5 Security Challenges to API Protection

All APIs are different inside, even if they're using similar frameworks and architectures, such as REST. Under whatever architectural "roof," the data protocols are always different — even when the structure is the same.

You've likely heard of specific protocol formats, such as REST, JSON, XML, and gRPC. These are actually data formatting and transportation languages that act as APIs' spokes. Inside those formats is a lot of variation. These formatting languages are less "language" and more like airplanes that carry ticketed passengers that move through airports to get where they need to be. The languages passengers speak and their individual cultural details are highly different.

From a security perspective, the protocol itself does nothing. To be effective, security needs to translate the language and intention of each person coming through, not just let the passengers navigate freely.

Here are five challenges in API protection.

No Two Applications Are Alike
To protect an API, we also need to know how it was initially designed. It's not just reading the code or the coding nuances. It's reading and sorting through layers and permutations of codes that are influenced by technological complexity and human variation.

It's impossible to imagine how exactly a particular developer designed a particular app. We know that one of the common underlying API frameworks, such as XML or gRPC, will be used in many cases. Still, the types of data, markups, and the application logic itself will be different.

Parsers are challenged by variation. To address how an app was specifically designed, parsers can require a lot of data to decode. To decode the more sophisticated cases, data may have to be decoded two or three times. You may find JSON inside one layer, but another iteration of code somewhere else. These chains and layers of code can be vast.

Poor Communication Is Clogging Pipelines
To put in place rules for API protection, security teams need to understand what exactly a particular API endpoint should do and how it should be done. This information is supposed to come from the developers/DevOps team but often gets lost in cross-functional communication.

To understand how an API is supposed to function, security relies on documentation. Yet getting developers to write documentation for APIs and document carefully can be impossibly hard. That makes documentation unreliable.

When documentation is unreliable, aligning security with business goals for the API is difficult. Without the API's business purpose, security can block or allow the wrong things. Imagine the API is supposed to communicate shipping details. The security team may assume that the data in the API will be the name and the street address of the receiving party. If an API includes a UPS or carrier stripe-code on the shipping label, the security solution is likely to block it as a potential attack because a postal address cannot technically look like that.

Internal APIs Also Need Protection
In addition to using APIs to connect two different systems, APIs are going internal, responding to the pace and scale of API evolution and new tech. It's practically intuitive. Let's say that you choose to develop your app in Kubernetes. A set of internal APIs will be used to manage the individual microservices from the Kubernetes controller and to send the data back and forth between the individual containers. This creates new security considerations and may require an overhaul of your security landscape.

Your security needs to now protect both this internal API and front-facing APIs. Within management APIs, you can add users and keys or grant access to any server there — making internal APIs a huge area for vulnerability. These internal APIs can also be more mission-critical. Together, this means handling their security and how they behave in relation to other APIs have to be given equal or higher consideration as the externally facing connections.

Service APIs Create Additional Challenges
Modern times find us moving from physical servers to cloud services. Many of these cloud-based services (SaaS) allow consumers to connect via their browsers, like checking your email on a desktop. Many more SaaS are only available via APIs. These are service APIs. And they have added security challenges based on their high data volume and the total variations of security and authentication models. 

With service APIs, the two ends of the connection belong to two different businesses. Because they can't trust one another, different security and authentication models need to be developed to protect each party.

APIs Are Not Web Apps
APIs behave completely different than human requests from web apps, demanding new ways of thinking through security landscapes.

Imagine we want to protect a login API against credential-based static attacks and we want to block all bots. However, all the clients of the API are designed as automated tools. That technically makes them function as bots. For example, an e-commerce organization might want to have logins for its retailers, distributors, or other end users. Now, to protect the API, the security solution has to be able to identify normal, legal bots (customers using automation) from illegal bots. On the surface, they look and behave the same from traditional security perspectives.

Mobile access, which faces a lot of traffic from technical bots, adds to the growing problem of distinguishing "good" versus "bad" bots. To boot, those bots only come from a handful of external IP addresses based on the provider. Bot protection for APIs may seem like a simple process, but in reality, it is an enormous undertaking.

The challenges in security stem from how APIs have evolved quickly from simple, front-facing APIs. They are no longer simple, nor only front-facing. APIs are nuanced and totally smudged with human fingerprints. And they are more layered every day. As API security becomes increasingly complex, it will be important for developers and security practitioners to consider these challenges as they move forward.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.