By Anastasios Arampatzis
Developers of APIs (application programming interfaces) and API architects must be well aware of possible security mistakes and how to avoid them. Most developers and businesses already use third-party, internal, and private APIs. As such, a stunning 83% of all web traffic is now reported to be from APIs. Unfortunately, an increase in APIs also means more opportunities for attack.
Cybercriminals are persistent and constantly discovering novel ways to launch attacks. Previously, companies assumed that having authenticated API access would be sufficient to deter potential attackers. However, according to Salt Labs’ findings, 78% of attacks originate from individuals who appear to have legitimate access but have obtained it maliciously.
There is a distinct difference between simply building an API and designing and developing an API with the security features that allow it to address business needs reliably. Here are three of the most common API security mistakes to be aware of and best practices for avoiding them.
No Plan for API Security Governance
Not prioritizing API security governance can be attributed to various factors. For example, organizations might want to develop quickly, and API security is not seen as a priority to move a product to market. Besides the business rush, other factors may include the perception of managing API security or a lack of expertise on the subject. As a result, 30% of businesses having APIs in production admit they have no current API strategy.
However, not having a governance plan could expose an enterprise to API vulnerabilities and become a low-hanging fruit for attackers. API security governance is an essential component of API lifecycle management. API governance should start with identifying and documenting the APIs developed and used by the organization. A governance policy is also necessary to track which APIs can be accessed by which parties, who owns the APIs, and who is responsible for maintaining them. Without a clear picture of its API environment, an enterprise can suffer from a lack of agility as it tries to function without having a clear view of its environment.
Governance is also crucial in spotting threats to the business API ecosystem. Knowing what kind of attacks and security threats a business might encounter is vital to overall good security governance since API attacks could happen to anyone. The question is how well-prepared the organization is in detecting and responding to these threats.
Security should be a primary focus during the development of an API, not an afterthought. However, organizations must be cautious in selecting security tools that effectively prevent API attacks. Traditional approaches to API security may fail, leaving the organization exposed.
Forget about (the old) OWASP Top 10
The newer OWASP API Security Top 10 list is an industry standard in the API space. Typically, bad actors use combinations of these ten risks to propagate more sophisticated attacks. Implementing an API with no mechanisms for verifying who is trying to gain access and whether they have the appropriate authority exposes the API and any connected digital assets to criminals and malicious bots searching for vulnerabilities to exploit and access sensitive data.
Organizations should implement the absolute minimal level of API security, including the following three fundamental security mechanisms.
- Strong authentication must be used at the front end, requiring the verification of the entity – human or machine – accessing the API. Lack of adequate authentication results in account takeover and disclosure of sensitive information.
- Minimize the entities having access to the API front-end. When creating an API endpoint, it is essential to understand which business flow it exposes. Some business flows are more sensitive than others because excessive access to them may harm the company. Blocking IP addresses secures and limits access to APIs.
- Implement efficient authorization processes to separate each request’s data and information requirements and grant access accordingly based on predefined access levels.
Once these foundational security controls are established, businesses can further mature their API security program to strengthen their environment.
Inadequate In-house API Security
There is a potential danger to keeping API security in-house because mistakes can happen, even if security is a top priority during development. For example, poorly written API code may contain vulnerabilities that go unnoticed for criminals to exploit, putting the system’s security at risk. Additionally, an enterprise’s developers may need to spend significant time and effort ensuring that security standards are up-to-date, which could lead to delays and technical debt for other projects. Instead, businesses should leverage third-party API security providers that keep up to date with the latest API security trends. The security standards used by their platforms are routinely updated and enhanced to handle new threats.
With APIs being an essential ingredient of business success, paying attention to their security and falling for common mistakes is a good recipe. Businesses should protect APIs, just like safeguarding all their physical assets, to reduce business risk and innovate securely.
##
ABOUT THE AUTHOR
Anastasios Arampatzis is a retired Hellenic Air Force officer with over 20 years’ worth of experience in managing IT projects and evaluating cybersecurity. During his service in the Armed Forces, he was assigned to various key positions in national, NATO and EU headquarters and has been honoured by numerous high-ranking officers for his expertise and professionalism. He was nominated as a certified NATO evaluator for information security.
Anastasios’ interests include among others cybersecurity policy and governance, ICS and IoT security, encryption, and certificates management. He is also exploring the human side of cybersecurity – the psychology of security, public education, organizational training programs, and the effect of biases (cultural, heuristic and cognitive) in applying cybersecurity policies and integrating technology into learning. He is intrigued by new challenges, open-minded and flexible.
Currently, he works as a cybersecurity content writer for Bora Design. Tassos is a member of the non-profit organization Homo Digitalis.
