Ask an Expert: Catching up with Sagara Gunathunga

Sagara Gunathunga, the product lead of the identity and access management (IAM) team at WSO2, has had one amazing career. Starting as a committer to Apache, he most recently led WSO2’s efforts to become GDPR compliant – using WSO2! In this interview, he tells why GDPR must be viewed as an opportunity to build closer relationships with customers and why we must always be curious to innovate.

1. Tell us about your introduction to open source and your journey at WSO2 so far.

Before I joined WSO2, I was a contributor to the Apache Software Foundation. In 2006 I attended various open source events like ApacheCon and I was highly motivated with the concept of contributing towards open source. So the motivation and some initial work towards it ended up with me being a committer in Apache. My first committer-ship was in an Apache project which was part of the Apache web service project and this also paved the way for my access to other projects.

During this time, I got a chance to join WSO2. Initially, I was driving WSO2’s contribution towards Apache. I started working on Axis2 and web services project during my own time and arranged various initiatives to review and mentor their work towards Apache. I also encouraged others to become committers. At present, I am part of the IAM team. It was quite challenging at the start, as none of my previous projects were on security and my knowledge was limited to the security aspects that I’ve been exposed to when working on Apache projects. Services, application development, and governance were my core focus areas back then but I used the knowledge I gathered as the base for career as an “identity guy”. There was lots to learn, going deep into the concepts of IAM – but it’s a been a rewarding journey.

2. What’s the most exciting project you’ve been a part of recently?

One of the main tasks I was assigned to was to work with the privacy standards given the emerging requirements in the EU/UK(GDPR) and Australia. As a technology company, it’s quite a task to keep up with all the privacy standards per country. Given that we have an identity product, it’s a priority for us.

We manage 50 mn+ identities, so in our case we store personal information and the main challenge is “how do we comply ourselves with the standard?” There are many known approaches like “Privacy by Design” but my architectural effort was to make WSO2 Identity Server comply with all the privacy standards, not just GDPR. Then we had to expand that exercise to all other WSO2 projects as all WSO2 products has some sense of personal data.

From a business perspective, WSO2 has data from customers and users that we need to protect and I was a part of that team that handled the privacy compliance/GDPR compliance. Meeting the deadline on the 25th May was daunting, but we did it!

From a business perspective, WSO2 has data from customers and users that we need to protect and I was a part of that team that handled the privacy compliance/GDPR compliance. Meeting the deadline on the 25th May was daunting, but we did it!”

4. You proudest moments at WSO2?

Not just one, but being a part of WSO2 alone is always something to be proud of. The reality is that on the surface, you don’t see a lot of technological innovations in this part of the world (South Asia) due to various reasons. At WSO2 we are able to innovate given these limitations, competing with leading and innovative tech companies around the world. Right now we are known as the largest OSS integration vendor in the world managing 50 mn identities through our identity server, and that’s truly special.

The reality is that on the surface, you don’t see a lot of technological innovations in this part of the world (South Asia) due to various reasons. At WSO2 we are able to innovate given these limitations competing with leading and innovative tech companies around the world.”

5. How do you see GDPR- is it an opportunity or a roadblock?

It depends on your individual perspective. Some think it’s a financial barrier/roadblock but many other people do not share this view. Last month I presented at the GDPR summit and at various meetups where GDPR was discussed. I learnt that most people think it’s an opportunity for them to demonstrate their commitment towards user privacy, how they respect it, and demonstrate the ways in which they have measures in place to provide data protection.

There are positive perceptions – including as an avenue for brand recognition and how you care about your customers. That’s great and I think it’s one of the best ways to prove to your customers that you respect their privacy and you have taken all measures to protect their data. Businesses are now moving away from being solely profit-oriented and to instead building relationships with their customers. That’s the most important aspect, and I believe this is how GDPR should be viewed.

6. Where do you think the future of IAM is heading and where does WSO2 Identity Server fit into that picture?

IAM is a broad term. We’ve noticed that authentication or how you verify the authenticity of a user is an evolving space and is a part of many privacy standards. For example, PSD2 and Open Banking in the UK requires enforcing Strong Customer Authentication (SCA). Financial institutions and banks used to have biometric and token devices for authentication. Yet, given the volume of cyber attacks and privacy violations, it is important that you provide maximum protection for your users. Therefore, authentication needs to become more agile and adaptive.

We’re hoping to provide adaptive authentication with WSO2 Identity Server, which is a very exciting direction for us!

7. WSO2 IS is an open source IAM product how does it stand as opposed to a regular IAM vendor or product?

At WSO2 the GA releases are under Apache 2.0 license which means you are free to do whatever you want.”

Open source is a loaded term. To ensure that what we offer is truly open source, we provide binary distributions that are freely accessible so you are able to customize, redistribute, and access the source code.

