide Web, which will be a decentralized web where users are in control. It will be an internet that is not owned by any company or individual, but instead by the people, for the people. The main benefits of Web3.0 are: - Freedom from censorship - Freedom from centralized control - Freedom from data ownership and privacy Conclusion: Why You Should Care About Web3.0 We are at the beginning of a new era of web development. Web3.0 is a new paradigm in the way we think about the internet. It has been called the “ ”, “ ”, “ ” and many more names. Programmable Web Web of Apps Web of Things The web is not just a place for people to read content anymore; it is also about data-driven interactions and transactions between people and objects in our lives.

Web3.0 vs Web2.0 vs Web1.0

APIs have some fascinating implications for how companies are built and where value is created. We compiled a list of the best places to get the most impactful information on APIs. Summary (TL;DR) Rank Website 1. Not Boring https://www.notboring.co/ 2. Stratechery https://stratechery.com/ 3. The API Economy https://www.apifirst.tech/ 4. API Evangelist https://apievangelist.com/ 5. Nordic APIs https://nordicapis.com/blog/ 6. Postman Blog https://blog.postman.com/ 7. API Developer Weekly https://apideveloperweekly.com/ 8. r/programming https://www.reddit.com/r/programming/ 9. MuleSoft Blog https://blogs.mulesoft.com/bloghome/ 10. Programmable Web https://www.programmableweb.com/ API-first companies can be confusing to explain because many of them offer both API products and traditional SaaS products. Their customers run the gamut, from large platforms like Shopify and Uber all the way down to individuals who want to accept payments online, and everything in between. To put it simply “APIs give their customers superpowers.” That’s the phrase you see most often when researching the space and talking to people in it, but APIs obviously go much deeper. Here’s a list if you’re interested in learning anything and everything in the wonderful world of APIs. The List Not Boring Not Boring is the most fun way to learn about what’s going on in business and the strategy behind the decisions companies make. If Ben Thompson and Bill Simmons had a baby, it would look like Not Boring. The Not Boring community is  almost 100,000+ strong and growing, full of smart, curious people from the worlds of tech, finance, real estate, design, and beyond. has a lot of fun writing this, and I think you’ll have a lot of fun reading it. Join our growing community by subscribing. Packy M Notable API focused writings include: — an essay going down the API-First Ecosystem Rabbit Hole with Shopify, Stripe, Twilio, and more. APIs All the Way Down — an essay announcing the Newest API-First Unicorn Saving the Internet Stytch: Kill the Password — A Not Boring x Collab on Moon Math, Privacy, and Hype Zero Knowledge Jill Carlson Bull & Bear: Agora, the API Powering Clubhouse https://www.notboring.co/ 2. Stratechery Stratechery provides an analysis of the strategy and business side of technology and media and the impact of technology on society. Written by , perhaps the world's most distinguished tech writer, the blog’s content does not miss. Ben Thompson Recommended by The New York Times as “one of the most interesting sources of analysis on any subject”, Stratechery has subscribers from over 85 different countries, including executives in both technology and industries impacted by technology, venture capitalists and investors, and thousands of other people interested in understanding how and why the Internet is changing everything. Notable API focused writings include: Stripe: Platform of Platforms From Products to Platforms Cloudflare’s Disruption The Cost of Developers https://stratechery.com/ 3. The API Economy While the likes of Stripe, Twilio, Plaid, and Cloudflare have all built some of the biggest companies in SaaS by leveraging an API-first approach — few understand the groundbreaking shift we’re experiencing with APIs. In this monthly newsletter, the aim of writer is to: Peter Schroeder Research the trends regarding APIs (starting in Saas, but bridging to the mainstream economy). Break down modern companies that are pushing the boundaries of API capabilities. Teach people more about how to either: a. Build an API-first company. b. Start to pivot/decouple at their current company to become API-first. Notable API focused writings include: — why Shopify's platform continues to thrive from a business & technical perspective. Shopify: The Entrepreneur's Platform — breaking down the company on a