Securing Integrations on Anypoint Platform (Course #securing-integrations)

Programme every line is something you do

5 modules · 15 topics · in course-flow order

1. Module 1

   Encrypt data, config and transport

   Objective. Apply JCE and PGP cryptography plus secure properties so no credential or sensitive payload persists or travels in clear text.

   • Encrypt payloads with the Cryptography (JCE) module using AES-256-GCM and script key rotation per environment
   • Apply PGP encryption and signing to partner file exchanges: key pairs, armored output, recipient key verification
   • Move credentials into secure properties protected by AES-256 and unlocked through runtime-injected encryption keys
2. Module 2

   Federate identity, never fork it

   Objective. Integrate Okta or Ping as the sole identity source so platform access and API calls ride OAuth 2.0/OIDC end to end.

   • Register Anypoint as a relying party of Okta or Ping via OIDC discovery, with SAML fallback for admin console SSO
   • Establish OAuth 2.0 trust between API Manager and the enterprise IdP: authorization code + PKCE for human users
   • Test identity end to end — issuance, 15-minute access-token expiry, refresh and revocation — with automated checks
3. Module 3

   Shrink the network blast radius

   Objective. Design the Anypoint VPC, firewall rules and private links so only intended ports answer and east-west traffic runs mTLS.

   • Design the Anypoint VPC: private CIDR range, internal DNS zones, public exposure reduced to 443 behind load balancers
   • Write firewall allow-lists and fixed egress IPs so partners whitelist exactly your gateways, nothing broader
   • Bridge on-prem systems over VPN with mTLS backed by an internal CA chain — no self-signed certificates in production
4. Module 4

   Compliance evidence by default

   Objective. Instrument masking, logging and access control so HIPAA and PCI-DSS evidence accumulates continuously, not per audit sprint.

   • Map PHI and PAN touchpoints across flows and place masking before every log appender and exception handler
   • Configure auditability: log forwarding to the SIEM, 12-month retention, least-privilege roles separated per environment
   • Score controls against HIPAA and PCI-DSS checkpoints and turn gaps into an owned remediation backlog with due dates
5. Module 5

   Every Input Is Hostile

   Objective. Harden Carelink's APIs against malformed and malicious payloads without breaching the +8 ms per-control budget.

   • Validate inbound JSON/XML against schemas at the gateway; reject early with 400 instead of poisoning downstream flows
   • Neutralize injection vectors: parameterized Database queries, hardened XSLT/XPath, XXE and entity-expansion defenses
   • Cap request size and depth (e.g. 1 MB payload, XML nesting ≤ 10) and negative-test each limit with fuzzed payloads

References & Official Documentation every claim above has a source

Module 1

• Configuring JCE CryptographyMuleSoft Docs
• Configuring PGP CryptographyMuleSoft Docs
• Secure Configuration PropertiesMuleSoft Docs

Module 2

• OpenID Connect Core 1.0Specification
• Configuring OpenID Connect Identity Management in Anypoint PlatformMuleSoft Docs

Module 3

• CloudHub 2.0 Networking ArchitectureMuleSoft Docs

Module 4

• Audit Logging in Anypoint PlatformMuleSoft Docs

Module 5

• XML Threat Protection PolicyMuleSoft Docs

More in API Management & Security