There are other “open source” IAM products where you can get the source code and run it, but you cannot run the officially binary release in production. At WSO2 the GA releases are under Apache 2.0 license which means you are free to do whatever you want. You can use the code and run it yourself or extend, customize or even resell. In case you need professional support and help, you can then engage with us.

8. From the point you started at WSO2, you have had an amazing professional journey. Any advice for budding developers or engineers who are beginning their careers?

Be curious. Always.

If you’re curious, the commitment and passion to what you do will come naturally. But if you settle, innovation becomes a battle.”

I have been in the field for more than 10 years and I’m more curious than ever given how much the technology landscape is evolving. If you are planning to have a fruitful career (which I’m sure you are), you have to be curious. I’m paraphrasing one of our greatest losses from recent times, Stephen Hawking, who said the key to his success was being curious. When people grow up they tend to settle with what they know but if you are curious, you grow with knowledge. It’s a guiding principle for me too.

As an identity guy, the key is to learn ideas and concepts thoroughly, so the application of the technology becomes easier. If you’re curious, the commitment and passion to what you do will come naturally. But if you settle, innovation becomes a battle.

Wait, I have to have WHAT in place by May 25, 2018?

We’re THIS close to inventing a drinking game everytime someone says GDPR. It’s quite fascinating to see how much is going to change with this regulation. Just like college, everyone is scrambling to meet the deadline of May 25, although the regulation came into place in 2016 and this is technically a “grace period”. Personal data and privacy are more important than anything else. We bet you now regret the time you clicked on “What does your favorite pizza topping say about your personality?” in exchange for all the personal data you submitted at the time – without so much as a second thought.

GDPR is going to change everything and place user consent on top, which is great. But if you’re an enterprise dealing with data of anyone living in the EU, you’ve got a lot to do. We put together a few questions we encountered, let us know if these help!

What exactly do I need to have in place to be in compliance with GDPR?

In this article we’ve listed 7 pragmatic steps you can take depending on where you are on the journey. Here’s a quick look of what they are:

  1. Build awareness around GDPR: in-depth awareness and building in-house expertise on all aspects of the regulation.
  2. Analyze if you’re company is affected: if you’re dealing with PII (personally identifiable information) of “residents” in the EU, then your company must deal with GDPR.
  3. Review the impact of your current data: thoroughly evaluate if all data collection methods used the necessary consent and furthermore, if you are able to demonstrate proof of consent.
  4. Review your systems and processes: review data storage and access mechanisms, and specifically decide if a data processing impact assessment (DPIA) must be carried out. It’s recommended you get a professional’s help with this.
  5. Implement necessary safeguards: adjusting business processes, upgrading software/storage systems, training for staff members, and introducing auditing systems.
  6. Appoint a DPO/EU representative: to address GDPR related matters within the organization such as advising staff members on data protection procedures, monitor compliance, and act as the point of contact for supervisory authorities when liaising with them.
  7. Revise your documents and policies: thorough review of all documents and policies of the organization such as websites, terms and conditions, privacy policies, and social channels.

I’m a company in Milwaukee/Bikini bottom [or insert wherever you’re from]. Should I concern myself with GDPR and if so, to what extent?

As long as you’re dealing with PII – Personally identifiable information of those living in the EU, GDPR affects you. From a small retail company to a large financial organization, as long as you deal with Karen who lives in Norway, your company must be compliant with the law. You can find a link to all the laws here.

Should we extract and provide all of the customer data if requested by the customer? All the data or just the personal data like name, address, email, etc? Should we also extract the old orders that we have stored in the system?

Yes. Absolutely. There’s a right on “data portability”, meaning there should be a mechanism to access all the details if an end user wants to. Remember that with GDPR, it’s all about the customer and their rights must be given the utmost priority.

All data or personal data?

All the data. Whatever that’s stored, for whichever reason, should be made available if the user requests. The key term here is, PII – personally identifiable information. And if individuals want their data erased, you must adhere to it too.

Does WSO2 provide consultancy to make an organization GDPR compliant?

If it involves technology such as using WSO2 products, yes, we can provide consultancy to help your organization. Successful GDPR compliance require changes in people, process, and technology aspects. WSO2’s suite of technologies can be used to make your organization GDPR compliant. To reiterate, if you’re looking for consultancy from a technology perspective and if it concerns our products and technology, yes, we provide consultancy based on that.

How can you help me speed up the process? What tools do you provide? / How exactly are you helping to implement GDPR compliance?

