What are API’s?
Sometimes applications need to communicate with other programs to extract or process
information. this requires a bolted on custom built bridge that communicates with the main database. This could be a credit card machine updating the Point of sales system which then updates the accounting section or an ecommerce web server sending orders to a logistics software. We often have requests from design agencies that need to push through the final drawing to automatically order all the components through an enterprise purchase ordering system. Protocols like ODBC allow for this sort of connectivity.
At this point we face the same security issues we have discussed previously as you are opening a connection of the main database. If you are bypassing the front entrance to make deliveries to the back door, you still need to maintain the same level of building security. With an API connection you are side stepping the main user credentials and injecting information directly into some of the central tables. To maintain the same level of integrity you need to have other procedures in place.
There are several different protocols that allow you to keep the same level of confidence.
Security approaches to API’s.
There are several different protocols that allow you to keep the same level of confidence.
- Basic authentication through TLS. Has a standard username and password used through Transport Layer Security which is a predecessor to SSL for added protection?
- Oath 1.0 is a cryptographic token using a hash (HMAC-SHA1) which is secure within itself and does not require SSL as the token holds the password and is not communicated across the network.
- Oath 2: TLS handles the encryption, so no signature is required. Specific API to read token or connect over the net.
Consider at the design stage.
When building and deploying these sorts of bespoke systems thought needs to be given to the type of security deployed to prevent a weakness appearing in the system. This is something that should be raised at the very begining of the design stage so security is built in from the ground up.
No point in bolting the front door if the back door is wide open.
If you need assisatnce linking different sosftwares please see our bespoke packages page.
