Securing the APIs of a digital identity service — case study

Collage: a hand holds an open envelope from which a fingerprint unfolds into a network of connected organisations.

Key facts

Client: Digital identity service of a major French group
Sector: Digital identity
Period: since October 2023
Practice: Cybersecurity Architecture
Offer: Trusted Integration

In figures

APIs secured to OWASP standards: ~20

The challenge

A high-assurance digital identity service runs on some twenty microservice APIs. Advanced security practices had to be built in without hurting availability or performance, OWASP standards adopted by teams of uneven maturity, and sensitive data kept traceable in fraud investigations, in line with the GDPR.

What we did

Secured some twenty APIs (authentication, protection against common vulnerabilities, input and output validation) to OWASP standards.
With the CISO: designed an “evidence file” component that gathers and restores user data for fraud investigations.
DevSecOps audits: assessment of the information system’s maturity, gaps and recommendations.
Automated controls in the continuous integration and delivery pipelines: static code analysis, image and dependency scanning, vulnerability tracking, software bill of materials (SBOM).

What changed

Fewer critical vulnerabilities on exposed APIs and better compliance with OWASP standards.
Fraud investigations made easier by the evidence file.
A structured view of DevSecOps maturity, and vulnerabilities caught earlier in the delivery pipelines.

This is the Integrate activity of Trusted Integration: building security into the information system and projects, with proof that it works.

All case studies

Other case studies

From audit to ISO 27001 certification for a 100‑person IT services company
Governance and architecture delivered together: a 105‑document information security management system, a security architecture rolled out in stages, and ISO 27001 certification achieved.
ISO 27001 certification achieved
Migrating a public financial institution's public key infrastructure
Programme management and integration of a public financial institution's public key infrastructure migration: certificates of 140 applications migrated with no service interruption, on schedule.
140 applications whose certificates were migrated with no service interruption

A similar challenge?

Tell us about your context: an expert will get back to you.

or write directly to trust@blooo.io

Reply within 24 hours
Non-disclosure agreement on request, before any exchange
First call of 30 minutes

Your e-mail is sent from your own mail client: blooo.io stores nothing. We only use your details to reply to you. Privacy policy.