In this lesson,
we will learn about application layer security.
Application layer security involves protecting applications
and their data from unauthorized access and attacks.
It works at the highest layer of the OSI model,
the application layer,
and it involves the implementation
of both Application Programming Interface or API gateways
and Web Application Firewalls or WAFs.
Let's learn more about API gateways and WAFs.
First we have API gateways.
Let's compare an API gateway
to something we're familiar with,
a toll booth on the highway.
When driving on the highway,
you may pass through toll booths
that control the flow of traffic,
ensuring that only authorized vehicles,
those that have paid or have a pass can continue.
Similarly, an API gateway controls the flow of data
between clients and backend services.
It checks incoming requests
to ensure they meet certain security conditions like
authentication or rate limits before allowing them through.
And just like a toll booth prevents vehicles
that haven't paid from entering the highway.
An API gateway ensures only valid authorized requests
reach the backend server,
protecting it from unauthorized access and overload.
One of the most common roles for an API gateway
is acting as a reverse proxy.
Acting as a reverse proxy means the API gateway
accepts all API calls coming into the network
and routes them to the appropriate backend services.
For example, when you want to watch a movie on Netflix,
the Netflix API Gateway determines
which services are needed based on your location
and the device you're using like a laptop or TV.
Then the API Gateway efficiently directs your request
to the right servers to deliver the content,
ensuring a smooth user experience
across different devices and regions.
But an API gateway can do much more
than just act as a reverse proxy.
API gateways can also perform request routing,
directing traffic to the right service
based on the type of request.
For example, if a request involves
retrieving user account details,
the API gateway can send the request to the account service.
Or if the request is for processing a payment,
the API gateway could route the traffic
to the payment service.
This ensures that each request
is handled by the appropriate service,
improving efficiency and ensuring the right resources
are used to fulfill each specific need.
API Gateways can also handle authentication
and authorization,
ensuring that only users with the correct
can access certain data.
In addition, API gateways can manage rate limiting
and throttling, ensuring that no one device
can overload the system by sending
too many requests too quickly.
An API Gateway can even provide enhanced security
by blocking unauthorized access
and allowing companies to filter
and control the flow of data.
By balancing all these capabilities,
an API Gateway not only helps ensure data
gets to where it needs to go,
but also keeps systems running smoothly and securely.
Second, let's talk about Web Application Firewalls or WAFs.
A Web Application Firewall
is a specialized firewall designed to inspect
and filter HTTP traffic to protect web applications
from common attacks like cross-site scripting
and SQL injection.
These firewalls apply rule sets to detect
and block harmful traffic
before it can reach your web server.
For example, if a hacker tries to insert
malicious SQL code into a web form
to gain unauthorized access to a database,
the WAF can identify and block this attempt
preventing a potential breach.
To provide this level of protection,
WAFs can be installed either as separate appliances
or as a software plugin on a web server.
When installed as a separate appliance,
the WAF functions independently
within the network infrastructure.
When installed as a plugin,
the WAF integrates directly with the web server itself.
WAFs can also be deployed in line
between the network firewall and the web server
where they can actively block live attacks.
But this might slow down traffic a bit
or occasionally block legitimate requests.
So to prevent this, WAFs can be configured as out of band
where they passively monitor traffic by analyzing
a copy of the traffic that they are monitoring.
This allows them to detect threats
but not block communications in real time.
This out-of-band monitoring setup is unintrusive,
but serves more as a detection system
than a prevention system.
Whether inline or out of band,
WAFs can play a critical role in web application security.
So remember,
application layer security focuses
on protecting applications and their data
from unauthorized access and attacks.
Additionally, application layer security
operates at the highest layer of the OSI model.
Two key components of application layer security
are API gateways and web application firewalls.
API gateways manage the flow of data
between clients and backend services,
ensuring requests are valid and secure,
while also performing tasks like request routing,
authentication, and rate limiting.
On the other hand, WAFs are specialized firewalls
that filter and block harmful traffic
to protect web applications from threats
like cross site scripting and SQL injections.
Whether deployed in line or out of band,
WAFs play an important role in maintaining the security
and smooth operation of web applications,
while API Gateways are deployed in line
to manage traffic and security effectively.