journey to connect one API to the entire world of SaaS. Merge: One API To Rule Them All https://www.apifirst.tech/ 4. API Evangelist The API Evangelist is about making sense of the world of application programming interfaces, or simple APIs. APIs have become part of every layer of our Internet-connected world over the last 20 years, and this their my research project into understanding what is happening. As of 2019 the author of the API Evangelist, is also the Chief Evangelist for Postman, but he still uses this site in the same way he has since 2010, as a workbench for what he is working on each day. Providing him with a very public way to work through his projects, while helping others see the world of APIs in different ways, and hopefully learn more about how APIs are being applied across our world. Kin Lane https://apievangelist.com/ 5. Nordic APIs Nordic APIs is a series of conferences and events held throughout Scandinavia that provide knowledge and information designed to help organizations become more efficient, automated, and programmable through the use of Application Programming Interfaces (APIs). Every year, a multi-day event is held in one of the Nordic capitals, and smaller events are run throughout the region all year long. https://nordicapis.com/ 6. Postman Blog Postman is an API platform for building and using APIs. Postman simplifies each step of the API lifecycle and streamlines collaboration so you can create better APIs—faster. Their blog is a treasure trove of information covering all corners of what APIs have to offer. https://blog.postman.com/ 7. API Developer Weekly API Developer Weekly is a weekly newsletter hyper-focused on the business, design, development, and deployment of APIs for web and mobile apps. The newsletter is hand-curated and designed to keep you updated on the latest news, practices, and trends in the web-based API industry. https://apideveloperweekly.com/ 8. (Programming subreddit) r/programming You’ll have to look for API-specific content, but how could we not include Reddit? ;) https://www.reddit.com/r/programming/ 9. MuleSoft Blog Over a decade ago, founder created a short string of text that pioneered a simple, powerful idea: why crank out custom code over and over when it's faster and more efficient to assemble the right components? This led to the creation of MuleSoft, a platform to help you Ross Mason create seamless digital experiences, products, and services — with the #1 platform for integration, APIs, and automation Fun fact, the "mule" in their name comes from the drudgery, or "donkey work," of data integration that our platform was created to escape. Check out all things APIs on their blog. https://blogs.mulesoft.com/bloghome/ 10. Programmable Web As the world's leading source of news and information about Internet-based application programming interfaces (APIs), is known as the Web's defacto journal of the API economy. Since it was founded in 2005, ProgrammableWeb has been chronicling the daily evolution of the global API economy while amassing the Web's most relied-on directory when it comes to discovering and searching for APIs to use in Web and mobile applications. ProgrammableWeb.com In the past, Gartner identified ProgrammableWeb as one of several “Cool Vendors” in Information Innovation. ProgrammableWeb is also the most widely-cited source of data when it comes to the inclusion of API-related statistics in the mainstream media, conferences, whitepapers, and other forms of research. Written by who works with APIs and AVs at Ford Motor Company, this is one of the best blogs in the world to learn from. John Musser https://www.programmableweb.com/ Bonus: The API Design Blog The #1 source of tips and tricks for building quality APIs with a Design-First Approach Merge API’s Blog Merge is the unified API of the future. They help you integrate your product once with Merge and connect to all Payroll, Recruiting, HR, and Accounting API platforms automatically. Merge’s founding team worked at different startups but ran into the same issue: time-consuming customer-facing integrations. Developer time spent crafting and maintaining those integrations takes time, money, and focus away from the company’s core product roadmap. Their team of builders and problem solvers are motivated to not just make integrations incredibly accessible, but also delightful to implement. Their blog helps show you how all of it is possible from some of the smartest people in the world. https://www.merge.dev/blog For more API-related topics, subscribe to and . The API Economy follow me on Twitter Subscribe

