Understanding the Challenges, Risks and Best Practices for Securing APIs
Overview
Most of today’s digital experiences are powered by APIs, however security remains a primary concern for CXOs. API adoption is being driven by digital transformation in every sector, and in turn that is driving an increase in malicious threats that target APIs. The security needs of organizations continues to outpace the state of API security, and organizations have been struggling to decipher complicated attack surfaces, and they often lack a clear strategy to mount a defense. In this article, we will explore the many different challenges and threats that the API ecosystem is currently facing, and provide best practices for securing APIs.
API Security Challenges
APIs are at the center of just about every digital experience, and they make up the core functions of mobile and web apps, websites, micro-service architecture, regulatory requirements, etc. In short, APIs are the way that applications communicate and share data with each other. From text messaging to e-commerce, to simply checking the news, everything that we view as standard operating procedure on the internet depends on API support.
According to statistics from Akamai Technologies, API requests account for 83% of all application requests, and there is an expectation that in 2024, the actual number of API requests will exceed 42 trillion. Malicious attackers have increasingly preferred APIs over more traditional web forms, because API performance is higher and the cost of performing an attack is lower. Industry analysts at Gartner predict that by 2022, API attacks will become the most common method of attack.
Protecting your APIs can be difficult because APIs are ubiquitous, and to be effective, they need to be secure. Here are just a few challenges to API security:
Expanding attack surfaces brought on by increasing cloud migration
With the wide application of cloud computing technology, more and more SaaS are migrated to the cloud, while providing services for more users, API is also exposed to the cloud, compared with the traditional data center, both East-West and North-South traffic may become the attack surface of API.
Enterprise growth and technological advancements optimize for speed and agility, at the expense of API security
Agile model is the mainstream development model, agile development emphasizes individual and interaction, working software, customer cooperation, response to change, although improve the speed of innovation and flexibility, but lack of appropriate methods regarding how to build API security, resulting overlook API security in the software development process.
The API interface is invisible to users, but not to attackers
APIs are written by programmers, which means that they are pretty much the only ones in the organization who know they even exist. This lack of visibility makes it easy to overlook routine maintenance, and that can lead to a lot of problems for security teams. There are many ways to find undefended APIs, such as using network traffic, reverse code, security vulnerabilities.
Organizations might not consider all of the APIs that exist in their systems and applications, potentially leaving a back door open for hackers
It’s easy to underestimate the possibility of an API attack. With the often complex web of API dependencies, oftentimes people would prefer to assume that everything is running according to plan, because tying up every loose end can be labor intensive and cumbersome. It’s also easy to overlook APIs in your 3rd party systems.
API attack vectors
Attacks targeting APIs are three times more common than those targeting HTML applications, and attacks using weak password, authorization and injection vulnerabilities are still common. Meanwhile, the risk of parser-based attacks, such as Json and XML, and third-party API integration is increasing. All of which can cause tremendous disruption to businesses.
The three main types of API attacks are:
Credential Attacks
Attackers obtain API login credentials through purchasing, phishing, vulnerability exploitation and other ways, and then use botnets to access customer site API to steal customer data or personal information. According to statistics, from 2018 to 2020, there were over 100 billion credential attacks, and the complexity and number of attacks continue to increase every year, the cost of credential attacks is as high as 22.8 million US dollars, with an average of one victim every 30 seconds.
Network Availability Attacks
When the API is exposed, an attacker can use DDOS or target the API parser, which renders the API unable to provide services. These attacks are nothing new, security teams have been fighting them off for years, however in addition to standard anti-DDoS devices, you need to also be aware of the DDoS attack tolerance of the partner APIs. Your original APIs will not be protected if you rely solely on partner security measures. Attacks against API parsers are more targeted, which may cause hash value conflicts or deserialization anomalies, and then reject API requests.
Exploitation Attacks
All applications are vulnerable to exploitation, and that includes APIs. By embedding malicious code in API function parameters, Json, XML and other payload, common API attacks such as directory conversion, command injection, SQL injection, XSS, bypassing identity authentication are implemented to achieve the purpose of stealing sensitive data or destroying the system. Furthermore, API attacks have been instrumented, enabling attackers to use tools to gather a list of domain names and APIs used in attacks, and then use other tools to find or delete sensitive data.
Best Practices for Protecting APIs
API security defense is a systematic project, compared with traditional defense focusing on access control, signature, rate adjustment, encryption and other specific technical means, the new security practice more emphasizes API governance, new solutions and systematic measures of routinely API security review.
API Governance
First of all, in order to quickly respond to API-based attacks, use open source automation management tools, add descriptive description when API changes, automatically generate the latest API documents, while automatically checking traffic to find and analyze unknown or changed API. Secondly, organize the relationship between APIs, and find out the bot API, prevent the omission of security protection measures. This step can also be completed by tools. Finally, regularly contract testing and white-box testing to detect vulnerability.
New solutions for an ever-changing landscape
New solutions are available to provide security protection to APIs. Including:
- Use advanced bot detection to achieve pre-login verification, interception of API unauthorized access.
- Deploy an API gateway to perform authentication, authorization and access control on API requests.
- Validate API parameters by using positive and negative security modes;
- Use tools to discover API traffic behavior and provide rapid integration with WAF/DDoS.
Routinely API Security Review
No matter how many publicly available APIs an organization might have, security teams need to be aware of all of them in order to manage their security. Once a comprehensive list has been established, schedule a routine security inspection to continuously seek out hidden threats. From there, you can formulate a strategy to implement your protection solution.
- Monitor: Comprehensively review API development, testing, and deployment security measures.
- Protection: Check whether the user ID, DDOS attack protection measures, data verification black and white list is complete.
- Analysis: Review the adequacy of API risk assessments and API audit logs.
Conclusion
With the rapid development of information technology, API security protection is also in the process of continuous evolution. Initially API security protection was aimed at solving invalid input, DoS attacks, authentication bypass and other attacks, recently the focus of protection has shifted to buffer overflow, XSS, SQL injection and other vulnerability protection, security measures from a single vulnerability protection upgrade to gateway, application system protection. We are seeing API attacks will evolve to mainly consist of multi-vector, automated and weaponized artificial intelligence attacks. Security for APIs will be an ongoing challenge with a constant need to focus on the ability of automation, deep learning, and intelligence, and evolve towards intelligence battle field.
Source: ridgesecurity.ai
View more posts: nessar.net
Category: VENDORSNEWSRidge Security News
