97 Things Every Application Security Professional Should Know

Chapter 43. Application Integration Security

Sausan Yazji

With the rising need for data democratization and data availability, sharing data between systems internally and externally becomes a definite requirement for the success of any business. Understanding and applying the controls needed to protect data is one of the key areas for application security and product security. Those controls should also comply with all data privacy laws and data security regulations, such as GDPR, PiplL, Brazilian General Data Protection Law (LGPD), FedRAMP, SOX, and more.

The following is a list of best practices that should be followed by application developers to reduce data security risks of application integration:

Data classification

All data assets and data attributes should be classified based on their sensitivity and criticality following the classification guidelines provided by your organization. Data classification helps in determining the appropriate security measures to be applied to different types of data.

User persona

All systems should have a user persona built to identify the right level of access to these systems. These personas should have a clear representation of all users, internal and external, including people and automatic system interfaces.

Encryption

Strong encryption techniques should be implemented to protect data at rest, in use, and in transit.

Access ...