Event-driven architectures come with their own unique security challenges. Yet 60% of new digital solutions are expected to embrace event-driven architectures by 2025. This means that managing asynchronous APIs and event brokers is rapidly becoming crucial for forward-thinking businesses – which is precisely why we shone a spotlight on the topic at a recent Tyk webinar.
Embracing event-driven architectures securely is a top priority, particularly for financial services businesses. Our webinar looked at securely managing asynchronous APIs and event brokers for unified streaming. The key to doing so? Tyk Streams.
The current landscape
According to the 2024 CDW Cybersecurity Research Report, 69% of financial services firms have experienced a data breach within the past five years. That compares to two thirds of all organizations, demonstrating the greater risk of breaches across the financial sector.
As businesses – including those in the financial services industry – move increasingly towards event-driven APIs, the need for a secure solution is paramount.
Security made simple
Tyk Streams simplifies the process of bringing security to your event-driven architecture, using trusted API management principles. It means you can streamline event handling and integrate real-time events, minus the usual complexity. This provides exciting possibilities when it comes to detecting and preventing fraudulent activities in financial transactions in real-time.
Fraudulent activities include using stolen credit card information, unauthorized transactions, identity theft, check fraud, money laundering and more. They can result in financial losses for both the victim and the financial institution. Fraud can also damage customer trust, hurting a company’s reputation. Organizations may also face potential legal and regulatory penalties, as well as litigation and legal costs – all of which distracts time and resources away from daily operations.
Financial services’ environments can differ massively, ranging from mainframes and bespoke legacy systems to services spanning public and private clouds maintained and run by the financial institution, as well as third-party environments run by external partners. The latter can include external services that aggregate fraud data from multiple sources, to provide the financial institution with up-to-date information on known fraud tactics and compromised credentials.
Let’s break this down and look at three real-world challenges that event-driven APIs present, and how you can overcome them with Tyk Streams.
Challenge: Creating special-purpose HTTP API endpoints for events
Creating special-purpose HTTP API endpoints for incoming events can be time-consuming. The problem arises because reacting in real-time to incoming events from external systems isn’t possible. External systems aren’t capable of placing events on message queues directly, they only generate HTTP events (e.g. webhooks). This means you need to create dedicated microservices to handle each of the HTTP events and then enqueue the data for processing.
At least, that’s what it meant before Tyk Streams. Now, you can use a far simpler solution. You can configure an endpoint directly in Tyk Streams that can receive HTTP events and forward them to a job queue or event log. This rapid setup of tailored endpoints enables you to efficiently publish events to brokers. All with Tyk’s robust security baked in.
Challenge: Securing event broker interactions as you scale
Securely managing asynchronous APIs and event brokers is complex as event-driven architectures scale. You need to ensure that you expose everything to other systems, applications or services, but that you do so in a controlled and secure manner.
Complicating matters is the fact that direct interaction with the broker requires a specialized client library and underlying protocol, which the potential consumer application may lacks, meaning it cannot interact with the broker.
Without Tyk Streams, addressing this challenge would involve creating/using language-specific SDKs that encapsulate the complexities of broker protocol and provide developers with a more familiar and higher-level API for interacting with broker. You would also need to create/use wrapper libraries, create custom client-side abstractions and create custom middleware.
That’s a lot of work. Tyk Streams approaches this head on, streamlining security to ensure only trusted sources handle real-time events through Tyk API Gateway.
With Tyk Streams, you can enforce security and governance while delivering easy subscriber compatibility through effortless protocol mediation (such as being able to translate from Avro to JSON). That way, the consumer isn’t forced to develop custom processors.
After using Tyk to apply robust security to your event-driven APIs and make life easier for consumers, you can leverage the power of Tyk’s Developer Portal to enable event discovery and productization. That includes creating products by presenting messages from several different brokers as a unified API. Welcome to seamless scaling.
Challenge: Unifying event streams from multiple sources
Juggling different event sources can be a challenge. You may have some coming from a Kafka broker, while others are posted via HTTP endpoints. Yet your internal system has to receive all of them using WS/SSE, regardless of where they originated.
You could approach this with a custom aggregation service, implementing a transformation layer with middleware or ESB, then adding in consumer-side aggregation. But who has the time and resources to do all of that?
Instead, you can configure Tyk Streams to receive events from both sources and present them to the consumer as a unified stream of JSON events through WS/SSE. You can publish stream access details via the Tyk Developer Portal to enable self-service access, whether for internal teams or external consumers. All while enjoying top-notch security applied via Tyk API Gateway.
See Tyk Streams in action
Want to explore how Tyk Streams tackles key implementation challenges associated with event-driven architectures in greater depth? Then check out our on-demand webinar on securely managing asynchronous APIs and event brokers for unified streaming.
If you prefer a hands-on approach, why not get started with Tyk Streams today?
