AMWA BCP-003 NMOS API Security Recommendations

What do the recommendations do?

• Document best practice and recommendations for securing AMWA NMOS APIs.

Why do they matter?

• A secure control plane is essential.
• These recommendations allow interoperability using widely adopted open technologies.

What are the recommendations?

• BCP-003-01: Secure Communication in NMOS Systems recommends securing API communication using TLS 1.2 or better.
• BCP-003-02: Authorization in NMOS Systems recommends using OAuth 2.0 authorisation using JWT.
  • IS-10 details how to do this.
• BCP-003-03: Certificate Provisioning in NMOS Systems recommends using Enrollment over Secure Transport for certificate provisioning.
• INFO-002 provides guidance for implementers.

Getting started

Start with the recommendation for the security feature being implemented:

• BCP-003-01 for securing API communications with TLS
• BCP-003-02 for API authorization using OAuth 2.0 and JWT
• BCP-003-03 for automated certificate provisioning
• INFO-002 for implementation guidance

There is more information about the NMOS Specifications and their GitHub repos at https://specs.amwa.tv/nmos.