What are the best security practices for reviewing your application architecture?

Application layer security involves the following. 1. Web Application Security - use HTTPS instead of HTTP which will address MitM attacks. You may also use a web application firewall (WAF), a security tool designed to detect and block application-layer attacks. 2. API Security - using SOAP, a highly structured message protocol that supports multiple low-level protocols, and REST, a simpler approach to APIs using HTTP/S as the transport protocol, and typically using JSON format for data transfer is advisable. 3. Cloud Native Application Security - use tools for instrument containers, container clusters, and serverless functions, report on security issues, and provide a fast feedback loop for developers.

Recently a new category was added to OWASP top 10 which is Insecure Design . Here one of the mitigation strategies recommended is use of threat modelling. As per OWASP threat modelling is the attackers perspective of the application. To implement a threat model following steps can be done . - Create a DFD between all the services of the application - Perform STRIDE analysis for different personas - Ensure mitigation is provided by applying appropriate security controls by involving all stake holders network, cloud, DBA, Application development and performance. - If there is access to security experts get it reviewed This will go a long way in securing the design and strengthen the application security framework.

Regularly revisiting and updating your security practices is crucial in the ever-evolving landscape of cybersecurity threats. Consider engaging with security experts or third-party security assessments to ensure a comprehensive and unbiased evaluation of your application architecture. Include Regular Security Audits and Reviews like: 1. Conducting regular security audits and reviews of the application architecture. 2. Performing penetration testing and code reviews to identify and address vulnerabilities.

OWASP is a great resource for learning about what the common vulnerabilities are. In a well architected solution some of the cross cutting concerns highlighted in OWASP should be handled at the framework level . Some examples (.Net) - Implement Authentication using HttpHandlers and Authorization using Auth filters - Use of Antixss Middleware to prevent cross site scripting - Fluent validation libraries for input validation - Use of modern ORMs such as entity framework to to reduce SQL Injection occurance These will reduce implement burden and help application be more secure.

Cifrado: EL cifrado de los datos es una de las medidas activas de seguridad. Se debe pensar en dos dimensiones: 1. En reposo: Cifrar los datos en su almacenamiento es crucial. ?Qué sistemas debiese acceder y leer los datos? 2. En transito: Los datos en movimiento pueden viajar por red provada o red pública. Mucha veces no se pueden aislar los datos y deben viajar por red pública. La administración y el compartir de las llaves, certificados etc... son aspectos a definir prontamente.

Cross cutting concerns such as Authentication and Authorization should generally be handled at the application framework level . .NET for example allows you to implement security in the request pipeline using custom pluggable middleware . For protocols such as SAML, OAuth2.0/OpenId Connect use reliable 3rd party libraries so that the overhead of being in sync with the security specifications are offloaded to the libraries.WebAuth is emerging as a serious contender with password less authentication and needs a second look by teams . Overall security is serious business and should be looked after by experts who are aware of the security landscape.

Monitor your application and its infrastructure for performance as well as potentially malicious activity. Employ observability tools that facilitate the creation of dashboards and alerts to notify you of changes in your application's health as well as occurrences of suspicious actions. Implement different types of logging—access logging, error logging, audit logging, etc.—and aggregate those logs in a central location; doing so makes it easier to perform the forensic work that is required to resolve a security incident.

Logging in an application can be made for effective if - SRE teams, who analyze the logs, are involved in the design phase - Implement relevant log levels e.g. Use "Warn" to highlight recoverable transient exceptions - For multithreaded or distributed applications introduce correlation id to help in searching - Archive the logs . Helpful for debugging intermittent issues - Try to find the right balance . Too much or too less logging are both undesirable . - Finally keep refining the logging strategy based on feedback .