Previous sections of this chapter have discussed the types of threats that are likely to be encountered by an organization and the policies that can be used to defend against them. This section will discuss how policies are defined using APIP CS.
The type of policy used will depend on whether APIs are being exposed on an internal gateway or an external gateway. Policies are designed by the API Manager in conjunction with Enterprise Security Architects. Generally, more consideration needs to be given to external-facing APIs as they will almost be certainly subjected to attack over the course of their life time. However, internal policies are still important, albeit that they are usually limited to authentication and authorization. The use of API gateways internally also helps to decouple and abstract systems, particularly for COTs functionality, since the APIs...
