I want to design and implement an epayments system (I will not be handling credit card payments). The system will have a RESTful API. I am already familiar with RESTful servies, and have built a few in my time.

However, this time round, security is of paramount importance and I want a system that is as robust against external attacks, as anything out there (e.g. Paypal).

The way I see it, there are two points of attack:

The physical machines (servers) and the network they reside on
Attacks via the exposed RESTful API (man in the middle attacks, snooping etc).

Paypal, which is a model of what I want to replicate, provides a RESTful API, using OAuth etc, so I know it is possible to provide a secure RESTFul API to sensitive data.

So my question basically decomposes into the following two questions:

A. What technologies/practises are employed by companies such as Paypal, to ensure that their machines are not hacked or compromised?

B. Is OAuth the way to go to present a secure interface to the world? - or can this be improved?

  • 2
    A caveat: Paypal has 148 million customers, $4 billion in annual revenue, and is registered as a bank in Luxembourg. Both their threat model and their defensive capabilities are significantly different from yours; don't assume that if Paypal do X and don't do Y that those are necesarilly good choices for your business. – Graham Hill Jul 22 '14 at 12:03
  • @GrahamHill: True, perhaps I should have made it clear - I meant Paypal as when it first started out, not as they are now. I only used Paypal because most people are familiar with the concept (electronic money transfer) – Homunculus Reticulli Jul 22 '14 at 12:30
  • @HomunculusReticulli you're forgetting all the "internal" attack vectors. Segregation of responsibility is a good start on this. About the technology, using HSMs, encryption and digital signing are a must. And the whole development process and code needs to be auditable, and peer reviewed by security specialists (aka developers with a very, very good understanding of security) – Augusto Aug 21 '14 at 14:43

You might think that your project differs from a decent Content Management System. But in fact it's not. You should reinforce what's paramount to every software project: Testing and high code quality. Security is not only subject to the API itself but to the software behind.

Using a programming language that forces a static type system is a good start. Then do excessive Unit and functional testing. Especially what happens if the client does not behave in the predicted manner. Then you can do some pentesting.

Those strategies apply to a high-security application as well as a little app like a CMS. I would also suggest a language like Java with a compiler. So if you introduce any code inconsistencies they will break the compiling process.

The server itself will likely to be secured like every bigger server. But that's not my best expertise.

You see? Nothing new and fancy here...

  • A static typed programming language will provide 0 (zero) extra security compared to a dynamic language... the same applies the other way around. – Augusto Aug 21 '14 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.