Hands-On Security in DevOps

Authorization

The authorization security requirements can refer to the 'OWASP ASVS V4: Access control verification requirements'. For example, the OWASP ASVS self-assessment results showed the need for centralized mechanism protection.

Centralized Mechanism Protection: You should verify that there is a centralized mechanism (including libraries that call external authorization services) for protecting access to each type of protected resource.

To achieve the centralized mechanism protection, the security team decided to introduce the API gateway architecture that was designed so that all the API interfaces were controlled by the API gateway/manager, such as authentication, the API key, monitoring, ACL, logging, and rate limiting. The security ...