Forem: Anita Achu

Data Management Best Practices for Modern Backend Data Security

Anita Achu — Thu, 30 Jun 2022 12:30:02 +0000

As a backend developer working with millions of data regularly, you understand how sensitive data is and the implications of a data breach. Whether you are building a database from scratch using code with an SQL/NoSQL database or no-code development tools, your database is prone to attacks. You must ensure that sensitive data is secured from attackers.

This article will discuss data management and its security challenges and outline some of the best modern data management practices to keep your software data secure.

What is data management?

Data management refers to the practice of collecting, storing and managing data efficiently. It involves the complete lifecycle that tracks data from its creation till it is no longer required.

Data is a core asset of software, holding sensitive and valuable information. Over the last few decades, application infrastructure and database patterns have advanced significantly. A modern backend developer faces far more complex data management systems such as user information, access control, authentication, and integrity of data that you must keep safe from attackers as they are most vulnerable to attacks.

Let’s examine some of the common data security challenges in data management.

Data security challenges in data management

The reality of managing a software data system is the amount of sensitive data you have to work with. This data could contain personal information, identities, or credentials of users. As a result, this data is a common target for cyberattacks.

You are to ensure that your data is protected, prevent unauthorized access or modification to this data, and grant easy access to this data for users when requested.

These are some of the security challenges in data management. Let’s discuss these challenges and how we can fix them using the best modern practices.

Is my information safe?

When a website collects personal information from users, such as credit card credentials, location, identity, etc., users want to be assured that their information is safe and will not be breached someday. This assurance is what data management entails: confidentiality! Confidentiality is a core principle of data security.

Password changed?

Imagine a user tries to access their account, and the login credentials show, "You cannot log in; the password has changed." I would also dread this. The integrity of user data has been tampered with. Data integrity involves the protection of data from unauthorized modification or removal. Data integrity is also a principle of data security.

How soon can I get it?

Data management guarantees the availability of user data when requested. When the data is requested, availability requires that information systems function effectively and be accessible when needed. For example, your admin database must be available to access your financial records.

There are other challenges in data management. However, we will limit ourselves to these common challenges. Having looked into the challenges, let's dive into the best modern practices to address them.

Data security best practices

Here are some best practices for improving your software data security:

Use separate servers and storage.

Storing your data on the same server as your website exposes it to a variety of attacks specifically designed to target the database. Suppose you have an e-commerce store that stores both sensitive and non-sensitive data on a single server. You may probably be using a hosting service for your site. However, the security measures provided by this hosting service do not protect your sensitive data from attacks. Any attack on your site gives the attacker access to your sensitive data.

Most big cloud computing providers distribute your deployments geographically. You can operate an instance of your application on both the west and east coasts of the United States or another region. You may have numerous instances at the same location. The idea is that if one instance fails, another will be available to fulfill requests. Your service will still be connected even if a data center is unavailable. With this, the availability of your service is assured.

Modern databases like PostgresSQL and MongoDB have good support for server and storage separation.

Use database encryption protocols.

One of the best security measures for databases is encryption. Encrypting data guarantees that it is inaccessible to anybody who does not have access to the encryption key, whether it is at rest or in transit. For example, information stored in Google Cloud Storage is secured at rest. They allow you to provide the encryption keys to offer you more confidence and make it easier to convert encrypted data from other places to Cloud Storage. Take advantage of encryption if your cloud provider offers it. Encrypting data is critical not solely for keeping trade secrets safe but also for transferring and storing sensitive user data. You can also encrypt all connections to give an extra degree of protection to any piece of data you transfer.

Use a strong authentication system.

According to the latest study from Verizon, stolen passwords are responsible for 80% of data breaches. It demonstrates that passwords are not a sufficient security mechanism on their own. Imagine a data breach in your database due to a stolen password. This breach will result in a loss of confidentiality because users are not assured that their data is safe with you. The modern practice would be to adopt a system with several authentication processes. Your users can log in with Google if they prefer to manage their passwords using that method.

Better still, a multi-factor or two-factor authentication (2FA) into your system is a useful tool for protecting sensitive data from unauthorized access. You can use a combination of user authentication methods, such as biometrics, SMS/text messaging, emails, and security questions, for the most secure user sign-ins. Extra layers of protection, such as text verification, email verification, or time-based security codes, are also recommended.

Monitor database logs

Regularly checking your database for attempted breaches strengthens your security and helps you respond quickly to possible threats. Keep an eye on database activity and keep track of log activities. The actions that your users take on your server should be logged.

For example, where a modification has been made on Google Docs, the server records the modification and the person who made it. By monitoring the logs, you can tell if a document modification is by an authorized user. There are modern security solutions that automatically keep you up to date on logs. These security solutions use machine learning to respond to different threats and can be deployed as a service or through a Managed Service Provider (MSP) such as SIEM Software.

