January 2023 Summaries

In a landscape where economic challenges and technological advancements are rapidly shifting priorities, app development teams are urged to focus on core activities such as swiftly shipping product features, while outsourcing non-essential tasks like payments and user authentication to specialized providers. As frictionless user experiences become crucial in highly competitive markets, simplifying processes like onboarding and login will be key to retaining discerning customers. The rise of passkeys, championed by tech giants like Apple and Google, signals a move towards a passwordless future, emphasizing the need for widespread adoption to enhance privacy and security. Meanwhile, identity remains a critical aspect of cybersecurity, as cybercriminals increasingly exploit stolen credentials for attacks, underscoring the importance of robust identity safeguards in application security strategies.

In a guest post by Serge Bakharev, the challenges and best practices of implementing Identity and Access Management (IAM) within microservice architectures are discussed. The complexity arises from the need for multiple independent services to authenticate and authorize requests consistently, without compromising the Single Responsibility Principle. Instead of relying on a central dependency, a multilayered IAM approach is recommended, with access policies enforced at both the edge via an Access Server and closer to the microservice itself. This dual-layer strategy, advocated by standards like NIST 800-204, ensures security by requiring failures at both levels before unauthorized access can occur. Stateless tokens, particularly JSON Web Tokens (JWT), are favored for their ability to decouple authentication from authorization, enabling validation throughout the infrastructure without dependency on session state information. The use of external authentication providers and API gateways with token filtering capabilities simplifies the implementation of such access policies, allowing for role-based access control and fine-grained policies within the microservices.