WSO2 provides a stack that’s fully GDPR compliant, this includes the WSO2 Identity Server, Enterprise Integrator, API Management, and the open banking solution. This article will help you understand what you need to look for when searching for a GDPR compliant IAM product and how it helps to optimize your GDPR strategy. WSO2’s open source Identity Server in particular can help you save time and cost involved given the consent management and the privacy tool kit in our latest release. Get in touch with us if you’re building your own solution or if you have any questions. What our products will essentially do is, help you build a GDPR compliant solution. You can find out more here.

Should we perform pseudonymization of the database in order to protect our data?

If by our you mean your customer, yes. Performing pseudonymization is in fact a best practice. So yes, by all means. If the end user requested you to erase their data, you should comply according to the “right to be forgotten” rule. Having a proper IAM solution in place to do this would be helpful too. We also have a privacy toolkit that will enable you to do that, learn more here.

We are a company who is doing business with EU customers. We maintain their data in our CRM, do we fall under GDPR? In this case how can we collect consent of customer of CRM?

Yes, you are processing, collecting details of EU residents, therefore you are affected by GDPR.

What if legacy apps are involved?

GDPR is focused on the end user, doesn’t matter how your business does things, whether it is cutting edge or not. So even if it’s legacy apps you work with, you must have processes in place that will bridge between the applications and the regulation.

Are there examples of what other companies have done to become GDPR compliant?

It might be not explicit but if you do a quick search or pay attention to your inbox, a lot of other companies might be already sending you mails saying updating their privacy policies meaning that’s them taking steps to become compliant. And that’s just one part of ensuring explicit consent.

Did we miss a question? Get in touch with us and we’ll get back to you!

Four Warning Signs an Integration Wall is Approaching

The Integration and API Management markets are growing, expanding in both popularity and use. Enterprise App integration will surpass $33b by 2020, and other markets like iPaaS and Data Integration are growing at double-digit CAGRs. Enablers, such as containers and serverless technologies are only accelerating the move toward increased disaggregation of applications.

All seems rosy. And it mostly is.

But with the explosive growth of APIs and endpoints, traditional centralized tools like ESBs will become unsuitable, and simple low-code snap-together tools won’t scale to address the broader scope. We’re potentially about to hit an “integration wall” at high speed.

Consider the following four warning signs – some technical, some process – that I find are beginning to plague the integration market:

1. Waterfall Development for integration is hitting a wall.

Although most code development has shifted to an Agile Development model, the same can’t be said for Integration tools. As the quantity and diversity of endpoints increases, and as Integration projects become more diverse and complex, use of the waterfall model is beginning to slow down integration projects. And with a future where there will be billions of Integratable endpoints, it’s obvious that an Agile Development model for integration will need to become the norm.

2. Existing tools and programming languages aren’t optimized for Integration-at-scale.

Enterprises that currently use low-code, snap-together, centralized integration technologies (including iPaaS) will not be optimized for orchestrating, integrating, observing and governing the expansion of constantly-changing endpoints. Nor are traditional centralized approaches (think: EDI and older ESBs) prepared to handle increasing endpoint scale or diversity. Many of these existing tools are well-adapted for Line-of-Business or Citizen Integrators of relatively small-scale implementations but are far from well adapted for more complex integration-at-scale projects.

3. Current programming languages are not optimized for Integration.

With languages like Java/Spring or JavaScript/Node, developers can engineer flow, but must take responsibility for solving the hard problems of integration. With these languages, developers have to write their own integration logic or use bolt-on frameworks. Clearly a new programming paradigm will be needed long term.

4. The Exploding Endpoint Problem is very real.

As I referenced above, IT is ill-prepared to address the oncoming wave of service disaggregation, the diverse types of APIs, differing sources of service endpoints, challenges from Big Data, and multiple approaches to serverless IT. The industry is about to hit a scale and diversity wall. To wit,

  • 917 apps in use per enterprise (Netscope, 2016)
  • 893-1206 average cloud services used per employee (Kleiner Perkins, April 2017)
  • 19,000 APIs as-of January 2018 (Programmable Web, 2018)

And if you don’t believe those numbers, Matt Eastwood of IDC recently pointed out that the number of containerized services has expanding well beyond where VMs ever were. Yep, billions of programmable endpoints aren’t kid’s stuff.

Where does this leave us?

A new approach to addressing the future of integrating thousands-or millions-of endpoints could lie in a new programming language, Ballerina.

Ballerina is a simple programming language whose syntax and runtime have been optimized for the hard problems of integration. Its focus is integration – bringing concepts, ideas and tools of distributed system integration into the language. Based on the concepts of interactions within sequence diagrams, Ballerina has built-in support for common integration patterns and connectors, including distributed transactions, compensation and circuit breakers. And it supports JSON and XML, making it simple and effective to build robust integration across distributed network endpoints.

So, watch this space for future developments. And in the meantime, beware of the approaching wall.