WHITEPAPER

Akamai

APISecurity

Fundamentals:

BuildYourKnowledge,SecuretheEnterprise

|2

Akamai

Introduction

APIshaveevolvedrapidlyfromanimplementationdetailtoastrategicenablerofdigitalinnovation.Everytimeacustomer,partner,orvendorengageswithabusinessdigitally,there’sanAPIbehindthescenesfacilitatingaseamlessdataexchange.

AsAPIsproliferate,sodotheirrisks.Intheracetoquicklycreateandreleasenew

applicationsandAI-enhancedservices,theunderlyingAPIsaretoooftenmisconfigured,lackinginsecuritycontrols,andvulnerabletoeasilyexecutedattacks.

Asaresult,APIshaveemergedasatopattackvector,leavingmanysecurityteamstoplaycatch-upwiththeirAPIsecuritystrategies.Therefore,APIsecurityisquickly

emergingasatopstrategicpriorityforITandsecurityexecutives.

Whetheryou’relookingtogroundyourselfinAPIsecuritybasicsorareassemblingalistoftherightquestionstoask,thisguideoffersthedetailsyouneedtoknow,including:

?ThedifferenttypesofAPIs

?WhatAPIsecuritymeansforbusinessestoday

?BestpracticesforaddressingAPIsecurityrisks

?CommonAPIattackandabusemethods

ITogodirectlytoAPIsecuritybestpractices,youcanskipaheadtopage10.

|3

Akamai

TableofContents

APIbasics

4–9

APIsecurityexplained

10–12

APIsecurityrisksandabuse

13–18

APIsecuritysolutionsandtrends

19–22

Akamai

APIbasics

WhatisawebAPI?

Awebapplicationprogramminginterface,orAPI,consistsofoneormoreendpointsofa

definedrequest–responsemessagesystem,typicallyexpressedinJSONorXML,whicharepubliclyexposedviatheweb—mostcommonlybymeansofan

HTTP-basedwebserver

.

Inotherwords,awebAPIiswhatmostpeoplethinkofwhentheyhear“API.”It’sa

collectionofendpoints.Endpointsconsistofresourcepaths,theoperationsthatcanbeperformedontheseresources,andthedefinitionoftheresourcedata(inJSON,XML,Protobuf,oranotherformat).

WebAPIsaredifferentfromotherAPIs,suchasthoseexposedbytheoperatingsystemorbylibrariesofapplicationsrunningonthesamemachine,butthegeneralterm“API”usuallyreferstoa

HTTP-based

(web)API,especiallyinthecontextofenterprisedigitaltransformationandAPIsecurity.

WhatarethemostcommontypesofAPIs?

Thefollowingtablecontainstermsthatrefertodifferentusagemodelsandtechnical

approachesforAPIimplementations.WebAPIsaredefinedasbeingbasedon

HTTP

,andthefourmaintypesofwebAPIsseentodayareRESTful,SOAP,GraphQL,andgRPC.

Thetabledefinesthesecommontypes,aswellasothers.

|4

Akamai

|5

APIusagemodelDescription

PublicAPI

AnAPIthatismadeavailableandsharedfreelywithalldevelopersviatheinternet

ExternalAPI

OftenusedinterchangeablywithpublicAPI;thesetypesofAPIsareexposedtotheinternet

PrivateAPI

AnAPIthatisimplementedinaprotecteddatacenterorcloudenvironmentforusebytrusteddevelopers

InternalAPI

OftenusedinterchangeablywithprivateAPI

Third-partyAPI

Providesprogrammaticaccesstospecializedfunctionality

and/ordatafromathird-partysourceforuseinanapplication

PartnerAPI

Atypeofthird-partyAPIthatismadeavailableselectivelytoauthorizedbusinesspartners

AuthenticatedAPI

AnAPIthatisonlyaccessibletodeveloperswhohavebeengrantedaccess(orthreatactorswhohavegained

unauthorizedaccesstocredentials)

UnauthenticatedAPI

AnAPIthatcanbeaccessedprogrammaticallywithouttheneedforspecificcredentials

HTTPAPI

AnAPIthatusesthehypertexttransferprotocolasacommunicationprotocolforAPIcalls

Akamai

|6

RESTfulAPI

GraphQL

Representationalstatetransfer(RESTful)isthemostcommontypeofwebAPIthatusesplaintext,HTML,XML,YAML,or

