While several start-ups have demonstrated the potential of tapping the long-tail developer community (look at examples like Twillio, Tapjoy, Stripe and Braintree) the number of enterprises that have seen similar success is less clear (Amazon Web Services is an obvious counterpoint).

One reason for this is simple – enterprises have conflicting interests and are almost never set up to successfully service these communities at all costs. This doesn’t negate the value of fostering relations with the long tail. External developer programs make sense for enterprises and should be viewed as strategic, even if the immediate payback is not obvious. With the advent of the app economy, developers represent as important a channel to market as traditional distributors.

However, often overlooked in the race to launch an external API developer program is the potential benefit of an internal API developer program. Enterprises have, in many cases, thousands if not tens of thousands of developers internally. Often, internal developers are supplemented by contractors. Enabling all these developers to become mobile innovators through APIs holds out the promise of delivering the kinds of leaps in productivity, agility and experimentation that will benefit any enterprise.

To make internal developers innovation leaders, it is essential to provide a canonical way for these developers to access all corporate application and data resources. An API abstraction layer delivered through an ESB or API Gateway simplifies the process of API-ifying information resources and consuming APIs.

But that’s not enough because developers will still need a central directory or registry of APIs to discover which APIs are available and what these APIs do. In the WS*-centered Web services world of SOAP-oriented APIs, which most enterprises still inhabit, this function would be handled by a UDDI directory and some accompanying “repository” software. But in the API world, no exact analog has existed – in part because every API Management vendor has insisted on provisioning its API portal in the public cloud only, a place most enterprises are reluctant to post APIs aimed at internal developers. Layer 7 aims to bridge the gap.

The Layer7 API Portal is the first turnkey API developer portal that can be deployed 100% inside a customer’s private cloud, datacenter or IT facility. Moreover, it is the first developer portal to offer simultaneous support for both RESTful APIs and SOAPy APIs, meaning it can act as a substitute for existing UDDI-style services while providing a pathway to newer RESTful services. Best of all, it can be implemented with different grades of privacy so that the same API Portal can support internal, contract and external developers at the same time – with each group seeing only what the enterprise chooses.

By centralizing where APIs are presented for discovery and consumption by developers, enterprises can make it easier for their service innovators to build new capabilities and mash multiple existing services into newer composite business functions. They can introduce new apps and applications faster. They can respond to change faster. They can build and iterate on new mobile apps in less time, with less error. It all comes down to the API presentation layer.

With the steady decline of the PC business, Intel clearly has to look elsewhere for its future growth. The cloud datacenter is not a bad place to start. Cloud server farms clearly consume lots of processors. Still, servers powering Web sites can operate fine without APIs, thank-you. But servers powering mobile is a different story. Mobile apps (whether HTML5, hybrid or native) get the data that makes them valuable from applications that reside in datacenters. And APIs are the key to letting cloud data be sharable with mobile apps.

Clearly, app-centric “smart” phones and tablets and TVs and cars and watches and glasses are changing the way we go about our daily business. And APIs will power these smart devices by giving enterprise and Internet companies a way to push their data to apps. That hope of bridging the cloud with mobile is probably why Intel has kept its current API product intact. Mashery broadens Intel’s API scope by providing a way to not only share data with mobile apps but now also the developers that build these apps. But will this plan succeed?

If it does, it will take quite a bit of time. The reality today remains that Intel – even despite the semi-recent McAfee acquisition – is not oriented to selling software or even cloud services into the enterprise. It’s missing the sales force. It’s missing the history. And in many ways, it’s missing the rest of the software stack it needs to power the networking, infrastructure and application parts that underpin data in the cloud. That will make selling an API platform comprising a legacy API Gateway and newfound API developer platform a harder proposition. It’s kind of out there alone.