All The Best API Related Blogs and Newsletters

TL;DR: An API (Application Programming Interface) enables two-way communication between software applications driven by requests. A webhook is a lightweight API that powers one-way data sharing triggered by events. Together, they enable applications to share data and functionality, and turn the web into something greater than the sum of its parts. APIs and webhooks both allow different software systems to sync up and share information. As software applications become increasingly interconnected, it is essential for developers to understand the difference between these two means of sharing data, and select the tool that best meets the needs of the task at hand. Let's dive in. What is an API? An API is like a portal through which information and functionality can be shared between two software services. The word “interface” is key to understanding an API’s purpose. Just like a web browser is an interface for a human end user to receive, send, and update information on a web server, an API is an interface that provides software programs with the same functionality. There are different types and categories of APIs (which we will explore later), but defined broadly, APIs are the most common way for different software systems to connect and share information. Currently, provides a database of over 23,000 APIs that deal with everything from global epidemiological data to dad jokes. Each API is a blank canvas waiting for developers to tie it into other applications and use it in new, creative ways. ProgrammableWeb What is a webhook? A webhook can be thought of as a type of API that is driven by events rather than requests. Instead of one application making a request to another to receive a response, a webhook is a service that allows one program to send data to another as soon as a particular event takes place. Webhooks are sometimes referred to as “reverse APIs,” because communication is initiated by the application sending the data rather than the one receiving it. With web services becoming increasingly interconnected, webhooks are seeing more action as a lightweight solution for enabling real-time notifications and data updates without the need to develop a full-scale API. Say for instance you want to receive Slack notifications when tweets that mention a certain account and contain a specific hashtag are published. Instead of Slack continuously asking Twitter for new posts meeting these criteria, it makes much more sense for Twitter to send a notification to Slack only when this event takes place. This is the purpose of a webhook––instead of having to repeatedly request the data, the receiving application can sit back and get what it needs without having to send repeated requests to another system. APIs enable robust integrations An important feature of APIs is that they provide two-way communication between different software programs via a request-response cycle, most commonly using the . HTTP protocol In a typical API use case, one software program will ask for a specific set of data from another using an HTTP GET request. Provided the request is valid, the receiving system will respond with the requested data in a machine-readable format, commonly XML or JSON. This is what allows applications to share data regardless of their individual programming languages or internal specifications. The universal nature of API interactions can enable countless scenarios, from an iPhone user checking the local temperature via the to an Uber driver navigating to their next pickup location via the Google Maps API. AccuWeather API In addition to receiving data, APIs can also handle the full gamut of “CRUD” (Create, Read, Update and Delete) operations between two applications. In other words, APIs aren’t just for displaying data to a user in an interface––they can also be used to make changes to it in the application where it is stored. This is how APIs allow software systems to expand their services and functionality, and integrate with other platforms in a more thorough and meaningful way. The versatility of APIs makes them powerful tools for developers to extend the capabilities of their applications. Most modern web services include APIs that allow their data and functionality to be incorporated into other tools––in fact, it would be rare to encounter an enterprise web service that does not leverage an API from at least one other application to some extent. Webhooks offer lightweight data sharing One might think that since webhooks are real-time events that they are technically difficult to implement. Actually, a key advantage of webhooks is that they are easier to set up and less resource-intensive than APIs. Creating an API is a complex process that in some cases can be as challenging as designing and building an application itself, but implementing a webhook simply requires setting up a single POST request on the sending end, establishing a URL on the receiving end to accept the data, then performing some action on the data once it is received. Common use cases for webhooks include sending new email list additions and removals to a CRM system, automatically updating accounting software when invoices are paid, or setting up any type of notifications. In each of these types of events, the