Cyber Security

Definition

Backend is the part of an application that runs behind the scenes and is responsible for handling business logic, data storage, and communication with external systems.

It contains the core source code of the solution that realize the functionality. 

Potential Attacks

1. Brute Force: Guessing passwords repeatedly, you should have Strong passwords, login rate limits, and account lockout policies

2. Fixation: It’s an attack that hacker can steal your session ID and use it to execute HTTP requests 

• Use HTTPOnly : cookie is not accessible via JavaScript (document.cookie)  

• Use short session lifetimes

• Bind session to IP/User-Agent (optional) 

• Disable URL-based session tracking 

3. XSS: Cross-Site Scripting — injecting scripts into websites, you should have Input validation, output encoding, Content Security Policy (CSP)

4. DDoS

• Distributed Denial of Service — overwhelms servers

• You should have WAF, CDN, rate-limiting, DDoS mitigation tools

5. Brute-Force: Attacker trying many passwords or passphrases with the hope of eventually guessing correctly. Can be resolved by delaying the repetitive trials and blocking the incoming IPs from IIS 

6. SQLi: SQL Injection — inserting malicious queries into databases, you should have you should have Prepared statements, ORM frameworks, input sanitization

7. SQL Injection : Injecting malicious SQL queries

Use PreparedStatement or ORM (e.g. Hibernate)

8. Deserialization Attack : 

• Running malicious code via deserialized Java objects

• Use safe libraries like Jackson with strict type checks

9. Authentication Bypass

• Gaining unauthorized access

• Validate JWTs, session tokens, and user roles strictly

10. Path Traversal: 

• Accessing files outside allowed directories

• Sanitize and validate file paths

11. RCE (Remote Code Execution)

• Executing commands remotely on the server

• Avoid Runtime.exec(); validate all inputs

12. XSS via Server-side Templates

• Injecting scripts into server-rendered HTML

• Escape output and sanitize user input

13. CSRF (Cross-Site Request Forgery)

• Forging requests on behalf of a logged-in user

• Use CSRF tokens and SameSite cookies

14. Broken Access Control

• Unauthorized access to resources or operations

• Enforce RBAC (Role-Based Access Control) at every layer

9 Insecure Logging (Info Leak)

• Logging sensitive information by mistake

• Avoid logging passwords, tokens, or PII

Security Approach

1. Authentication:

• Never use basic authentication

• Strong Authentication (OAuth 2.0, OpenID Connect, JWT)

  • • Encrypted

    • Better as it has an Expiry

    • Standard

    • Has claims and more authorization

• MFA: Multi-factor authentication, authentication at first login

• Implement Role-Based Access Control (RBAC) to prevent access to improper services

• Continuous authentication on sensitive activities

2. Secrets

• Use secret keys

• Use a secret key for each channel

• Auto-Rotate secret keys

• Never be exposed to FE

3. Configuration

4. Pipeline

• Integrate SAST tools at the pipeline, like SonarCloud

5. Automated Security Testing  (OWASP ZAP, Burp Suite )

6. Communication

• Encrypt payload {data: EncryptedPayLoad}

• Add a filter at the gateway level to decrypt

7. Configure and implement CSRF tokens 

8. Add HSTS and XSS headers at the backend

9. API Architecture

• Encrypt payload in Post methods

• Use Post methods instead of Get for get methods in order to be able to encrypt the payload, as data exposed in the URL leads risk of leaks 

• Reduce touch surface

• Prevent data crawling

• API versioning deprecation model for old APIs

10. Performance and Load Testing:

• Denial of services

Business Requirements Focus

1. Payment:

2. Ownership changes

3. Assets transfer

4. Data crawling

5. Sensitive data exposure

6. Notifications

7. Financial reports