As part of an IoT project, an organization is developing an application that will share multiple clients using a REST API.
Based on the software development process, what are two valid technical activities that can be suggested to secure the REST API that is developed during the development of the software? (Choose two.)
Click on the arrows to vote for the correct answer
A. B. C. D. E.BD.
When developing a REST API for an IoT project, it is essential to ensure that the API is secure. The following are two valid technical activities that can be suggested to secure the REST API that is developed during the development of the software:
Implement HTTP Whitelisting: HTTP whitelisting is a security mechanism that allows only specific HTTP methods, such as GET, POST, PUT, and DELETE, to access the API. By whitelisting HTTP methods, it is possible to prevent unauthorized access and prevent attacks, such as Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). This security measure also helps ensure that only valid requests are processed and reduces the risk of data breaches.
Implement and review audit logs for security-related events: Audit logs record events that occur within an application, such as user logins, access attempts, and changes made to data. By implementing audit logs, it is possible to monitor and detect any suspicious or unauthorized activity on the REST API. Reviewing the audit logs regularly can help identify security-related events and enable administrators to take appropriate action, such as blocking IP addresses or revoking user credentials. This security measure can also help identify and address vulnerabilities in the system before they can be exploited by attackers.
The other options mentioned in the question are not related to securing the REST API during the software development process. For example, responding to request failures in detail is not a security measure but rather a troubleshooting mechanism. Rejecting HTTP methods that are invalid with an error code 404 is not a security measure, but it is a good practice to inform clients that a resource is not available. Finally, implementing physical firewalling and access control is a security measure but not specific to securing the REST API during the software development process.