#xexagen

[cyberspace-by-xexagen-blog]

What is an API?

An application program interface (API) is a collection of routines, protocols, and tools for building software applications. It states how software components should interact. Additionally, API is used when programming graphical user interface (GUI) components. An excellent API makes it easier to develop a program by offering required building blocks. A programmer then aligns the blocks together.

Example: Imagine you’re in a restaurant with a tasty selection to order from. The kitchen is the part of the “system” that prepares the order. The waiter- API acts as the messenger; critical link to converse the order to the kitchen. Then the waiter delivers the response back to you; in this case, it is the food.

APIs: A Developer’s Dream Come True

When developing an app for an iPhone, the Apple iOS operating system-like other operating systems- offers a wide portfolio of APIs to ease the task. By using the camera API to embed the built-in iPhone camera in your app you can capture photos or videos easily, without writing your own camera interface.

Without the existence of APIs, developers would have to reinvent over and over again. Do you want to create a dialog box on Windows? There’s an API for that. Want to support fingerprint authentication on Android? There’s an API for that, too, you need not test all the different Android manufacturer’s fingerprint sensor.

Controls Access to Resources

APIs play a major role in terms of security. They are utilized to regulate access to hardware devices and software functions which an app might generally not have permission to use.

Example: Messages that pop up on browsers asking for location uses the geolocation API in your web browser. These APIs are exposed by web browsers to ensure web developers can easily access your location. Your physical location is identified when the browser access GPS or Wi-Fi- networks in close proximity.

  As afore mentioned, APIs controls access and thus browsers can freely expose information via and API. Websites can only access a user’s physical location through API request which the user can deny or accept. Hardware resources similar to the GPS sensor can be accessed through API only, therefore browser can regulate access and limit app activity.

The above principle is also used in contemporary mobile operating systems (iOS, Android), through which mobile applications must obtain permission before operation- this can be enforced through APIs. Example: In the event a developer attempts to access the camera via the camera API, you are able to deny the request for permission. Thereafter the application will not be able to access the device camera.

File systems which use permissions—like Windows, Mac, and Linux—have permissions imposed by file system APIs. An ordinary application lacks direct access to the raw physical hard disk, instead the application should access the file through an API.

 Communication amid Services Done through API

The Google Maps API is seen to be used to embed the map on certain websites. Google reveals these APIs to web developers to plot complex objects on their website. Imagine if the APIs were non-existential, developers would have to go through the tedious process of compiling their own maps. Google is able to control access to Google Maps on third-party websites since it is an API, ensuring consistency and safety.

Few More Popular API Examples

·       YouTube APIs: Google's APIs allows developers integrate YouTube videos and functionality into websites/applications. (YouTube APIs -YouTube Analytics API, YouTube Data API, YouTube Live Streaming API, YouTube Player APIs and others)

·       Flickr API: Utilized by developers to access the Flick photo sharing community data. The Flickr API consists of a set of callable methods, and some API endpoints.

·       Twitter APIs: Twitter offers two APIs. The ‘'REST API’ enables developers to access core Twitter data and the ‘Search API’ offer methods for developers to interact with Twitter Search and trends data.

·       Amazon Product Advertising API: Provides developers access to Amazon's product selection and discovery functionality to advertise Amazon products aimed at monetizing websites.

[cyberspace-by-xexagen-blog]

Important Facts about PCI-DSS

You may hear about “PCI Compliance”, “PCI-DSS secured Apps” or "PCI” terms before. But you may not be aware of what PCI-DSS is and how it is important in today's digital world.

So, this article will clear out your gray areas about this topic quickly and easily.

What is PCI-DSS?

Payment Card Industry Data Security or PCI-DSS consists of standards that ensure the safety cardholder data across the world. These policies and procedures are defined in 2004 by the PCI Security Standards Council. They serve the organizations and people who work with cardholder data. Current standard documents can be found on the Councils website.

Who should follow these standards?

✓      Financial Institutions

✓      Merchants

✓      POS Vendors

✓      Hardware and Software Developers

✓      And whoever involving in processing, transferring, and storing cardholder data.

 The Basics of PCI Compliance

Many organizations think that compliance is a one-time activity. No, it’s not. PCI Compliance is a continuous process.

 Mainly, PCI compliance consists of 12 standards. These will apply to any business that employs in credit/debit card data regardless of the size of the business or location.

Below mentioned data should be protected which includes the following:

 ✓      Cardholder name

✓      Expiration date

✓      CAV2, CVC2, CVV2, CID (the security digits on the back of credit cards)

✓      Service code

✓      Full magnetic stripe data

✓      PINs

 Levels of PCI Compliance

Four levels exist for the standard. These levels are divided based on the annual number of credit/debit card transactions a business processes.

 ✓      Level1: Merchants who process more than six million VISA transactions per year fall into this category.

 ✓      Level 2: Merchants who process transactions between 1 to 6 million VISA transactions per year fall into this level.

 ✓      Level 3: Merchants who process transactions between 20 000 to 1 million VISA e-commerce transactions per year is fall into this level.

 ✓      Level 4: Applies to merchants processing fewer than 20,000 VISA e-commerce transactions annually, or those that process up to one million real-world transactions

 Each level has its requirements that are needed to fulfill by the merchants.

How do I become a PCI-DSS Compliant?

If you want to become a PCI complaint merchant or an organization, you need to follow twelve requirements.

Install and maintain a firewall configuration to protect cardholder data.

Do not use vendor-supplied defaults for system passwords and other security parameters.

Protect stored cardholder data.

Encrypt transmission of cardholder data across open, public networks.

Protect all systems against malware and regularly update anti-virus software or programs.

Develop and maintain secure systems and applications.

Restrict access to cardholder data by business justification.

Identify and authenticate access to system components.

Restrict physical access to cardholder data.

Track and monitor all access to network resources and cardholder data.

Regularly test security systems and processes.

Maintain a policy that addresses information security for all personnel.

 Why Security is important?

Everybody needs to know about cardholder data security and it affects and who is in the digital payment industry.

 If you are a merchant who accepts digital transactions then you need to ensure that the customers' card details are secured with your payment channels. When you are a payment app developer or financial institution who runs a payment app, then you all should protect customers’ card details when processing, storing and transmitting with other parties.

 If the financial institutions or merchants do not follow the secure methods when transacting, customers will complain about the payment channels. When your application is unstable and not securing the customers' card details, then you will lose the credibility you have built through the community. Sometimes your business will fail because of your careless mistakes when joining with payment vendors and other parties involved in customer data handling.

 As you know, PCI requirements are not “one-and-done” requirements. You need to maintain your data security every day.