Because most methods, particularly those exhibiting the n-tier architecture, rely on several third-party components and a wide selection of programming languages, defining zones of belief and taking an outside/in perspective similar to the one usually found in traditional security has clear benefits. In any case, interaction of various merchandise and languages is an architectural element likely to be a vulnerability hotbed. Suppose that SSL protects user-logon flows between the consumer and the Web server. Our deployment pattern indicates that though the encrypted tunnel terminates at this tier (because of the inherent threat within the zones occupied by the Web and software tiers), we actually should prevent eavesdropping inside and between these two tiers as well. This may point out the necessity to establish yet one more encrypted tunnel or to think about a special method to securing this knowledge (maybe message-level encryption as a substitute of tunneling). Evenly making use of these simple concepts will put you ahead of most software developers.