Another obvious roadblock to making the Mashery acquisition successful is that Intel’s existing API Gateway and the Mashery API service are designed for two very different audiences inside the enterprise, with un-reconcilable needs. The API Gateway is designed for an IT department that wants to run its API Management layer in its own datacenter. The Mashery offering is designed for a non-IT buyer (a mobile program manager, say) who wants to run everything in someone else’s cloud.

One is technical, the other is not. One is on-premise, the other is SaaS. One sells traditional software licenses, the other pure subscription. The first aims to address internal and external API integration challenges. The latter is only really concerned with the challenge of acquiring external API developers (though Mashery would probably protest this point).

Will the two be a marriage made in heaven? Given that the Intel/Mashery partnership is already a year old and that Mashery was barely able to grow its revenues in that time, the likelihood seems remote. But who knows for sure? And anyway, Intel has probably not bought Mashery for its $12M in revenue but for its long-term potential as a pathway to mobile.

Arguing about “who owns the customer” or that “our customers expect a certain level of service” is so far behind the curve it’s laughable and service providers simply can’t derail innovation by imposing expensive and exhausting procedures. But to be clear, this is a competitive market and service providers will lose more ground unless a contemporary model for collaboration is adopted.

The Amdocs OTT Monetization Solution allows service providers to leverage network assets to create value for OTT providers and monetize service collaborations. Layer 7’s API Management Suite of products defines a new methodology for telco APIs, bringing interface, identity and developer management together in a cohesive platform that can serve mobile, enterprise and internal applications equally. Layer 7 and Amdocs will be working together to deliver a best-of-breed solution, addressing the full lifecycle of telco API needs.

This new approach will yield great results. We have already seen Spotify implement a flat-rate service with T-Mobile Germany. Also, network-enhanced enterprise tools (e.g. AT&T Business Services) are becoming commonplace as LTE networks expand. APIs are the fabric that ensures these collaborations are possible and can be brought to market quickly and efficiently.

So, are all these news stories about trillion-dollar business opportunities in IoT just stories? Most likely the truth is that no one has yet figured out how to make money with IoT but everyone wants to make sure that they are at least seen to have a plan – just in case it does take off. As if to prove this point, ZDnet made a very different assessment of M2M at MWC. I went into more detail on these issues during my recent interview with DeviceLine Radio.

Personally, I firmly believe in the disruptive potential for IoT. It will be disruptive because it will break down the separation between manufacturing industry on one side and IT industry on the other. Manufacturing companies like GE, Bosch and Siemens will increasingly see IT – and Big Data in particular – as a core competency they will need to master in order to sustain a competitive advantage. Simply outsourcing to IT companies will no longer suffice.

We can clearly see this developing as, for example, Bosch is readying its Internet Application Platform and GE is aggressively building out its Silicon Valley presence. At the same time IT companies are trying to position themselves as natural partners for manufactures or as integrators of smart things. Credit has to go to IBM, which has been pushing this trend as part of its Smarter Planet campaign, way ahead of other players.

Meanwhile, telecom carriers are also struggling to decide what IoT will mean for them. It’s easy to see how telecom’s core business can be seen as just a set of “dumb” data pipes. The challenge for this sector will be figuring out how to leverage its considerable assets, like cellular networks, global roaming and integrated billing, to create M2M business platforms. I think that Big Data analytics on the data piped through their network will have to be part of it.

The BYOD movement seems to be changing the hardware landscape permanently and it’s showing no signs of slowing down. Naturally, this presents both opportunities and challenges. Security managers within the enterprise have less control then ever. “Anywhere access” has blurred the lines of what used to be called the corporate network perimeter.

So what are CIOs and CTOs specifically worried about with BYOD? Well for one, mobile devices can easily go missing while containing sensitive data and employers often cannot even assess the impact of data security breaches from compromised devices. But locking down employees’ personal devices is generally not an option.

So how can enterprises re-assert control over their data assets while still allowing employees to use their own smartphones as they choose? We’ll be discussing this and other questions during out live, interactive Q&A. So, be sure to clear your calendar and join in the discussion on March 26 at 9am PST.

