By Ross Moore

Anything is Possible!

A retired developer friend of mine was often asked by his colleagues, “Is such-and-such possible?” His response was, “Anything’s possible. How much do you want to spend?”

Technology has almost no limits. There are all kinds of tools, resources, knowledge, etc. available for securing organizations and providing a Wow! customer experience. These things make great security, compliance, and business projects possible. But the question is, “What can we afford?”

Each business has 24 hours a day, but that’s all that businesses have in common. Vision, mission, culture, number of personnel, revenue, expenses – everything after “number of hours in a day” is up for grabs.

This factor makes “How do I secure my company’s applications?” impossible to answer with specificity lacking any approach other than experts working directly with an org. And the same truth applies – “how secure can we make it?” can be answered with “how much do you want to spend?”

A post like this can provide some helpful guiding principles. Let’s check out some ideas for improving security, specifically application security.

Traditional Tools

API Gateways and Web Application Firewalls are two common assets used to protect applications. Here are brief descriptions of them.

Gateways

API gateways handle the authentication and authorization of requests to access APIs. API gateways handle incoming traffic requests specifically trying to access the API.

Some features of API gateways include:

• Allowlists
• Blocklists
• Rate-limiting
• Traffic management

Web Application Firewalls (WAFs)

WAFs protect web assets – including APIs – from malicious traffic coming from outside the local network.  WAFs provide:

• Known attack detection
• Abnormal request detection
• Virtual patching
• Bot detection and mitigation

What’s Missing?

While WAFs and API gateways can be part of a layered security strategy, protecting web apps doesn’t mean what it used to. With the rapid increase of API use (including the enormous mobile app market), the use of a website presence is being overtaken by mobile apps and IoT. Protecting corporate assets has moved from thinking about protecting just the network perimeter. One needs to move from only thinking of a web presence to considering interconnectedness.

These two traditional security controls miss certain types of attacks because they lack the ability to understand API context and don’t have a baseline for normal API behavior. Their focus is often geared primarily to known and isolated vulnerabilities, such as SQLi and XSS. They aren’t designed for the “low-and-slow attacks”. Methodical, trickling, and metered attacks are missed, obfuscated to appear as normal or benign traffic.

WAFs and gateways only protect the information that passes through them. Without a way to keep track of inventory, any shadow or zombie APIs will not be protected. WAFs and gateways don’t provide insight into contextual API data.

What’s The Solution?

Application Security (AppSec) solutions – specifically API security solutions – need to include features such as:

• Continually updated inventory of all resources (including shadow and zombie APIs)
• Resource analysis for vulnerabilities (e.g., outdated NPM packages)
• Detection of runtime security anomalies
• Integration with the SDLC to prevent vulnerabilities being pushed to production
• Integration with WAFs and Gateways

AppSec solutions also needs to protect an organization from:

• Brute forcing to obtain sensitive IDs or tokens
• Account Takeover (ATO affects almost 25% of U.S adults)
• Targeting sensitive APIs and attempting to validate stolen cards
• Malicious automation and bots
• Malicious or disallowed traffic sources
• Insider Threat (APIs abused by insiders for privilege escalation)
• Performing a high number of permissions changes
• Injection issues (command execution, XSS, SQL Injection)
• High velocity requests leading to stolen content or resource exhaustion

Bonus security Level

An additional option is to open up a bug bounty or vulnerability disclosure program. This will encourage security researchers to find issues before threat actors find them – or at least report what could have already been discovered by criminals (who won’t let you know until it’s too late). Researchers and threat hunters will go beyond finding straightforward vulnerabilities and misconfigurations; they will take time to discover the technologies, map out the application, and find where all the virtual trails lead. An example is the recent finding by a security researcher of a long-time flaw in a Python tarfile.

Have a System

One could call it a program, a platform, a solution, or a system.  A recent quote I saw says, “Goals are for those who want to win once; systems are for those who want to win consistently.” Security goals will secure a company for the day; appsec systems, while complex, will provide a comprehensive view of one’s security ecosystem, along with a foundation that provides longevity to the security program.

It’s reminiscent of the Shakespearean quote, “What’s in a name?” Whatever it’s called, the set of resources – people, processes, and technologies – that one will use to provide reasonable AppSec needs to use the proper resources to secure company and customer data.

There’s a lot to moving beyond traditional tools, such as a WAF, while also affirming traditional principles, such as having a system. But the importance of layered security applied to modern technology is a must in today’s applications.

What’s next for your organization? Take the next step, and the next step will follow.

##

ABOUT THE AUTHOR

Ross Moore is the Cyber Security Support Analyst with Passageways. He was Co-lead on SOC 2 Type 1 implementation and Lead on SOC 2 Type 2 implementation, facilitated the company’s BCP/DR TTX, and is a HIPAA Security Officer. Over the course of his 20 year IT career, Ross has served in a variety of operations and infosec roles for companies in the manufacturing, healthcare, real estate, business insurance, and technology sectors. He holds (ISC)2’s SSCP and CompTIA’s Security + certifications, a B.S. in Cyber Security and Information Assurance from WGU, and a B.A. in Bible/Counseling from Johnson University. He is also a regular writer at Bora.