Create data backups.

Creating a data backup is one of the practices for data security. Backing up data has gained a lot of relevance in recent years. The goal of data backup is to have a secure copy in case the original data is lost or corrupted. You can reduce the risk of a data breach by making an exact copy of your data and storing it in a safe location that can only be accessed by authorized administrators.

Imagine a situation where your data is compromised by an attacker, accidentally erased by a user, or lost due to hardware failure. Only if the cloud-based data backup plan is implemented on time will we be able to restore data without losing a single piece of information.

One modern way to back up your data is by using cloud storage. A good cloud storage service, like Google Drive or Dropbox, has a file management system for easier access and strong encryption to keep your data safe from third parties.

Enable anti-virus and firewall protection.

Firewalls stand as a defense against data attacks. Attackers can gain access to your data through viruses, trojans, spyware, spam messages, etc. Your system will be able to defend itself against these attacks with the help of anti-virus software and firewalls. You must ensure that your firewall or software is up to date and that it detects and blocks cyber threats before they occur.

There are modern anti-virus and firewall software such as Norton, McAfee, NGFW, NAT firewalls, etc. Ensure that your firewall is regularly updated and prevents such cyber threats before they occur.

According to Statista, there have been over 18 million data breaches in 2022, and about 72 percent of these attackers are on the database, with an estimation of each data breach costing $3.38 million on average. In this regard, data security is an essential action you must take to protect the data of users from hackers to prevent financial losses. While building a modern backend system, you should consider these practices.

In addition, ensure you report failures to your users in time so they can take the necessary steps to better safeguard themselves. In addition to these, there are several other practices you can employ. Continue exploring new ways to make your systems more secure.

Building a contact application with Django and Appsmith

Anita Achu — Mon, 02 May 2022 16:13:28 +0000

A contact application is a database that collects and stores user contact data. The contact app is a widely used application, similar to the contact application on your mobile phone, that stores data such as user contact names, phone numbers, email addresses, etc. Businesses can use this application to manage their customers' information and store personal contact data.

This tutorial primarily focuses on integrating a contact API in Python using the Django Rest Framework. This application will have functionalities that allow users to create, edit, and delete contact data. While this goes on the backend of the application, we will create the interface of our application using Appsmith's pre-built UI widgets.

Appsmith is a powerful open-source low-code framework for creating internal tools with features such as pre-built UI widgets that connect to multiple data sources: APIs, databases, GraphQL, etc., with support for OAuth 2.0 and CURL.

Appsmith allows you to create web application interfaces with little or no code. You don't need to be a developer to create an application dashboard using Appsmith. Using Appsmith's drag-and-drop UI widgets, we will create a dashboard for our application.

Prerequisites

Basic knowledge of Python.
Good understanding of Django
An Appsmith account

Project setup: Building a contact book API

Creating a virtual environment

We will begin by creating a virtual environment for our project. The essence of a virtual environment is to create a separate environment for all installed packages and dependencies.

The command below shows how to create a virtual environment in your terminal:

pip install virtualenv

virtualenv env

Activate our virtual environment

For Windows:

env\Scripts\activate

For Mac/Linux:

source env/bin/activate

Virtual environment activated!

Cloning a repository
Next, we will be cloning an already existing repository built with the Django Rest Framework. This repo contains a contact application with functionalities that allow users to create, edit, and delete contact data.

To clone the repo, run these lines of code in your terminal:

git clone https://github.com/Anitaachu/contactAPI.git

cd contactAPI

Dependencies installation

Once this is completed, we will be installing a couple of dependencies and packages required for this project using the pip These packages are already contained in your cloned requirements.txt file.

Run this command to create a requirements.txt file and install the packages:

pip install -r requirements.txt

Next, migrate the data to the database and create a superuser. To this by running the following commands:

python manage.py migrate

python manage.py createsuperuser

Testing the application

Next, let's test this application locally, using the following command: python manage.py runserver

In your browser hit the endpoint http://127.0.0.1:8000/. You can also access the admin page using this URL http://127.0.0.1:8000/admin/

Great! Our application is running!🎉

Getting started with Appsmith

With our API up and running, the next phase of this project is creating an interface using Appsmith pre-built widgets and connecting these widgets to our data source (API). We will be doing this by writing some queries that will be implemented with the widgets.

Let’s dive in!

Connecting to a Datasource

It takes a few minutes to connect to a datasource, and you can develop tools on the database of your choosing. You can either connect to a database, an API, or both. For this project, we will connect Appsmith to a deployed API using the API we earlier created. The deployed API can be accessed using this URL: https://contactapp-api.herokuapp.com/

Ensure the API you intend to connect is already deployed. You can use Heroku or any other deployment service.