JSONtodeliverdata;RESTfulAPIsareeasytoconsumeby

modernfront-endframeworks(e.g.,ReactandReactNative)andfacilitatewebandmobileapplicationdevelopment;theyhavebecomethedefactostandardforanywebAPI,includingthoseusedforB2B

GraphQLAPIsarethenewer,Facebook-developedstandardthatprovidesdatabaseaccessoverasinglePOSTendpoint(typically/graphql);itsolvesacommonRESTfulAPIproblem—thatofrequiringmultiplecallstopopulateasingleuser

interfacepage

SOAP

XML-RPC

gRPC

SOAPusestheverboseeXtensibleMarkupLanguage(XML)forremoteprocedurecalls(RPCs).ItcanstillbefoundinlegacyAPIs

XML-RPCisamethodofmakingprocedurecallsovertheinternetthatusesacombinationofXMLforencodingand

HTTPasacommunicationsprotocol

gRPCAPIsareaGoogle-developed,high-performancebinaryprotocolover

HTTP/2.0andareusedmostlyforeast-west

(withininternalnetwork)communication

OpenAPI

OpenAPIisadescriptionanddocumentationspecificationforAPIs.ItmaybehelpfultoknowthatthetermSwaggerreferstotheoriginalspecification,andOpenAPIreferstotheopen

standarddevelopedbytheOpenAPIInitiative

|7

WhatisthedifferencebetweenAPIsandendpoints?

Peopleoftenuse“API”whentheyarereallyreferringtoasingleAPIendpoint.APIs,

sometimescalledservicesorAPIproducts,arecollectionsofendpointsthatservea

businessfunction.Anindividualendpoint,ontheotherhand,isaresource(orresourcepath,alsoknownasaURIoruniformresourceidentifier)alongwiththeoperation

performedonit(create,read,update,ordelete).InRESTfulAPIs,operationsaretypicallymappedtothe

HTTPmethods

(POST,GET,PUT,andDELETE).

Whatisanorth-southAPI?

TheseareAPIsthatanorganizationleavesaccessibletotheoutsideworld,primarilytoconductbusinesswithitsbusinesspartners.ThisiscalledAPIexposure.Forexample:

BanksembracingopenbankingmayexposetheirdatatootherfintechorfinancialservicesorganizationsviaAPIs.

HealthcareorganizationsmayexposepatientrecordstoinsurancecompaniesandothermedicalorganizationsviaAPIs.

HospitalityorganizationsmayexposetheirreservationsystemstotravelagentsoraggregatorsviaAPIs.

APIsaretheconnectivetissuethatallowsdisparateorganizationstoexchange

data.North-southAPIsareoftenconsideredsafebecauseaccessisauthorizedandauthenticated.Typically,thisisthefastest-growingandlargestvolumeofAPIs,

andconsequently,itisthelargestattacksurfaceformostorganizations.

Whatisaneast-westAPI?

TheseareAPIsthatanorganizationusesinternallyandshouldnotbeaccessibleto

anyoneoutsidethebusiness.TheseAPIsconnectinternalapplicationsorbusinessunitsordepartments.Itispossibleforadevelopertomakeamistakethatmakeseast-westAPIsaccessiblebyaccident.TheseAPIsarenotmeanttobeaccessibleorevenknownbyexternalentities,butbreachesdohappenwhenthreatactorsfindeast-westAPIs

accessibleviatheinternet.

|8

WhatarethedifferencesbetweenB2CAPIsandB2BAPIs?

Business-to-consumer(B2C)APIspowerwebandmobileapplications.Theyaretypicallyconsumedbymodernfront-endclientstoallowauthenticatedendusersaccesstothecompany’sbusinessfunctionality.

Business-to-business(B2B)APIsareofferedbytheorganizationtootherorganizationstoconductbusinessandsometimestoprovidevaluetojointcustomers.

B2BAPIshelpstreamlinehowanenterpriseworkswithitssuppliers,resellers,andotherpartnersandhowitprovidesbetterexperiencestoitscustomers.

