Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

02:30 PM
Ivan Novikov
Ivan Novikov
Connect Directly
E-Mail vvv

5 Security Challenges to API Protection

Today's application programming interfaces are no longer simple or front-facing, creating new risks for both security and DevOps.

All APIs are different inside, even if they're using similar frameworks and architectures, such as REST. Under whatever architectural "roof," the data protocols are always different — even when the structure is the same.

You've likely heard of specific protocol formats, such as REST, JSON, XML, and gRPC. These are actually data formatting and transportation languages that act as APIs' spokes. Inside those formats is a lot of variation. These formatting languages are less "language" and more like airplanes that carry ticketed passengers that move through airports to get where they need to be. The languages passengers speak and their individual cultural details are highly different.

From a security perspective, the protocol itself does nothing. To be effective, security needs to translate the language and intention of each person coming through, not just let the passengers navigate freely.

Here are five challenges in API protection.

No Two Applications Are Alike
To protect an API, we also need to know how it was initially designed. It's not just reading the code or the coding nuances. It's reading and sorting through layers and permutations of codes that are influenced by technological complexity and human variation.

It's impossible to imagine how exactly a particular developer designed a particular app. We know that one of the common underlying API frameworks, such as XML or gRPC, will be used in many cases. Still, the types of data, markups, and the application logic itself will be different.

Parsers are challenged by variation. To address how an app was specifically designed, parsers can require a lot of data to decode. To decode the more sophisticated cases, data may have to be decoded two or three times. You may find JSON inside one layer, but another iteration of code somewhere else. These chains and layers of code can be vast.

Poor Communication Is Clogging Pipelines
To put in place rules for API protection, security teams need to understand what exactly a particular API endpoint should do and how it should be done. This information is supposed to come from the developers/DevOps team but often gets lost in cross-functional communication.

To understand how an API is supposed to function, security relies on documentation. Yet getting developers to write documentation for APIs and document carefully can be impossibly hard. That makes documentation unreliable.

When documentation is unreliable, aligning security with business goals for the API is difficult. Without the API's business purpose, security can block or allow the wrong things. Imagine the API is supposed to communicate shipping details. The security team may assume that the data in the API will be the name and the street address of the receiving party. If an API includes a UPS or carrier stripe-code on the shipping label, the security solution is likely to block it as a potential attack because a postal address cannot technically look like that.

Internal APIs Also Need Protection
In addition to using APIs to connect two different systems, APIs are going internal, responding to the pace and scale of API evolution and new tech. It's practically intuitive. Let's say that you choose to develop your app in Kubernetes. A set of internal APIs will be used to manage the individual microservices from the Kubernetes controller and to send the data back and forth between the individual containers. This creates new security considerations and may require an overhaul of your security landscape.

Your security needs to now protect both this internal API and front-facing APIs. Within management APIs, you can add users and keys or grant access to any server there — making internal APIs a huge area for vulnerability. These internal APIs can also be more mission-critical. Together, this means handling their security and how they behave in relation to other APIs have to be given equal or higher consideration as the externally facing connections.

Service APIs Create Additional Challenges
Modern times find us moving from physical servers to cloud services. Many of these cloud-based services (SaaS) allow consumers to connect via their browsers, like checking your email on a desktop. Many more SaaS are only available via APIs. These are service APIs. And they have added security challenges based on their high data volume and the total variations of security and authentication models. 

With service APIs, the two ends of the connection belong to two different businesses. Because they can't trust one another, different security and authentication models need to be developed to protect each party.

APIs Are Not Web Apps
APIs behave completely different than human requests from web apps, demanding new ways of thinking through security landscapes.

Imagine we want to protect a login API against credential-based static attacks and we want to block all bots. However, all the clients of the API are designed as automated tools. That technically makes them function as bots. For example, an e-commerce organization might want to have logins for its retailers, distributors, or other end users. Now, to protect the API, the security solution has to be able to identify normal, legal bots (customers using automation) from illegal bots. On the surface, they look and behave the same from traditional security perspectives.

Mobile access, which faces a lot of traffic from technical bots, adds to the growing problem of distinguishing "good" versus "bad" bots. To boot, those bots only come from a handful of external IP addresses based on the provider. Bot protection for APIs may seem like a simple process, but in reality, it is an enormous undertaking.

The challenges in security stem from how APIs have evolved quickly from simple, front-facing APIs. They are no longer simple, nor only front-facing. APIs are nuanced and totally smudged with human fingerprints. And they are more layered every day. As API security becomes increasingly complex, it will be important for developers and security practitioners to consider these challenges as they move forward.

Related Content:



Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ivan Novikov is CEO of Wallarm, a provider of AI-powered application security. He is also a white hat security professional with over 12 years of experience in security services and products. He is an inventor of memcached injection and SSRF exploit class as well as a ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
4/27/2019 | 3:25:15 AM
Be ware to the theift
I also consider that none of these websites have a propoer accountibility.
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...