Understanding the elements of API security

API security is a complex topic and comprises many elements — a successful API security initiative should be built upon a solid foundation of a DevOps practice and a balanced AppSec program. Just like a house, the strength of the overall structure is dependent on a solid foundation – without these in place, an API security initiative may prove challenging.

Good security is built on a multi-layer system – this is the defense in-depth approach.

It is important to remember that API security is quite different from what has come before with web application security. This means that using existing tools and practices may be insufficient to produce secure APIs. Dedicated API security solutions must be deployed in addition to traditional AppSec tools to provide the optimum coverage and protection specific to APIs.

The elements of the API security hierarchy are shown here:

Figure 1.2: The elements of API security

Let’s explore each of the layers of API security briefly.

DevOps

DevOps is a well-established set of practices to facilitate modern software systems, characterized by close relationships between the development and operations teams to improve methodology and practices and leverage the benefits of automation. DevOps is considered a continuous process with continuous improvements across several key domains in the Software Development Lifecycle (SDLC), as shown here:

Figure 1.3: The DevOps cycle

DevOps offers many benefits to the delivery of software, including the following:

• Improved collaboration and trust
• Faster release cycles
• Reduced time to repair
• Higher levels of automation
• Use of standard processes, including testing and deployment

From the perspective of API security, the key benefit of DevOps is the ability to build APIs in a deterministic fashion using a standard process. Using standard Continuous Integration / Continuous Delivery (CI/CD) pipelines, API security testing and validation tooling can be injected into the build process to ensure that all deployed APIs have had the specified security checks and controls applied to them. APIs by their nature are well suited to automated testing, and the CI/CD pipeline is the ideal place for this activity.

SAST, DAST, SCA, and WAFs

Static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and web application firewalls (WAFs) form the vanguard of traditional application security programs.

The security of any software can be improved by the judicious use of such tools, as follows:

• SAST can detect basic flaws in source code at the time of development
• DAST can detect application vulnerabilities at runtime
• SCA can detect the use of vulnerable components and libraries
• WAFs can afford some level of protection against certain attack types

SAST can detect common coding vulnerabilities in API code (such as injection flaws) but will not detect API-specific flaws (such as broken authentication or authorization), since the SAST engine does not have contextual awareness of the underlying API code. Similarly, DAST is able to detect certain API vulnerabilities (such as a lack of rate limiting) but lacks the context to understand the API requests and responses.

WAFs are a mature technology for protecting web applications and offer some protection for APIs as well. They operate in line with traffic utilizing a so-called allow list to block suspected malicious traffic and allowing everything else. They can be configured to operate in monitor mode (passive) or blocking mode (active).

Organizations typically have dedicated security teams tasked with deploying and operating these tools within development teams. These teams should evaluate dedicated API security tools to complement some of the gaps that exist with these tools.

API management and gateways

API gateways are the workhorse of the API industry, providing a unified external interface to public clients and traffic routing to the relevant internal API backends after having performed transformation and conversion. Gateways are also responsible for network-level controls such as SSL termination, rate-limiting, IP address restrictions, and load balancing. Gateways can also implement security features such as JWT validation and identity management.

Some of the shortcomings of API gateways include the following:

• API gateways provide a central point of entry for API traffic and are effective at acting as a gatekeeper at the front door of the customer infrastructure; however, they are less effective at protecting what goes on behind the door
• Gateways are ineffective at protecting against several of the OWASP API Security Top 10 vulnerabilities
• Gateways can be inefficient at providing security processing functions such as traffic inspection

Typically, API management portals provide a level of API management on top of a gateway, allowing organizations to control their inventory, versioning, life cycle, and end-user experience by providing API catalogs.

Some of the shortcomings of API management platforms include the following:

• APIM portals are effective for providing a central view of an API inventory and also a single point of deployment for API policy
• Effective APIM deployment is contingent on development teams embracing a design-first approach and enrolling their APIs into a central portal

Both API management portals and gateways are vital components of an API security strategy, but their limitations should be borne in mind as part of the overall strategy.

API security platforms

The growth of API adoption has spawned several dedicated API security platforms, with the specific intent of addressing API security as a first-class citizen.

These platforms take different perspectives of securing APIs, including the following:

• Continuous monitoring of API traffic to detect emergent threats using machine learning (ML) and artificial intelligence (AI) technology
• Dedicated API firewalls that can protect APIs by enforcing the OpenAPI contract – this is the positive security model covered in the next section
• Scanning APIs to validate the API behavior against an OpenAPI contract
• Providing audit tools to ensure OpenAPI contracts adhere to best practices for data and security

Dedicated API security tools are vital to providing the final layer of API security. Now that we understand the elements of API security, let us conclude this chapter by setting API security goals.