API's and Backend

[TheDevopsGuy]

Hi guys,

I'm wondering if anyone can help me understand a concept on security and networking.

I'm currently working as an intern in a company and while there a client opened a call to open access to the internet to their servers.

I would like to know why all the seniors were discussing how this call can never be accepted since you can never have the backend and API both facing the internet. How would you go around on mitigating this issue? And why specifically the back-end and API.

Thanks

 

[DelJo63]

Some fundamentals to consider:

• an API (application programming interface) is a formalize and approved means to access a specific set of code, eg there's an API for MySQL, DB2, Oracle and the various Cloud services from various providers.
• The concept of a back-end, by definition, accesses services and facilities that are internal to the company, like all HR, orders for supplies and raw materials.

Back-end services just never are accessible to the Internet for simple reasons - - would you EVER have one of your customers altering employee records or ordering $10,000 of raw sheet metal?