Securing ESG services

In Chapter 7, Bridging Intersystem Gaps, we covered the ESG pattern that provides an anti-corruption layer around external systems. The syntactic details of various security technology often differ between system. ESG services encapsulate these details so that they do not pollute the rest of the system. We may even isolate legacy systems and external interfaces in their own cloud accounts to help control the attack surface that exists at the interactions between disparate systems. In this section, we will address shared secrets such as passwords, access keys, and API keys.

Securing shared secrets

The various ESG scenarios require connecting to external resources. We secure these interactions in transit with SSL, but first they must be authenticated. Legacy systems will most likely require a username and password, while modern systems typically require some sort of long-lived token. For example, a SaaS system may use API keys and a cloud provider may require an access...