information flows in one direction, and no request is necessary to receive updated data. The same characteristics that make webhooks relatively easy to implement are also the reasons why they are far more limited than APIs. Updating the data a webhook delivers requires re-configuring it entirely to listen for a different event, and in most cases it would be more efficient to create a new webhook. When two systems share data via an API with multiple endpoints, the receiving system has access to a much broader range of data from the sending system. Also, unlike APIs, webhooks do not allow the sending system to add, update and delete data on the receiving end, which is why webhooks alone are too limited to offer full integration between two applications. API architecture: Present and future APIs fall under different categories depending on the protocols and architectures that define how they send and receive data. Historically, the most common architectural pattern for API design has been REST, especially for those servicing web-based applications. REST stands for “Representational State Transfer.” This pattern, defined by in 2000, allows for two applications to communicate over HTTP in a way similar to browsers and servers. REST is not an official standard––rather, it is a set of suggestions about how to design APIs and other web services. An API is considered “RESTful” if its design abides by the following recommendations: Roy Fielding : Just like a browser requesting a webpage from a server, in a RESTful API, application A makes a request to a URL hosted on application B over HTTP. Application B then evaluates the request and returns either the requested data or an error message. Client-Server : The responding system does not need to know anything about the application state of the system making the request to provide an appropriate response. The request alone should contain all the information necessary to deliver the response. Stateless : The response should state whether the receiving system is allowed to cache it or not. Cacheability : The API does not rely on a particular system to make the request in order to deliver the response. This means the requesting system could either be a client, a proxy, or any other intermediary. Layered systems This simple follows REST conventions. When you visit the URL, your browser will display a suggested activity to take part in if you are bored in JSON format: example { : , : , : , : , : , : , : } "activity" "Go to a concert with some friends" "type" "social" "participants" 4 "price" 0.6 "link" "" "key" "4558850" "accessibility" 0.4 No matter how you make a request to this URL––whether with your browser, with , or an HTTP client library like in JavaScript––the API will return the same object. In addition to REST, other API conventions include , and . To date, however, REST the most widely used set of API architecture guidelines. CURL fetch SOAP COBRA XML-RPC GraphQL: The Goldilocks of data retrieval In 2015, the engineering team at Facebook released ––a new query language for APIs intended to provide a more flexible alternative to sending requests to endpoints on REST APIs. Without getting too deep into the complexities of GraphQL, the main advantage it offers over traditional REST APIs is its ability to return the exact data needed with each request while avoiding “over fetching” and “under fetching,” problems typically encountered with traditional APIs. GraphQL For example, consider the following situation. A restaurant review app needs to display the titles of the most recent reviews a user has published, along with the last three people to follow that user. Using a REST API, the client would typically have to make three different requests to different endpoints––one to fetch the initial user data, a second to return all the reviews for that user, and a third to return a list of that user’s followers. Using GraphQL, a client could access the same data with a single query the exact requirements: query {
    User(id: ) {
        name
        posts {
            title
        }
        followers(last: ) {
            name
        }
    }
} "qr3fsdcv24" 3 Like Goldilocks, GraphQL seeks to retrieve the amount of data that is "just right." Hopefully this post has expanded your understanding of these two common methods of sharing data between applications. The same wisdom that applies to all architectures, frameworks, design patters and technologies in software engineering also holds true for APIs and webhooks: everything has its time and place. The key to getting the most out of both tools is knowing which one is right for the job. Also published on: https://www.mparticle.com/blog/apis-vs-webhooks

PROGRAMMABLEWEB

programmableweb.com

11-50 employees

Since n.d.

COMPANY RANKING

PROGRAMMABLEWEB

EVERGREEN INDEX #2506

Representing this company? Click here to claim and customize this page!

ProgrammableWeb WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

PROGRAMMABLEWEB

programmableweb.com

11-50 employees

Since n.d.

COMPANY RANKING

PROGRAMMABLEWEB

EVERGREEN INDEX #2506

RELATED COMPANIESRANK

STORIES ABOUT PROGRAMMABLEWEB

Representing this company? Click here to claim and customize this page!

ProgrammableWeb WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!