Better Web Application Security in 14 Steps

**Executive summary:** Neeraj Khandelwal of Barracuda Networks presents a 14-point set of web application security design recommendations to secure REST APIs, covering input validation for JSON/XML and URLs, protecting parsers from DoS (XML/JSON bombs), virtual patching, rate limiting and SLA enforcement, authentication and session token protections, verb-based access control, TLS fronting, connection multiplexing, caching/compression, and centralized auditing to improve API security, performance, and manageability.