Verificando autenticación…

Skip to main content

Security Practices

API Security Standards​

GRT.EST.030 - API Security v1.1 Standard Summary​

Overview​

This standard establishes the cybersecurity guidelines required to publish LATAM Airlines Group S.A. services through APIs (Application Programming Interface), both internal and external. The document is mandatory for all internal staff and outsourcing involved in API development and management.

Scope: Applies to all employees, collaborators, third parties, processes, and system components of LATAM Airlines Group S.A., its affiliates, and subsidiaries worldwide.

Main guidelines​

General security requirements​
  • HTTPS required: HTTP is prohibited; all communication must use HTTPS
  • TLS v1.2 or higher: Dynamic token exchange under TLS v1.2+, disabling earlier versions
  • Authentication and authorization: APIs must require authentication before granting access
  • Input validation: Implement controls to validate input data (size, range, format, type)
  • Data encryption: Data in transit encrypted (TLS 1.2+ for communications, AES-256 for data)
  • DDoS protection: APIs protected against distributed denial-of-service attacks
  • Rate limiting: Implement request limits (default: 30 calls per 60 seconds)
Token and key management​
  • Dynamic tokens: Do not configure tokens at URL level
  • Capture protection: Implement Secure Cookies, CSRF Tokens, and Token Revocation
  • API key management: Environment variables instead of hardcoded values
  • Credential rotation: Policy to periodically rotate Client Secret, Secret ID, API key, and passwords

Required security controls​

Authentication by application type​

Employee authenticated applications:

  • Authentication: Delegation to an IAM platform compatible with OIDC, OAuth 2.0, and SAML 2.0
  • Mechanisms by type:
    • Mobile/native applications: OIDC + OAuth 2.0 Authorization Code
    • Traditional web applications: OIDC + OAuth 2.0 Authorization Code
    • Single-Page Apps (SPA): OIDC + OAuth 2.0 Implicit Flow
    • SaaS applications: SAML 2.0 or OAuth 2.0 Authorization Code

Customer authenticated applications:

  • OIDC and OAuth 2.0 compatible
  • Same mechanisms as employee applications by type

Anonymous/third-party/batch applications:

  • Preferred authentication order:
    1. OAuth 2.0 Client Credentials
    2. Client Certificates
    3. API Key + IP filter (API Management only, specific cases)
    4. Basic Authentication (On-Premise only, specific cases)
Validation and responses​

  • Standard response codes:

    • HTTP 429 "Too many requests" for requests that are too fast
    • HTTP 405 "Method not allowed" for disallowed HTTP methods
    • HTTP 406 "Not Acceptable" or HTTP 415 for invalid content types

  • Error handling: Respond with generic messages avoiding disclosure of failure details

  • Content validation: Document and validate supported content types

Implementation​

Secure configuration​
  • Server: Firewall configuration, regular software updates, secure passwords
  • Security logs: Standard plain-text format with defined minimum structure
  • Log separation: Audit logs separated from system logs
  • Log custody: Maintain chain of custody with minimum privileges
Complementary controls​
  • Web Application Firewall (WAF): Detect and block web attacks
  • API Gateway: Granular control of inbound and outbound requests
  • Vulnerability analysis: On-demand or automated tools
  • Anti DDoS: Native cloud solutions integrated with WAF

Validation and compliance​

Required log types​
  • Authentication: Access and successful authentication information
  • Authorization: Accessed resources, authorized users
  • API activity: Requests, returned data, errors, validations
  • API changes: Modifications made, responsible parties, justifications
  • Monitoring: Performance, response times, security issues
  • Regulatory compliance: Adherence to GDPR, SOX, PCI DSS
Security testing​
  • Regular security testing including:
    • Penetration testing
    • Vulnerability analysis
    • Load testing
  • Mandatory secure development training for developers
Consequences of non-compliance​

Non-compliance is subject to disciplinary measures ranging from verbal warning to termination of employment and legal action, according to applicable local regulations.

References​

Standard annexes​

  • Annex A: CIS - OWASP Control Map
  • Annex B: CIS API Control Best Practices
  • Annex C: OWASP TOP 10 API Best Practices
  • Annex D: Configure JWS in an application
  • Annex E: Configure JWE in an application
  • Annex F: TLS encryption versions
  • Annex G: Libraries and log configuration
  • Annex H: Secrets management
  • Annex I: JWT and Apigee best practices

Other security practices​

Important definitions​

  • API: Application programming interface for communication between systems
  • Authentication: Process of verifying user or system identity
  • Authorization: Process of granting or denying access permissions
  • Token: Unique code to authenticate identity
  • WAF: Web Application Firewall to protect web applications
  • TLS: Transport Layer Security to protect communications
  • Vulnerability: System weakness that can be exploited by attackers