Implementing Security Patterns
1. Encrypting Data in Transit
| Aspect | Detail |
|---|---|
| Protocol | TLS 1.3 (preferred), TLS 1.2 minimum |
| Cipher suites | Modern AEAD (AES-GCM, ChaCha20-Poly1305) |
| HSTS | Strict-Transport-Security: max-age=63072000; includeSubDomains; preload |
| In-cluster | mTLS via service mesh |
| Disable | SSLv3, TLS 1.0/1.1 DEPRECATED |
2. Encrypting Data at Rest
| Layer | Mechanism |
|---|---|
| Disk | LUKS, EBS encryption |
| Database | TDE (Postgres pgcrypto, MySQL TDE) |
| Field-level | App encrypts before insert (sensitive PII) |
| Backups | Encrypted snapshots |
| Key mgmt | KMS (AWS, GCP, Azure, Vault Transit) |
3. Implementing Input Validation
| Rule | Detail |
|---|---|
| Allow-list | Define valid; reject rest |
| Schema | JSON Schema, OpenAPI, Bean Validation |
| Type/range/length | Strict bounds |
| Canonicalization | Normalize before validation (Unicode NFC) |
| At boundary | Validate in API layer + domain |
4. Preventing SQL Injection
| Technique | Detail |
|---|---|
| Parameterized queries | Always use placeholders |
| ORM | JPA/Hibernate, Prisma, SQLAlchemy |
| Stored procedures | With typed params |
| Least privilege DB user | No DROP/TRUNCATE in app role |
| Avoid | String concatenation; dynamic SQL |
5. Preventing XSS Attacks
| Defense | Detail |
|---|---|
| Context-aware encoding | HTML, attr, JS, URL contexts |
| CSP | default-src 'self'; script-src 'self' |
| Sanitize HTML | DOMPurify, OWASP Java HTML Sanitizer |
| HttpOnly cookies | Prevent JS token theft |
| Avoid | innerHTML, eval |
6. Implementing CSRF Protection
| Defense | Detail |
|---|---|
| SameSite cookies | SameSite=Lax default; Strict for auth |
| CSRF tokens | Per-session synchronizer token |
| Double-submit | Token in cookie + header |
| Custom header check | Require X-Requested-With |
| Bearer tokens | Not vulnerable (no auto-send) |
7. Using Security Headers
| Header | Recommended Value |
|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
| Content-Security-Policy | App-specific; minimum default-src 'self' |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | DENY (or CSP frame-ancestors) |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | Restrict camera, mic, geo |
8. Implementing Secrets Management
| Practice | Detail |
|---|---|
| Centralized vault | Vault, Secrets Manager |
| Dynamic secrets | Vault DB engines (auto-rotated) |
| Workload identity | IRSA, Workload Identity, Pod Identity |
| Rotation | Automated; ≤ 90 days |
| Audit | Who accessed which secret when |
9. Handling Sensitive Data
| Practice | Detail |
|---|---|
| Classification | Public / Internal / Confidential / Restricted |
| Tokenization | Replace PII with tokens; vault holds map |
| Masking | Logs, UIs show ****1234 |
| Minimization | Don't store what you don't need |
| Right to erasure | GDPR Art. 17 workflows |
10. Implementing Audit Logging
| Field | Detail |
|---|---|
| who | User/service ID |
| what | Action + resource ID |
| when | UTC timestamp (ms) |
| where | Source IP, service |
| outcome | Success / failure + reason |
| Tamper-evident | Append-only, signed, separate store |
11. Using API Security Standards
| Standard | Detail |
|---|---|
| OWASP API Security Top 10 (2023) | BOLA, Broken Auth, BOPLA, etc. |
| FAPI 2.0 | Financial-grade OAuth profile |
| OpenID Connect | Identity layer over OAuth 2.0 |
| JWT Best Current Practices | RFC 8725 |
12. Implementing Zero Trust Architecture
| Principle | Detail |
|---|---|
| Never trust, always verify | Auth every call (no perimeter trust) |
| Strong identity | SPIFFE/mTLS for services; OIDC for users |
| Least privilege | Per-action authorization |
| Microsegmentation | NetworkPolicies, mesh AuthZ |
| Continuous verification | Risk-based, device posture |