Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

02:30 PM
Ivan Novikov
Ivan Novikov
Connect Directly
E-Mail vvv

5 Security Challenges to API Protection

Today's application programming interfaces are no longer simple or front-facing, creating new risks for both security and DevOps.

All APIs are different inside, even if they're using similar frameworks and architectures, such as REST. Under whatever architectural "roof," the data protocols are always different — even when the structure is the same.

You've likely heard of specific protocol formats, such as REST, JSON, XML, and gRPC. These are actually data formatting and transportation languages that act as APIs' spokes. Inside those formats is a lot of variation. These formatting languages are less "language" and more like airplanes that carry ticketed passengers that move through airports to get where they need to be. The languages passengers speak and their individual cultural details are highly different.

From a security perspective, the protocol itself does nothing. To be effective, security needs to translate the language and intention of each person coming through, not just let the passengers navigate freely.

Here are five challenges in API protection.

No Two Applications Are Alike
To protect an API, we also need to know how it was initially designed. It's not just reading the code or the coding nuances. It's reading and sorting through layers and permutations of codes that are influenced by technological complexity and human variation.

It's impossible to imagine how exactly a particular developer designed a particular app. We know that one of the common underlying API frameworks, such as XML or gRPC, will be used in many cases. Still, the types of data, markups, and the application logic itself will be different.

Parsers are challenged by variation. To address how an app was specifically designed, parsers can require a lot of data to decode. To decode the more sophisticated cases, data may have to be decoded two or three times. You may find JSON inside one layer, but another iteration of code somewhere else. These chains and layers of code can be vast.

Poor Communication Is Clogging Pipelines
To put in place rules for API protection, security teams need to understand what exactly a particular API endpoint should do and how it should be done. This information is supposed to come from the developers/DevOps team but often gets lost in cross-functional communication.

To understand how an API is supposed to function, security relies on documentation. Yet getting developers to write documentation for APIs and document carefully can be impossibly hard. That makes documentation unreliable.

When documentation is unreliable, aligning security with business goals for the API is difficult. Without the API's business purpose, security can block or allow the wrong things. Imagine the API is supposed to communicate shipping details. The security team may assume that the data in the API will be the name and the street address of the receiving party. If an API includes a UPS or carrier stripe-code on the shipping label, the security solution is likely to block it as a potential attack because a postal address cannot technically look like that.

Internal APIs Also Need Protection
In addition to using APIs to connect two different systems, APIs are going internal, responding to the pace and scale of API evolution and new tech. It's practically intuitive. Let's say that you choose to develop your app in Kubernetes. A set of internal APIs will be used to manage the individual microservices from the Kubernetes controller and to send the data back and forth between the individual containers. This creates new security considerations and may require an overhaul of your security landscape.

Your security needs to now protect both this internal API and front-facing APIs. Within management APIs, you can add users and keys or grant access to any server there — making internal APIs a huge area for vulnerability. These internal APIs can also be more mission-critical. Together, this means handling their security and how they behave in relation to other APIs have to be given equal or higher consideration as the externally facing connections.

Service APIs Create Additional Challenges
Modern times find us moving from physical servers to cloud services. Many of these cloud-based services (SaaS) allow consumers to connect via their browsers, like checking your email on a desktop. Many more SaaS are only available via APIs. These are service APIs. And they have added security challenges based on their high data volume and the total variations of security and authentication models. 

With service APIs, the two ends of the connection belong to two different businesses. Because they can't trust one another, different security and authentication models need to be developed to protect each party.

APIs Are Not Web Apps
APIs behave completely different than human requests from web apps, demanding new ways of thinking through security landscapes.

Imagine we want to protect a login API against credential-based static attacks and we want to block all bots. However, all the clients of the API are designed as automated tools. That technically makes them function as bots. For example, an e-commerce organization might want to have logins for its retailers, distributors, or other end users. Now, to protect the API, the security solution has to be able to identify normal, legal bots (customers using automation) from illegal bots. On the surface, they look and behave the same from traditional security perspectives.

Mobile access, which faces a lot of traffic from technical bots, adds to the growing problem of distinguishing "good" versus "bad" bots. To boot, those bots only come from a handful of external IP addresses based on the provider. Bot protection for APIs may seem like a simple process, but in reality, it is an enormous undertaking.

The challenges in security stem from how APIs have evolved quickly from simple, front-facing APIs. They are no longer simple, nor only front-facing. APIs are nuanced and totally smudged with human fingerprints. And they are more layered every day. As API security becomes increasingly complex, it will be important for developers and security practitioners to consider these challenges as they move forward.

Related Content:



Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Ivan Novikov is CEO of Wallarm, a provider of AI-powered application security. He is also a white hat security professional with over 12 years of experience in security services and products. He is an inventor of memcached injection and SSRF exploit class as well as a ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
4/27/2019 | 3:25:15 AM
Be ware to the theift
I also consider that none of these websites have a propoer accountibility.
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-09-17
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character.
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers.