It is critical to get foundations right from the outset to make the data secure, especially when adopting multiple cloud technologies. For example, one of our customers has implemented VPC Peering between different cloud platforms. They have MuleSoft and Pega (case management tool) running on AWS. To prevent the need of coming back into their internal network and go out again to the Pega environment, VPC Peering has been configured so that communication can happen directly between those cloud environments.
It is vital to follow the best practices to secure applications and APIs on top of CloudHub. Using Client ID and Secret is a no-brainer and an easy way of wrapping some security around APIs. By leveraging the IP-Whitelisting capability, we ensure that communication is only accepted from certain machines and devices. We put in place important steps like encryption of passwords within the application itself. MuleSoft comes with the capability to secure properties which gives you this additional encryption. The name of those properties can be viewed through the runtime manager, but the passwords themselves are not visible, given the level of encryption in place. We also encrypt through all the layers of MuleSoft components to ensure that data is encrypted in transit.
To sum up, when it comes to security, consider VPC, IPSec with VPN, Client ID and Secret, and encryption. Most importantly, choose the platform which enables you to do all of the above.
