Application programming interfaces (APIs) allow businesses to package their internal resources and make them accessible in well-defined infrastructures. External-facing APIs make it possible for businesses to adopt the inverted firm model that has defined the success of every modern tech giant and countless smaller platform businesses.

Companies adopting public APIs thrive, with market capitalizations up to 38% higher over a decade and a half, and those using private APIs enjoy more frictionless operations. Consequently, adoption is growing across the board. If you're a developer and currently not using APIs, chances are you will be soon.

But, as the API ecosystem grows, bad actors have also recognized the wealth of new attack surfaces opening up. Let’s examine the impact of APIs on security and see how you can adjust your workflow to eliminate the risks they pose.

API security

APIs have become so crucial that companies now prioritize them when building software. However, providing strong APIs is a delicate exercise. It involves creating portals large enough to serve meaningful application logic and data but not so large that you expose sensitive or critical points in your infrastructure.

Your business may encourage third-party innovation by making your app’s back-end system more accessible. Unfortunately, this often opens avenues of attack over mobile or cloud channels.

Inadequately secured APIs are susceptible to endpoint attacks, access-based exploits and many of the same incursions used against web protocols. Even after rolling back your system to regain data locked down by ransomware, your production secrets, customer data and potentially your entire IT security topography can be compromised. If the data includes personally identifiable information (PII), you’ll need to consider the cost of sorting out compliance issues as well.

API versus general web security

Compared with securing traditional web applications, protecting APIs demands more careful and advanced approaches. Both API traffic and web traffic are susceptible to injection-based attacks. However, APIs present additional data exfiltration and resource access concerns based on their structure.

Because API design isn’t comprehensively standardized, developers have a lot of freedom in how they design their APIs. However, this freedom makes it challenging to ensure security risks are mitigated at the code level.

Securing API gateways is also becoming challenging as companies increasingly adopt cloud-native architectures and distributed systems in all areas of their businesses. Each service in a distributed system generally has an independent release cycle, so you need to manage API gateway configuration per component as opposed to managing the configuration across the entire solution. 

If you notice a web attack from an IP address, you can block all traffic from that specific IP address. With API security, you have greater control to block specific malicious actors instead of blocking all traffic from the IP address.

API vulnerabilities

Common attack vectors for APIs include insufficient logging and monitoring, security misconfiguration, and injections. Cyber attackers aim to compromise the network, exploit the system and steal sensitive data. In addition to infrastructure logging, such as logging network events, API logging is equally essential as it helps you detect any malicious activities in your network. Efficient logging of API events like authorization and authentication failures and input validation failures will help you detect abnormal API usage.

Attackers look for misconfigurations in API servers so that they can exploit them. These may include unnecessary HTTP methods, misconfigured HTTP headers, unencrypted data in motion, missing security patches and the use of default configuration with weak authentication.

To launch an injection attack, the attacker sends malicious data to an API and expects the parser or interpreter to process and pass the data to the backend integrated services without validation. Ideally, the parser or interpreter should sanitize, filter or validate data before sending it to the back-end system. Threats associated with injection attacks include remote code execution (RCE), denia of service (DoS), and data loss or compromise. 

High-profile breaches

Some of the most high-profile recent security breaches were API attacks:

• The December 2021 Log4j attack was facilitated by issues with API security. Attackers issued unauthenticated requests containing malicious content to apps that use the Log4j logging library.
• Clubhouse experienced an API breach after improperly securing its API with token and password authentication. The leak led to the exposure of 1.3 million user records, including IDs, names, Twitter handles and photo URLs.
• In June 2021, an attacker used an authentication-free API to exfiltrate the personal data of about 700 million users from LinkedIn, including phone numbers and email addresses. The attacker then offered the data for sale.

Securing APIs

Optimal API security means that security must be a primary design feature from the start. One prevalent security measure is adopting a shift-left approach while shielding right to stop attacks. Shifting left means that testing occurs earlier in the development cycle, enabling you to find and eliminate API vulnerabilities before deployment. Shielding right is a mechanism for putting controls in place that protect your running applications. These security measures fill in the API-specific security gaps that traditional web security tools do not address. 

This method of API protection will require you to inspect API traffic at runtime, deploy vulnerability scanner tools to examine running applications for vulnerabilities and analyze the source code.

However, these labor-intensive practices require developers to devote a significant part of development and a product’s post-deployment lifecycle to security. As API adoption grows more quickly than security practices can accommodate, it’s often best to consult with experts for help with managing the complexities of integrating a complete API security strategy.

Conclusion

As APIs become the default communication system for modern services and products, it’s essential to keep up with new threats and vulnerabilities. The structural nuances of APIs, including support for many architectural styles and complex formats such as custom binary data formats, JSON, serialized objects, and XML, which make them well-suited to customization, also present new vulnerabilities. 

Creating a robust security architecture and ensuring your APIs are deployed and used correctly is a complex, labor-intensive task that should be handled by experts like those at Contrast Security who are experienced in navigating the quickly shifting API security landscape. Check out Contrast Security to see how you can meet your API security needs.