ExamplesofB2BAPIsinclude:

Openbanking

APIs

Supplychain

managementAPIs

Electronic

invoicingand

payments

betweentrading

partners

SincetheconsumersoftheAPIsdiffergreatly,thesecuritycontrolsavailablefor

protectingtheseAPIsalsovary.TheindustryhasbeenfocusedonB2Cusecasesuntil

fairlyrecently,buteventhere,thefocushasnotbeenonsecuringB2CAPIsbutratheronsecuringwebapplications.Thesecuritytoolsandcontrolstypicallyemployedfor

securingB2Cwebapplicationsoffercertainbenefits(e.g.,webapplicationfirewall[WAF]/webapplicationandAPIprotection[WAAP])butcannotprovidethedegreeofvisibility,

real-timemonitoring,andprotectionrequiredforsecuringB2CAPIsfromattacks.

ProtectingB2BAPIsisbecomingincreasinglychallenging.TheseAPIsareofteneasiertargetsforattackersbecausetheyfrequentlylackessentialprotectionmechanisms.

EarlierAPIsecuritytoolshadlimitedvisibilityintoB2BAPIsandstruggledtosecureAPIsthatfacilitatedbulkdataaccessonbehalfofsharedusers(asseeninopenbanking,

wherefintechcompaniesandfinancialinstitutionsconsensuallysharecustomerdata).However,newerAPIsecuritysolutionsofferbehavioralanalyticsandcanrecognize

anomalousactivities,effectivelyaddressingtheseconcerns.

Akamai

WhatarethedifferencesbetweenprivateAPIsandpublicAPIs?

PrivateAPIs,sometimesalsocalledinternalAPIs,areintendedtobeusedbythecompany’sdevelopersandcontractors.Oftenapartofaservice-orientedarchitecture(SOA)initiative,privateAPIsaremeanttostreamlineinternaldevelopmentbyenablingdifferent

departmentsorbusinessunitstoaccesseachother’sdataefficientlyandeffectively.

Bycontrast,publicAPIs,alsoknownasexternalAPIs,areexposedtoconsumersfromoutsidethecompany.Intheirmostextrememanifestation,asopenAPIs,theycanbefreelyconsumedbyanyone.Inallcases,theyrequiretightmanagementandgreat

documentationsotheycanbeusedbyengineersoutsidethecompany.

It’simportanttonotethatprivateAPIsthatcanbeaccessedovertheinternetarenot

reallyprivateinthestrictsenseoftheword.Forexample,let’ssayACME’sB2CAPIis

usedonlybyACMEmobileapps(developedinhousebyACMEengineers).YoumaybetemptedtocallthisaprivateAPI,butsincethetraffictothisAPIarrivesfromtheinternet(outsidethecompany),thisAPIisnotreallyprivate—itissimplyunpublishedtoexternalaudiences.HackersattacksuchAPIsregularlybyinterceptingtrafficandbyreverse

engineeringmobileappstofindtheircorrespondingAPIs.

|9

Akamai

APIsecurityexplained

WhatisAPIsecurity?

APIsecurityisastrategyforgainingvisibilityinto,rigorouslytesting,andprotectingeveryAPIacrossanenterprise.ThisincludesAPIsthatareintegraltoapplications,business

processes,andcloudworkloads.However,becausebothinternalandexternalAPIsare

beingproducedsorapidlyandinsuchlargenumbers,itcanbedifficulttohavea

completeunderstandingofyourorganization’sentireAPIlandscape.ManyorganizationslackvisibilityintohowmanyAPIstheyactuallyhaveandwhichAPIsreturnsensitivedatawhencalled.IdentifyingandmitigatingAPIsecurityrisksrequiresecuritycontrolsthataresophisticatedenoughtoprovidethiskindofvisibilityanddataanalysis.TheAPIsthat

needprotectionmayinclude:

?APIsthatmakedataeasilyaccessiblebycustomersorbusinesspartners

?APIsconsumedfrombusinesspartners

?APIsthatareimplementedandusedinternallytomakeapplicationfunctionalityanddataavailabletovarioussystemsanduserinterfacesinastandardizedandscalablemanner