Here’s How to Join the Discussion
Make sure you click Add to Calendar to get the event details and a reminder in your calendar. Then, on the day of the event, click here to join:

• layer7.com/live

To ask questions, you can:

• Tweet using the tag #Layer7Live
• Email techtalk@layer7.com
• Post a message on Facebook

Still, with Web and mobile technologies creating competition from outside the telco sector, carriers need ways to quickly adapt to technological change – and APIs provide the perfect solution. APIs allow telcos to open up their services for efficient repurposing by internal developers and partner organizations, creating opportunities for being quick to market with innovative new offerings.

Layer 7’s latest eBook 5 Ways Every Telco Can Benefit from APIs provides an overview of how carriers can realize these opportunities. If you visited the Layer 7 booth at MWC, you might have picked up the print version of this handsome document. If not, don’t hesitate to download the electronic version.

Smart phones are ubiquitous, social networks are the norm and we are connected to applications on our devices all the time. We love applications like Instagram, Twitter, Evertnote and Snapchat. But we don’t like signing in and out of each of these applications across networks or devices. It’s awkward and cumbersome and we’re often doing it while on the go or commuting, with only one hand to use while tapping in our passwords. Besides, who wants to remember all those passwords anyway? And it’s not safe to use the same one for every application.

This is the major downside of using all these great new mobile applications. Most of us would gladly invite a scenario where we’d only need to log in once to access multiple applications. There’s social login – but is it safe and is our privacy secure? Remember what happened to Burger King’s Twitter account? Enter Single-Sign-On & OAuth for Mobile Applications.

On Tuesday Feb 26, we’ll be hosting a live interactive Tech Talk on security and Single Sign-On (SSO) for mobile applications. And I’m excited to welcome back Layer 7′s Chief Architect and resident OAuth expert Francois Lascelles. He’ll discuss how to provide SSO for mobile applications, without compromising the security of the apps or the APIs that power them. Francois will also be taking your questions throughout the Tech Talk. So, this will be a great opportunity to get answers to your questions about your own applications and the security that surrounds them.

Click here to get the event details and a reminder in your calendar.

On the day of the event, click here to join:

•   layer7.com/live

Submit your questions:

• Tweet using the tag #Layer7Live
• Email techtalk@layer7.com
• Post a message on Facebook

As usual, we’re likely to see a very broad sweep across various areas of telco innovation and mobile strategy but there are some fundamental questions facing the community and these will dominate many conference sessions, seminars and exhibits:

1. Connected Living
   As the Internet of Things gains momentum, how can the service provider community deliver the kind of enriched connectivity the broader ecosystem increasingly demands?
   —
2. Mobile Commerce
   For years, mobile has been a key banking and commerce tool for certain markets. With the rise of NFC (near field communication) and success stories like the Starbucks mobile payment app, will mobile become the preferred payment instrument for us all?
   —
3. Next-Generation Communications
   The world of communications moves quickly – too quickly even for service providers at times, with the runaway success of technologies of iMessage, WhatsApp and – next – WebRTC. In this ever-innovating world of mobile communications, can service providers regain some ground and demonstrate their value?

Layer 7 has answers to these questions and will be at MWC, demonstrating a variety of solutions that can help service providers address the challenges ahead. For example:

1. We have been collaborating with AT&T and have planned an M2M solution that will capture anonymous information about visitors as they move around the exhibition halls. This information will be presented as intelligent APIs via the Layer 7 platform.
   —
2. Security and authentication are very familiar terms to Layer 7 and we’ll be showing how mobile payments can be easily and securely integrated with a mobile app without compromising the user experience.
   —
3. “Communications as a Service” opens many opportunities for service providers and the new partnership between Layer 7 and Voxeo Labs will show how easy it can be to capitalize on these opportunities.

