6 Principles of a Holistic API Security Strategy
While UX is the face of your applications, APIs are the backbone of your organization. A common mistake that many businesses have made is considering an API as just the interface layer on top of an application. The reality is that APIs serve as the connective tissue for your applications and third-party ecosystems, which are increasingly distributed across hybrid and multi-cloud architectures. While APIs are subject to some of the same risks as web applications—namely vulnerability exploits, business logic abuse, misconfiguration—there are other significant risks. These include attacks that bypass weak authentication and authorization controls, improper inventory, and unsafe usage of third-party APIs. Risk is further increased by the speed of digital business employed through complex software supply chains and automated CI/CD pipelines that can result in “rogue” APIs. Specifically, these include shadow and zombie APIs that are unknown to security teams and/or unmaintained by development teams. In this article, we’ll explore 6 principles of a holistic and well-rounded approach to API security.
1. Understand your APIs and endpoints
There’s a very real chance that, were you to try, you could not identify every API endpoint in your environment right now. But unfortunately, you may not be able to say the same for malicious actors. If an endpoint exists, it can be used as a way in.
In addition, offering public APIs opens you up to receiving queries from a myriad of customers, partners, and apps. It also opens your organization to compromise. There are a number of risk controls that need to be considered to protect your organization from attacks that can lead to breaches and downtime.
2. Find a balance between innovation and security
It’s a classic struggle. On one hand, the urge to be bold, to push the boundaries, to do what your competitors can’t, is a cornerstone to any successful business. But on the other hand, staying secure doesn’t always play nice with the newest innovations.
The key to striking the balance is threefold:
- Design an API governance strategy for each type of API in order to set the appropriate security controls.
- Implement API security policies that can be consistently enforced wherever APIs are deployed.
- Adapt to emerging threats, anomalous behavior, and malicious users that attempt to exploit or abuse APIs using AI to decrease the burden on security teams.
Depending on your industry, compliance standards will vary, with some requiring more stringent security than others. Regardless, it is essential that your API security posture is robust enough to face a barrage of threat vectors.
3. Manage risks throughout the development lifecycle
API security testing is not a one-time deal. Testing before, during, and after deployment is critical. By building testing into every stage of development, you gain many more opportunities to identify weaknesses and vulnerabilities before a breach happens. And while security-specific testing tools are great, don’t forget about security use case modeling as well.
Security needs to run in the same continuous lifecycle of apps themselves, meaning tight integration within CI/CD pipelines, service provisioning, and event monitoring ecosystems.
4. Layer protections from back-end to end customer
From external clients to the internal, backend infrastructure, every part of the architecture must have its own protective measures.
Furthermore, tried and true security practices still apply—default deny architectures, strong encryption, and least privilege access.
In thinking about protection at the API layer, it’s helpful to first sort your APIs into two categories: internal and external. Internal APIs are more straightforward to secure since the API provider can coordinate security measures with app teams. For external APIs, the risk calculus is different. You can (and should) implement API-level protections that do three things:
- Narrow the opportunity for a security breach with real-time threat intelligence and access control mechanisms such as hardened session tokens.
- Establish baseline normal and abnormal traffic patterns.
- Restrict API usage and provide granular control of any approved aggregators and third-party integrations.
At the production level, the sheer volume of traffic from API sprawl necessitates the use of AI to detect anomalous behavior and malicious users.
5. Have the right strategies and tools
Just like there is no one food that will keep us fully nourished, there is no one security tool that will fully protect APIs. Instead, you need to develop a strategy that employs a well-rounded ecosystem of tools as part of a holistic security architecture.
Tools you should consider include:
- An API gateway
- App security testing (SAST and DAST)
- A web application firewall (WAF)
- Bot management
- DDoS mitigation
API gateways provide robust inventory and management capabilities but only provide basic security such as rate limiting that will not deter sophisticated attackers. Additionally, API proliferation is leading to tool sprawl—including API gateway sprawl.
App security testing is always critical but shift- left methodologies for robust application security during development need to be augmented with shield- right practices—namely securing API endpoints in production.
Web application firewalls provide a critical stopgap to mitigate application vulnerability exploits but typically lack the dynamic discovery capabilities necessary to continuously detect “rogue” (shadow/zombie) APIs.
Bot management for APIs cannot rely on commonly used security controls such as multi-factor authentication (MFA) and CAPTCHA, as API traffic is typically machine-to-machine and there is no direct human interaction except within user interfaces into API-based systems.
Traditional DDoS mitigation focuses on network and volumetric attacks, whereas APIs can be subject to targeted layer 7 attacks that abuse critical business logic. The end result is the same—performance degradation and potentially, downtime. But dynamic API discovery, schema enforcement, access control, and automated protections based on machine learning have emerged as critical ecosystem capabilities for defending APIs.
6. Hybrid and multi-cloud security
API proliferation is driving untenable architectural sprawl across hybrid and multi-cloud environments. Again, API sprawl has led to API gateway sprawl as many security tools cannot provide consistent security across multiple architectures such as data center, private/public cloud, and the edge. Visibility and control of API traffic across the entire digital ecosystem is imperative for mitigating the next critical vulnerability, and for preventing misconfiguration that can occur when endpoints are distributed across different cloud providers.
Secure APIs Everywhere They Are
APIs are everywhere—in the data center, across clouds, at the edge—and are interconnected behind web apps, mobile apps, and associated third-party integrations.
APIs need to be protected wherever they live, and security should never sleep. Instead, ensure that your strategy includes solutions that continuously defend critical business logic behind APIs and consistently secure your API-connected digital fabric—so you can streamline operations and innovate with confidence.
Resources
Featured
Check out the new Forrester report that goes deeper on the topics covered in this article.