AneffectiveAPIsecuritystrategymustincludesystematictechniquesforassessingriskandpotentialimpactaswellasexecutingappropriatemitigationmeasures.ThefirststepinassessingriskisbuildinganinventoryofallsanctionedandunsanctionedAPIs

publishedandusedbytheorganization.Thisinventoryshouldincludeattributessuchas:

?Dataclassifications,whichataminimumdistinguishbetween“notsensitive,”“sensitive,”and“verysensitive”data

?Riskindicators,suchasAPIvulnerabilitiesandmisconfigurations

|10

Akamai

|11

Additionally,APIvisibilityandriskmitigationmeasuresmustconsideradiversecollectionofpossiblethreats,including:

?DetectingandpreventingtheuseofunsanctionedshadowAPIs(seesidebar)

?IdentifyingandremediatingAPIvulnerabilitiesand

misconfigurationsthatthreatactorscouldpotentiallyexploit

?PreventinginstancesofAPImisuse,suchasbusinesslogicabuseanddatascraping

HowisAPIsecuritydifferentfromapplicationsecurity?

WhileAPIsecurityandtraditionalapplicationsecurityarerelateddisciplines,APIsecurityisadistinctchallengefortwokeyreasons—thescaleandcomplexityoftheproblem.

Greaterscale

ThreefactorscontributetotherapidgrowthofAPIuse:

1.Theuseofmicroservices,anarchitecturethatmandatestheuseofAPIsforservice-to-servicecommunication,isgrowing.

2.Inthedirect-userchannel,modernfront-endapplication

frameworkssuchasReact,Angular,andVueuseAPIsandaredisplacinglegacywebapps.

3.APIsareaddedtoaddresscompletelynewchannelsaswell(e.g.,partners,IoT,andbusinessautomation).

Flexibilityleadingtocomplexity

Unlikewebapplications,APIsaredesignedtobeused

programmaticallyinmanydifferentways,whichmakesdifferentiatinglegitimateusagefromattacksandabuseextremelychallenging.

Thefollowingarecommon

categorizationsanddescriptionsofAPIsthatmaycomeupinasecuritycontext.

SanctionedAPIs

PublishedAPI(withSwaggerdocumentationorsimilar)

UnsanctionedAPIs

?ShadowAPI

?RogueAPI

?ZombieAPI

?HiddenAPI

Out-of-dateAPIs

?DeprecatedAPI

?LegacyAPI

?ZombieAPI

?OrphanedAPI

IsthereanAPItaxonomythatsecurityteams

shouldunderstand?

Akamai

StagesofAPIsecuritymaturity

Stage1:Visibilityanddiscovery

YouareintheprocessofdiscoveringallyourAPIsandthemicroservicestheysupportbyusingan

automatedapproach.Breadthofcoverageis

critical,asoverlookedAPIs(suchasthoseno

longerinuse)areaprimetargetforthreatactors.

Stage2:Testing

YoutestallyourAPIstoensurethattheyarecodedcorrectlyandthattheyperformtheirintended

function.TestingperformedpriortodeployinganAPIistheupperendofthismaturitystage;riskiseliminatedbeforetheAPIgoesintoproduction,

andanyneededfixisexponentiallylessexpensive.

Stage3:Riskaudit

YoucontinuallyaudityourentireAPIenvironmenttoidentifymisconfiguredAPIsorothererrors.Yourauditalsoensuresadequatedocumentationof

everyAPIanddetermineswhethertheycontain

sensitivedataorlackappropriatesecuritycontrols.

Stage4:Runtimeprotection

Youareusingasolutionwithautomatedruntimeprotection,whichcandifferentiatebetweennormalandabnormalAPIactivity.BymonitoringAPI

interactionsthisway,you’reabletodetectbehaviorsindicatingathreatinrealtime.

Stage5:Response

Youhavesolutionsinplacetorespondto

suspiciousAPIbehavior,suchasaWAForAPI

gatewaythatblockssuspicioustrafficbeforeitcanaccesscriticalresources.Yoursolutionsuse

customized,automatedrules.

Stage6:Huntforthreats

Youregularlyperformforensicanalysisonpastthreatdatatolearnwhetheralertscorrectlyidentified

threatsandwhetherpatternsemergedthatenableproactivethreathuntingusingacombinationofsophisticatedtoolsandhumanintelligence.