Add the URL of your deployed API and click on ‘run'.

Datasource successfully connected!

Now let’s get to work!

Creating a dashboard with the Appsmith widget

With Appsmith, you can build a fully customized interface with no code. Appsmith has many pre-built UI widgets such as tables, forms, buttons, boxes, images, and more, all available to help you create exciting applications.

Let’s begin! Firstly, let's create a table that will display our contact data.

Follow these steps:

From the widget section, drag and drop the table widget onto the canvas in this manner:

Edit the default data from the property pane and add the column names as contained in our database. As contained in our database, the column names include "first_name", "last_name", "phone_number", "email", "address", and "birthday."

Next, edit the Table Data property in Table Widget’s property pane to {{Contact_API.data}} in other access data from the query.

Next, we will create a button widget that will be used to create contacts. When a user clicks this button, it navigates to another page that contains a form widget.

Adding a button and form widget

Drag and drop the button widget into the canvas.

In the label section, change the ‘submit’ label to 'create contact'. Next, edit the button widget, in the Events > onClick > Navigate to.

Under "Page Name or URL" type in 'Page 2'. By doing this, when we click on the "Create contact" button, it navigates us to a new page that will take us to the contact form.

Lastly, click on the "+" icon at the top left to add a new page.

Form widget

This new page will contain a contact form that will be used to add a new contact, using input fields where users can enter the contact data they wish to create.

Let’s create a form using a form widget with these few steps:

From the widget section, drag a form widget into the canvas.

Change the "Form" label to "Create contact".
Next, drag and drop text widgets into the form widget we just created. Edit the label name to first name, last name, etc. In this manner:

Add the input widget to the canvas. This widget will allow the user to enter their contact name, phone number, address, etc.

Add functionality to the submit button. To do this, create a new query on the right side of the page.

Create a new datasource and enter the URL of the datasource, https://contactapp-api.herokuapp.com/. You can also change the name of this datasource to be able to identify it.

Add connect the query to the submit button.

Lastly, set the body property of your datasource to:

{
"first_name": "{{Input1.text}}",
"last_name": "{{Input2.text}}",
"phone_number": "{{Input3.text}}",
"email":"{{Input4.text}}",
"address":"{{Input5.text}}",
"birthday": "{{Input6.text}}"
}

By doing this, a connection will be created between the widget and the datasource.

Now let’s test out our widget to ensure that it's functioning. Firstly, on the contact dashboard, click on the "Create Contact" button. The button would redirect to another page that contains a contact form.

Fill out this form and hit the submit button. You will notice that contact details that are added through the form are displayed on our application dashboard.

So far, we have been able to create a form widget where users can create contacts, and these contacts will be displayed on our dashboard.

Great!

Asides creating contacts, contact applications also have features where users can edit contacts or delete contacts that are no longer needed. Let’s add the edit and delete contact buttons and write queries that will connect these buttons to our datasource.

Edit contact button

In our application dashboard, add an edit button. This button will also be connected to our datasource. Let’s work on our edit button.

Step 1: In the application dashboard, create a new column named "edit contact".
Step 2: Next, click on the Settings symbol in the “Edit Contact”* column to add some functions to it.
Step 3: Replace the following:
Column Type: Choose ‘Button’.
Label: Replace ‘Action’ with ‘Edit’.
onClick: Choose ‘Open modal’
Lastly, under 'Modal Name', create a new modal.

When you click on the edit button, it spins up a modal. We will edit this modal and add some queries to it to enhance its functionality. To do this:

First, create a text and input widget similar to that of the form widget in the modal. This way:

Add a new datasource and enter the URL of the datasource.

Now you can edit a contact by clicking on the edit button and adding new data to replace the former contact data.

For the delete function, we simply repeat the same process as that of the edit button. However, the modal of the delete may differ. The Delete modal should appear like this:

Just as we did for the first modal, create a query that will connect the delete button widget to a data source.

Set the body property of your datasource to: {{Table1.selectedRow.id}}

Lastly, execute a query under Events > onClick. This button will query data from the deleted datasource you have created.

Let’s test out the delete method to see if it is working properly.

Nicely done! Our widgets and datasources are well implemented and functioning properly.

Deployment

So far, we have done a great job. The last phase of this project will deploy our application. On the right section of the dashboard, click on 'Deploy'. You can also deploy this application by connecting to a Git repository.

Our application is deployed! 🎉

Finally, to test the work we have done so far. Try creating a new contact:

We will also test the delete button to ensure it's working as well:

Successful!

In this tutorial, we created an amazing user interface for our contact application with low code. I hope you had fun building!

Happy coding!🙂