Come and meet the team at booth 8.1A47 in the App Planet zone or email info@layer7.com to schedule a meeting. See you there!

However, the article clearly misstates the capabilities of an API Management solution founded on an API Gateway. I am going to assume that the author only had exposure to API Gateways second hand or through a competitor of Layer 7. Here are the misconceptions propagated by the article, along with some corrections:

“These API gateway services can be prohibitively expensive for small-scale applications…  ‘You can replicate the API gateway by creating a set of proxy services in their data center in an application container in their DMZ.’”

Trying to create your own homegrown set of proxy services is expensive and risky. The Layer 7 API Management Suite’s Gateway technology includes 10 years of functional enrichment and optimization. Such robustness cannot be hacked together on the fly.

“An API gateway still runs on the notion that you have to be careful not to block what might be legitimate traffic. So that could cause some openness – some attacks might slip through using Web application firewall evasion techniques.”

An API Gateway is not a typical web application firewall. Layer 7’s Gateway (evident in the company’s name) has full access to all layers of the data stream and can apply protections at any of these layers.

“Of course, if they can retrieve a developer key, attackers can slip past API gateways until their activity is noticed…  That’s why it’s important to encrypt any data stored on the device, including developer keys[.]”

API keys are not treated as security tokens by an API Gateway. The term “API key” is equivalent to a “database key”, not a security key, so don’t mistake it for a robust access control mechanism. It is mainly an identification mechanism. It is a gross misunderstanding to equate API developer keys with a standard access control cryptographic mechanism like PKI public/private keys.

“But keys have other ways of getting into the wild besides breaking into the application code.”

Right, so you should not rely on these keys for access control. The good news is that the API Management Suite’s Portal/Gateway combination makes it easier to revoke and reissue developer keys.

“For enterprise applications, an API gateway isn’t always enough – users need to get access to content on servers inside the firewall that may not be easily exposed through a Web API.”

And this is where the API Gateway really adds value. The Layer 7 API Management Suite allows companies to turn those backend interfaces from their native protocols into REST APIs or other formats that are friendly to mobile devices.

So, thanks to Ars Technica for flagging up this important aspect of mobile security and here’s hoping that this corrected information is included in the next article.

The good old measure of progress, mobile subscriber penetration, doesn’t cut it anymore. Now, the real measure is how many other connected devices a subscriber uses – iPads, Smart TVs and even fridges (who wouldn’t want a Galaxy Kitchen or an iPad Mini?) This is just the start of a revolution in connectivity, which will make it easier than ever to consume information and equally easy to emit a lot of information, often through social networks.

But there is another aspect to this – not only will you be able to post your own information but there will be all kinds of devices that can “sense” information about you. I expect to see a lot of this at MWC – sensors and cameras scattered around the floor, mapping passers-by to Facebook profiles and other personal information. Obviously, the capturing and cross pollination of this information raises all sorts of privacy issues.

It will also have a number of significant ramifications for mobile developers. First, there will be a new wealth of information available in the form of Web service APIs, as most of the data will be stored in cloud. The sheer scale of this new information-rich world will require apps to leverage cloud processing capabilities in order to be truly effective. This will create opportunities for enterprises to rethink their mobile architectures.

Second, mobile developers will need to use standard protocols for authentication and authorization. OAuth and OpenID Connect are key standards for protecting resources and allowing app users to authorize apps to leverage their information. Will these standards address all the privacy issues mentioned above? Probably not but they will make it a good deal easier for app developers to comply with privacy laws and regulations.

Third, the most successful app developers will be those that are able to provide a seamless user experience (UX) across multiple devices. This is because the end user of the near future will naturally expect all apps to know about other sessions that user had with an app across all of his or her many smart devices. Devs will therefore want to migrate sessions across devices, to bolster the UX.

If you’re going to MWC, come and say hello to the Layer 7 team. We will be located in the App Planet area Hall: 8.1 Booth: A47. I hope to see you there!