Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

02:30 PM
Ivan Novikov
Ivan Novikov
Connect Directly
E-Mail vvv

5 Security Challenges to API Protection

Today's application programming interfaces are no longer simple or front-facing, creating new risks for both security and DevOps.

All APIs are different inside, even if they're using similar frameworks and architectures, such as REST. Under whatever architectural "roof," the data protocols are always different — even when the structure is the same.

You've likely heard of specific protocol formats, such as REST, JSON, XML, and gRPC. These are actually data formatting and transportation languages that act as APIs' spokes. Inside those formats is a lot of variation. These formatting languages are less "language" and more like airplanes that carry ticketed passengers that move through airports to get where they need to be. The languages passengers speak and their individual cultural details are highly different.

From a security perspective, the protocol itself does nothing. To be effective, security needs to translate the language and intention of each person coming through, not just let the passengers navigate freely.

Here are five challenges in API protection.

No Two Applications Are Alike
To protect an API, we also need to know how it was initially designed. It's not just reading the code or the coding nuances. It's reading and sorting through layers and permutations of codes that are influenced by technological complexity and human variation.

It's impossible to imagine how exactly a particular developer designed a particular app. We know that one of the common underlying API frameworks, such as XML or gRPC, will be used in many cases. Still, the types of data, markups, and the application logic itself will be different.

Parsers are challenged by variation. To address how an app was specifically designed, parsers can require a lot of data to decode. To decode the more sophisticated cases, data may have to be decoded two or three times. You may find JSON inside one layer, but another iteration of code somewhere else. These chains and layers of code can be vast.

Poor Communication Is Clogging Pipelines
To put in place rules for API protection, security teams need to understand what exactly a particular API endpoint should do and how it should be done. This information is supposed to come from the developers/DevOps team but often gets lost in cross-functional communication.

To understand how an API is supposed to function, security relies on documentation. Yet getting developers to write documentation for APIs and document carefully can be impossibly hard. That makes documentation unreliable.

When documentation is unreliable, aligning security with business goals for the API is difficult. Without the API's business purpose, security can block or allow the wrong things. Imagine the API is supposed to communicate shipping details. The security team may assume that the data in the API will be the name and the street address of the receiving party. If an API includes a UPS or carrier stripe-code on the shipping label, the security solution is likely to block it as a potential attack because a postal address cannot technically look like that.

Internal APIs Also Need Protection
In addition to using APIs to connect two different systems, APIs are going internal, responding to the pace and scale of API evolution and new tech. It's practically intuitive. Let's say that you choose to develop your app in Kubernetes. A set of internal APIs will be used to manage the individual microservices from the Kubernetes controller and to send the data back and forth between the individual containers. This creates new security considerations and may require an overhaul of your security landscape.

Your security needs to now protect both this internal API and front-facing APIs. Within management APIs, you can add users and keys or grant access to any server there — making internal APIs a huge area for vulnerability. These internal APIs can also be more mission-critical. Together, this means handling their security and how they behave in relation to other APIs have to be given equal or higher consideration as the externally facing connections.

Service APIs Create Additional Challenges
Modern times find us moving from physical servers to cloud services. Many of these cloud-based services (SaaS) allow consumers to connect via their browsers, like checking your email on a desktop. Many more SaaS are only available via APIs. These are service APIs. And they have added security challenges based on their high data volume and the total variations of security and authentication models. 

With service APIs, the two ends of the connection belong to two different businesses. Because they can't trust one another, different security and authentication models need to be developed to protect each party.

APIs Are Not Web Apps
APIs behave completely different than human requests from web apps, demanding new ways of thinking through security landscapes.

Imagine we want to protect a login API against credential-based static attacks and we want to block all bots. However, all the clients of the API are designed as automated tools. That technically makes them function as bots. For example, an e-commerce organization might want to have logins for its retailers, distributors, or other end users. Now, to protect the API, the security solution has to be able to identify normal, legal bots (customers using automation) from illegal bots. On the surface, they look and behave the same from traditional security perspectives.

Mobile access, which faces a lot of traffic from technical bots, adds to the growing problem of distinguishing "good" versus "bad" bots. To boot, those bots only come from a handful of external IP addresses based on the provider. Bot protection for APIs may seem like a simple process, but in reality, it is an enormous undertaking.

The challenges in security stem from how APIs have evolved quickly from simple, front-facing APIs. They are no longer simple, nor only front-facing. APIs are nuanced and totally smudged with human fingerprints. And they are more layered every day. As API security becomes increasingly complex, it will be important for developers and security practitioners to consider these challenges as they move forward.

Related Content:



Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ivan Novikov is CEO of Wallarm, a provider of AI-powered application security. He is also a white hat security professional with over 12 years of experience in security services and products. He is an inventor of memcached injection and SSRF exploit class as well as a ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
4/27/2019 | 3:25:15 AM
Be ware to the theift
I also consider that none of these websites have a propoer accountibility.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-19
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
PUBLISHED: 2020-09-18
A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.
PUBLISHED: 2020-09-18
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
PUBLISHED: 2020-09-18
Improper Input Validation on Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11....
PUBLISHED: 2020-09-18
Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix ADC 12.1-FIPS before 12.1-55.187, Citrix ADC and NetScaler Gateway 12.0, Citrix ADC and NetScaler Gateway 11.1 before 11.1-65.12, Citrix SD-WAN WANOP 11.2 before 11.2.1a, Citrix SD-W...