应如何保护* Intranet * REST API调用？

Question

Here's the scenario. A user outside the firewall takes a UI action in the browser. The browser makes a REST API call to system A (and is authenticated and authorized at or near the point of entry past the firewall). System A (inside the corporate network firewall) makes a REST API call to system B (also inside the corporate network firewall).

How much security is sufficient for the "internal" REST API call from system A to system B, considering that authentication and authorization already occurred at the entry point to system A?

Answer 1

Like anything else, it depends on the sensitivity of the data involved, and the level of risk vs. how much the organization wants to spend.

Usually, using strongish SSL (https connection) is considered good enough. You may need to include an authentication mechanism, if you need to audit which System A submitted the request -- for this you could use any of: client cert, HTTP Auth (basic or digest), username/password as request parameters, IP-address mapping, API keys etc.

For system->system calls, if the client system doesn't change (ie not a web browser or actively changing clientbase), you don't even need "real" certificates -- a strong self signed certificate is good enough, and because you distribute it to your client systems, they all know the source is valid without a 3rd party signature.

If the data are very sensitive, you might dedicate connections between the client(s) and server, either using a physically separated network, or VPN.

Answer 2

For starters, if both are in a private subnet, then already thats a decent amount of security. If you have any reason to believe outside people can connect to that API, then go ahead an implement a secure API key that is checked before any call is allowed to execute.

Answer 3

The new (2018+) best practice would be to secure the internal services in exactly the same way that you'd secure external services.

Why?

Because upwards of 60% of data disclosures come from internal sources. Internal systems are just as likely to breach data as external systems, so you need to have the same controls that you would for external systems.