Why software layers are a pre-requisite for a scalable application security model for moving to distributed architecture?

The speed of digitalization creates the urge and need to be ready for the next phase of execution which will constitute of heterogenous integration flows. Decoupling the architecture from static dependencies is becoming the most important characteristic for the survival of the organization. The decoupling creates the flexibility to replace applications or legacy systems, but also to scale to new one with even a faster pace and to monitor and guarantee the overall security. One aspect which is a beautiful practice is by embracing software layering. The number of layers is not important, but the architecture principles per layer is really important. The principles for application layers are:

• ?A Centralised Integration layer to decouple the service consumers and service providers. The integration layer must be responsible for message routing, transformation and mediation.
• Multiple consumer layers which are equivalent to the demand for consumable services and more often than not have a user interface with presentation views. No databases must be hosted in consumer layer and no two consumers could have a data flow.
• Multiple provider layer is responsible for delivering services which constitute of heavy lifting business logic, statefulness and persistence . Any provider service must be exposed as services in the integration layer.

Consumer Layer

In 9 out of 10 cases, a consumer layer hosts consumer applications that creates business value with personalized and engaging interaction experiences. These interactions can be for a single screen type use or can involve multiple viewports and devices to present the functionality in fit-for-purpose HMI.

While consumer applications are responsible to service functional needs, from non functional aspects the consumer layer also increase availability and resilience by coping for failures to backend systems. An important element for any consumer application is to gracefully handle exceptions, while decreasing response times by using in-memory caching and content delivery networks functionality.

The consuming layer application is meant to be with a faster time to market potential. ?The consumer layer application must not hold any persistence.

Integration Layer

The Integration Layer is the decoupling layer and must compose of either one or polyglot technologies that must be the only gateway for exchange of data flows between any service consumer to any service provider. The integration layer must also provide a minimal set of capabilities to let service providers and service consumers interact.?

In cases when the service provider are outside the organisation then the integration layer can also hold the data in a persistence storage.

The integration layer provides standardised ways to message routing, transformation and mediation in order to expose the enterprise services.

The integration layer can safeguard the quality, assure the overall architecture, and apply security controls.

An integration layer must be mapped to a separate security zone and controls implemented. As an example an integration layer must use client certificates to safeguard the integrity and confidentiality for the provider applications.

The interface layer is only responsible for interfaces and hence can be a place to standardize the standards. In today’s world SOAP (XML), REST and JSON standards are the most common.

As Integration Layer is not an implementation layer, no heavy business logic should reside in the integration layer.

In order to protect the unintended flow of information to consumers, the integration layer is also responsible for security controls like access control list and encryption in addition to other basic requirements like routing and throttling (rate limiting). But, based on the business need these security controls can be formulated.

Integration layer can also act as a stitching layer for legacy consuming applications that require any form of integration or transformation.

Provider Layer

Provider layer applications provide data and business functionality.

A provider layer application must shield the data and business logic as these are the core of the existence for any business. No direct access to the databases much be provided by the provider layer to the integration layer, rather the databases must be wrapped by reusable services.

Based on the need of business, the provider layer component could host a database for persistence. In today’s DevOps world, established open source database solutions prevent a potentially costly vendor lock-in and allow to benefit from the input of the open source community. A proliferation of ?open source databases are available in the market with SQL and NoSQL flavours like MongoDB, Cassandra.

The provider application must be based on the principle of reusability and must be atomic for the functionality it provides.

Provider services which then depend on other provider services can introduce static dependencies which needs to be avoided and will therefore increase the complexity of the overall architecture, hence better avoided.

Linking software layers to application security

The above introduction of software layers can make it much easier to apply pattern based security ,following principles like defense in depth and complete mediation, and still keeps security easy and scalable.

For any organisation which is taking the leap to distributed architecture, the investments to put software layers in place and leveraging the pattern-based security would reap a lot of benefits and improve the lifetime and agility of the organisation.