WhatarethebestpracticesforprotectingAPIs?

EnhancingyourAPIsecuritystartswiththefollowingbestpractices:

?IntegrateAPIsecuritystandardsandpracticeswithyourorganization’ssoftwaredevelopmentlifecycle.

?IncorporateAPIdocumentationandautomatedsecurity

testingintoyourcontinuousintegration/continuousdelivery(CI/CD)pipelines.

?EnsurethatappropriateandeffectiveauthenticationandauthorizationcontrolsareappliedtoyourAPIs.

?ImplementratelimitingmeasurestohelppreventAPIsfrombeingabusedoroverwhelmed.

?Augmentratelimitingandotherapplication-levelmeasureswithspecializedgatewaysand/orcontentdeliverynetworksto

mitigatetheriskofdistributeddenial-of-service(DDoS)attacks.

?MakeAPIsecuritytestinganintegralpartofyourbroaderapplicationtestingprocesses.

?PerformcontinuousdiscoveryofAPIs.

?Implementasystematicapproachforidentifyingand

remediatingcommonAPIvulnerabilities,includingtheOWASPTop10APISecurityRisks.

?Usesignature-basedthreatdetectionandpreventionasabaselinelevelofprotectionagainstknownAPIattacks.

?Augmentsignature-baseddetectionwithAIandbehavioral

analyticstomakeAPIthreatdetectionmorescalable,

accurate,businessrelevant,andresilientagainstnovelthreats.

?EnsurethattheAPIsecuritymonitoringandanalysisprocessextendsovermultipleweeksandAPIsessions.

?ComplementAPIsecuritymonitoringandalertingwithon-demandaccesstoAPIinventoryandactivitydataforusebythreathunters,developers,DevOps,andsupportpersonnel.

YourabilitytoimplementtheseAPIsecuritybestpractices

dependsonwhereyouareinyourjourneytowardamatureAPIsecuritystrategy(seesidebar).

|12

|13

Akamai

APIsecurityrisksandabuse

WhatisanAPIvulnerability?

AnAPIvulnerabilityisasoftwarebugorsystemconfigurationerrorthatanattackercanexploittoaccesssensitiveapplicationfunctionalityordataorotherwisemisuseanAPI.TheOWASPTop10APISecurityRisksofferausefuloverviewofsomeofthemostwidelyabusedAPIvulnerabilitiesthatorganizationsshouldattempttoidentifyandremediate.

AreallAPIvulnerabilitiestrackedontheOWASPTop10APISecurityRisks?

TheOWASPAPISecurityTop10isanexcellentstartingpointfororganizationsseeking

toimprovetheirAPIsecurityposture.ItscategoriescoverawiderangeofpossibleAPIrisks.ButthecategoriesincludedinOWASPAPISecurityTop10arequitebroad,soit’simportanttodrilldowntothesub-areasforeachone.APIattackersfrequentlyattempttoexploit

authorizationissues(coveredbyOWASPextensively),buttherearealsoAPIrisksthatfallcompletelyoutsidetheOWASPAPISecurityTop10,suchastheabuseoflogicbugs.

HowcanAPIsbeabused?

APIscanbeattackedandabusedinvariousways,butsomeofthemostcommonexamplesinclude:

?Vulnerabilityexploitation:Technicalvulnerabilitiesinunderlyinginfrastructurecanleadtoservercompromise.ExamplesrangefromtheApacheStrutsvulnerabilities(CVE-2017-9791,CVE-2018-11776)toLog4jvulnerabilities(CVE-2021-44228).

?Businesslogicabuse:Logicabuseiswhenathreatactorexploitsapplicationdesignorimplementationflawstopromptunexpectedandunsanctionedbehavior.ThesescenarioscausestressforCISOsandtheirteamsbecauselegacysecuritycontrolsareuselessagainstthem.

?Unauthorizeddataaccess:AnothercommonformofAPIabuseistheexploitationofbrokenauthorizationmechanismstoaccessdatathatshouldnotbeaccessible.Thesevulnerabilitiescarrymanynames,suchasBrokenObjectLevelAuthorization(BOLA),insecuredirectobjectreference(IDOR),andbrokenfunction-levelauthorization(BFLA).

