API Security

Before jumping into API security lets talk about what API is:

API platform needs to have the capabilities and vision to execute your digital strategy. The TIBCO Responsive Application Mesh is our vision and strategy for modern application architecture supported by a blueprint for operationalizing this vision, and market-leading technology required to build it. 

essential to achieving this vision by empowering business and IT teams to work together seamlessly to connect and deliver digital representations of business capabilities.

·       Access Control

·       Service Isolation and Separation of Concerns

·       Consistent Monitoring and Reporting

·       Event-Driven Monitoring and Automated Response

·       Reducing Staff Burden with AI

API Security:

Broken, exposed, or hacked APIs are behind major data breaches. They expose sensitive medical, financial, and personal data for public consumption. That said, not all data is the same nor should be protected in the same way. How you approach API security will depend on what kind of data is being transferred. 

API security is concerned with the transfer of data through APIs that are connected to the internet.

You probably don’t keep your savings under your mattress. Most people their money in a trusted environment (the bank) and use separate methods to authorize and authenticate payments. API security is similar. You need a trusted environment with policies for authentication and authorization.

Common Attacks against API:

·       Injection Attacks. Injection attacks occur when malicious code is embedded into unsecured software.

·       DoS/DDoS Attacks.

·       Authentication Hijacking.

·       Data Exposure.

·       Parameter Tampering.

·       Man in the Middle (MitM)

·       Unencrypted Communications.

·       Application Abuse.

Solutions:

• Prioritize security. API      security shouldn’t be an afterthought or considered “someone else’s      problem.” Organizations have a lot to lose with unsecured APIs, so make      security a priority and build it into your APIs as they’re being      developed.

• Inventory and manage      your APIs. Whether an organization has a      dozen or hundreds of publicly available APIs, it must first be aware of      them in order to secure and manage them. Surprisingly, many are not.      Conduct perimeter scans to discover and inventory your APIs, and then work      with DevOps teams to manage them.

• Use a strong authentication and authorization solution. Poor      or non-existent authentication and authorization are major issues with      many publicly available APIs. Broken authentication occurs when APIs do      not enforce authentication (as is often the case with private APIs, which      are meant for internal use only) or when an authentication factor      (something the client knows, has, or is) can be broken into easily. Since      APIs provide an entry point to an organization’s databases, it’s critical      that the organization strictly controls access to them. When feasible, use      solutions based on solid, proven authentication and authorization      mechanisms such as OAuth2.0 and OpenID Connect.

• Practice the      principle of least privilege. This      foundational security principle holds that subjects (users, processes,      programs, systems, devices) be granted only the minimum necessary access      to complete a stated function. It should be applied equally to APIs.

• Encrypt traffic using      TLS. Some organizations may choose not to      encrypt API payload data that is considered non-sensitive (for example,      weather service data), but for organizations whose APIs routinely exchange      sensitive data (such as login credentials, credit card, social security,      banking information, health information), TLS encryption should be      considered essential.

• Remove information      that’s not meant to be shared. Because APIs      are essentially a developer’s tool, they often contain keys, passwords,      and other information that should be removed before they’re made publicly      available. But sometimes this step is overlooked. Organizations should      incorporate scanning tools into their DevSecOps processes to limit      accidental exposure of secret information.

• Don’t expose more      data than necessary. Some APIs reveal far too      much information, whether it’s the volume of extraneous data that’s      returned through the API or information that reveals too much about the      API endpoint. This typically occurs when an API leaves the task of filtering      data to the user interface instead of the endpoint. Ensure that APIs only      return as much information as is necessary to fulfill their function. In      addition, enforce data access controls at the API level, monitor data, and      obfuscate if the response contains confidential data.

• Validate input. Never      pass input from an API through to the endpoint without validating it      first.

• Use rate limiting. Setting      a threshold above which subsequent requests will be rejected (for example,      10,000 requests per day per account) can prevent denial-of-service      attacks.

• Use a web      application firewall. Ensure that it is able to      understand API payloads.

Last but not Least

APIs have arguably become the preferred method for building modern applications, especially for mobile and Internet of Things (IoT) devices. And while the concept of pulling information into a program from an outside source is not a new one, constantly evolving app development methods and the pressure to innovate means some organizations may not yet have grasped the potential risks involved in making their APIs publicly available. The good news is that there’s no great mystery involved in securing them. Most organizations already have measures in place to combat well-known attacks like cross-site scripting, injection, distributed denial-of-service, and others that can target APIs. And many of the best practices mentioned above are likely quite familiar to seasoned security professionals.