Home > taxonomy > asvs 5.0 > 13 configuration > 02 backend communication configuration

Backend Communication Configuration

V13.2.1

Verify that communications between backend application components that don't support the application's standard user session mechanism, including APIs, middleware, and data layers, are authenticated. Authentication must use individual service accounts, short-term tokens, or certificate-based authentication and not unchanging credentials such as passwords, API keys, or shared accounts with privileged access.

Required for Level 2 and 3

CAPEC™ (3.9): 113, 115, 133, 169, 179, 21, 36, 37, 49, 554, 57, 633, 87

V13.2.2

Verify that communications between backend application components, including local or operating system services, APIs, middleware, and data layers, are performed with accounts assigned the least necessary privileges.

Required for Level 2 and 3

CAPEC™ (3.9): 1, 116, 122, 126, 143, 144, 149, 150, 155, 169, 176, 179, 180, 203, 21, 215, 224, 240, 37, 497, 54, 541, 57, 58, 75, 87

V13.2.3

Verify that if a credential has to be used for service authentication, the credential being used by the consumer is not a default credential (e.g., root/root or admin/admin).

Required for Level 2 and 3

CAPEC™ (3.9): 115, 116, 151, 16, 176, 21, 37, 445, 49, 554, 560, 57, 70

V13.2.4

Verify that an allowlist is used to define the external resources or systems with which the application is permitted to communicate (e.g., for outbound requests, data loads, or file access). This allowlist can be implemented at the application layer, web server, firewall, or a combination of different layers.

Required for Level 2 and 3

CAPEC™ (3.9): 154, 176, 240, 481, 57

V13.2.5

Verify that the web or application server is configured with an allowlist of resources or systems to which the server can send requests or load data or files from.

Required for Level 2 and 3

CAPEC™ (3.9): 154, 240, 481, 57

V13.2.6

Verify that where the application connects to separate services, it follows the documented configuration for each connection, such as maximum parallel connections, behavior when maximum allowed connections is reached, connection timeouts, and retry strategies.