Akamai

|14

?Accounttakeover:AfteracredentialtheftorevenanXSSattack,anaccountcanbetakenover.Oncethathappens,abuseofeventhemostwell-writtenandperfectly

securedAPIispossible.UsinganAPIsecuritysolutionthatoffersbehavioranalysisallowsyoutodifferentiateauthenticatedactivityfromillegitimateusage.

?Datascraping:AsorganizationsmakedatasetsavailablethroughpublicAPIs,threatactorsmayaggressivelyquerytheseresourcestoperformwholesalecaptureoflarge,valuabledatasets.

?Businessdenialofservice(DoS):Byaskingthebackendtoperformheavytasks,

APIattackerscancauseerosionofserviceoracompleteDoSattheapplicationlayer(averycommonvulnerabilityinGraphQLbutsomethingthatcanhappenwithany

resource-intensiveAPIendpointimplementation).

WhatisazombieAPI?

Drivenbychangingmarketandbusinessrequirements,APIsareinconstantflux.

Asnewendpointimplementationsarereleasedtomeetnewbusinessneeds,fixbugs,andintroducetechnicalimprovements,olderversionsoftheseendpointsaresunset.

Managingthedecommissioningprocessofoldendpointsisnottrivial.Often,endpointimplementationsthatshouldhavebeendeprecatedremainaliveandaccessible—thosearecalledzombieendpoints.

HowcanIfindthevarioustypesofshadowAPIs?

Oneofthewaystoconductenterprise-wideshadowAPIdiscoveryistoingestandanalyzeAPItrafficonyournetwork.ExamplesofAPItrafficsourcesinclude:

Contentdeliverynetworks(CDNs)

APIgateways

WAFs

Kubernetes

clusters

Cloudinfrastructure

Oncerawdatafromallavailablesourcesiscollected,AItechniquescanbeusedto

transformitintoacomprehensiveinventoryofallAPIs,endpoints,andparameters.Fromthere,additionalanalysiscanbeperformedtoclassifytheseelementsandidentify

shadowAPIsthatshouldbeeliminatedorbroughtintoformalgovernanceprocesses.

|15

HowdoyouprotectinternalAPIsandB2BAPIs?

Itreallydependsonthedefinitionof“internal.”SometeamsrefertoAPIsexposedoverthe

internettotheirownorganization’swebandmobileapplicationsas“internalAPIs.”AndwhilethedocumentationfortheseAPIsmayindeedbeaccessibleonlytocompanyemployeesandcontractors,hackershavebecomeadeptatanalyzingappsandreverseengineeringtheAPIsviaappdisassemblytoolkitsandproxiessuchasBurpSuite.

However,if“internalAPIs”aredefinedaseast-westAPIs,whichcannotbeaccessedfromoutsidetheorganization,thenthemainthreatisreducedtoaninsiderthreat.Protect

east-westAPIsandyourB2BAPIslikemostotherAPIs:Startbysecuringthesoftware

developmentlifecycle(SDLC)andcontinuebyensuringaccessisauthenticatedand

authorized.Youcanalsoimplementmanagingquotas,ratelimits,andspikearrests.

Additionally,youcanprotectyourAPIsagainstknownthreatsbyusingWAFs/WAAPs.

ForB2BAPIs,consideraddingstrictauthenticationmechanisms,suchasmTLS,becauseofthesensitiveandoftenbulknatureofthetransactions.

Andforbotheast-westandB2BAPIs,werecommendyouemploybehavioralanalytics,especiallyifyouhavemanyentitiesinvolved,whichmaymaketheprocessof

distinguishingbetweenlegitimateandillegitimatebehaviordifficult.Forexample:

HowdoyouknowiftheAPIcredentialsofaspecificuserhavebeencompromised?

HowwouldyouknowifyourinvoicingAPIisbeingabusedbyapartnerenumeratinginvoicenumberstostealaccountdata?

