Composable architecture offers developers a new paradigm for building websites and web apps.  The development approach provides the ability to more rapidly build technology stacks by making use of logically separated reusable and customizable components.

Designing an app to use composable architecture can also promote a better security model, but has its own unique challenges.  In this post we’ll explore a bit more about threats and risks of the modern web, how adversaries target websites, and how composable architecture compares to the traditional monolithic development approach.

Before getting too deep into the specifics of composable architecture, it makes sense to take a step back and review the threats and risks of the modern web.

A web of security threats

While this list is not exhaustive, the following are some of the more common contemporary threats to websites and web apps:

Website defacements

Website defacements, where the content of a website is altered, are as old as the web. A famous early example of a website defacement was when the promotional website for the 1995 movie Hackers was defaced by a group called the “Internet Liberation Front”. While this particular defacement has been speculated to have been a marketing stunt, hacktivist groups continue to use defacements as a way to spread their message.

Abused as attack infrastructure

While defacements are meant to be known, many breaches are meant to remain unseen, such as when a website has been compromised with the intention of being used as part of a larger attack infrastructure. Threat researchers often find open website directories hosting a variety of malware, unsuspected by the website owner. Breached legitimate websites make excellent attack vectors to host phishing payloads or as a traffic redirect to malicious Command and Control (C2) infrastructure.

Data theft

Data theft is a threat that’s likely top of mind, especially for e-commerce websites.  Often websites are breached with the intent of targeting its visitors and customers for fraud.  Much sensitive data is held by and can pass through a website; Personal Identifiable Information (PII), credit cards, and site specific sensitive data.  With access to a website, it’s also possible to generate fraudulent SSL certificates for the domain.  Data theft may also occur due to c