ProtectionofB2BAPIsandeast-westAPIsrequiresbusinesscontextthatcannotbe

gainedbyanalyzingtechnicalelementslikeIPaddressesandAPItokensalone.Using

machinelearningandbehavioralanalyticstogainvisibilityintobusiness-relevantentitiesistheonlywaytounderstandandmanageriskeffectively.Businesscontextand

historicalbenchmarksfornormaluseofAPIsbyspecificentitieslikeyourusersorpartners—orevenbusinessprocessentities(invoice,payment,order,etc.)—makeitpossibletoseeanomaliesthatwouldotherwisegoundetected.

Akamai

DoAPIgatewaysoffersufficientriskprotection?

ManyorganizationstakingastrategicapproachtoAPIsuseAPIgateways.MostAPI

gatewayshaverichintegratedsecurityfeaturesthatorganizationsshouldtakeadvantageof—firstamongthoseisauthentication(andauthorizationaswell,ifyoucanleverage

OpenIDConnect).However,merelyperformingauthentication,authorization,andquotamanagementattheAPIgatewayisnotsufficientforseveralreasons:

ThediscoverygapofAPIgateways:APIgatewaysonlyhavevisibilityandcontrolovertheAPIsthattheyareconfiguredtomanage,makingthemineffectiveatdetectingshadowAPIsandendpoints.

ThesecuritygapofAPIgateways:APIgatewayscanenforceauthenticationand,tosomedegree,authorizationschemes,buttheydonotinspectpayloads(asWAFsandWAAPsdo),nordotheyprofilebehaviortodetectabuse.

WhatarethemostcommonAPImisconfigurationerrors?

ThenumberofpossibleAPImisconfigurationsisnearlyendless,giventhelargenumberofwaysthatAPIsareused.However,therearesomecommonthemesinmisconfiguration:

Brokenornoauthentication

AuthenticationisfoundationaltosecuringsensitivedatathatismadeavailableviaAPIs.SteponeisensuringthatallAPIscarryingsensitivedatahave

authenticationinplaceinitially.Butit’salsoimportanttoprotectauthenticationmechanismsfrombrute-forceattacks,credentialstuffing,anduseofstolen

authenticationtokensviaratelimiting.MisconfigurationsallowingAPI

consumerstobypassauthenticationmechanismscansometimeshappen,

oftenaroundtokenmanagement(forexample,somenotoriousJWTvalidationissuesornotcheckingthetokenscope).

|16

Akamai

|17

Brokenauthorization

OneofthemostcommonusesofAPIsistoprovideaccesstodataorcontent,includingsensitiveinformation.Authorizationistheprocessofverifyingthat

anAPIconsumeriseligibletoaccessthedatatheyaretryingtoaccess,priortomakingitavailabletothem.Thiscanbedoneattheobjectorresourcelevel(forexample,Icanaccessmyordersbutnotsomeoneelse’s)oratthefunctionlevel(asisoftenthecasewithadministrativecapabilities).Authorizationis

hardtogetrightbecauseofthehighnumberofedgecasesandconditionsandbecauseofthevariousflowsthatAPIcallscantakebetweenmicroservices.Ifyoudon’thaveacentralizedauthorizationengine,yourAPIimplementation

likelyincludessomeofthesevulnerabilities,suchasBOLAandBFLA.

Securitymisconfiguration

Inadditiontotheauthenticationandauthorizationissuesmentionedabove,

therearemanypossibletypesofsecuritymisconfigurations,includinginsecurecommunication(e.g.,failuretouseSSL/TLSortheuseofvulnerablecipher

suites),unprotectedcloudstorage,andoverlypermissivecross-originresource-sharingpolicies.

Lackofresourcesandratelimiting

WhenAPIsareimplementedwithoutanylimitsonthenumberofcallsthatAPIconsumerscanmake,threatactorscanoverwhelmsystemresources,leadingtoservicedegradationorfull-scaleDoS.Attheveryleast,ratelimitsmustbe

enforcedonaccesstoanyunauthenticatedendpoint,withauthentication

endpointsbeingofcriticalimportance—orelsebrute-forceattacks,and

credentialstuffingandcredentialvalidationattacks,aresimplyboundtohappen.

Akamai

WhatareAPIattacks?

APIattacksareattemptstouseAPIsformaliciousorotherwiseunsanctionedpurposes.A