A Comprehensive Look at API Security and Common API Vulnerabilities

Today, application programming interfaces, known as APIs, rule our online world. They are everywhere, from when we log into GDrive to how we book flights. They act as a software intermediary between applications that allows them to talk to one another and exchange information.

Every time you check the weather on your phone, you're using an API. Likewise, when you use an instant messaging service through a social media platform, APIs connect virtual and real-world devices using the Internet of things (IoT). However, while API security is a priority for all developers, they are still vulnerable to malicious actors. Here we discuss the current state of play for API security, what API vulnerabilities look like, and how to increase API protection. 

What Is API Security?

APIs and cybersecurity go hand in hand. In fact, since they're predominantly used over public networks, API security is a priority for developers at each stage of its design, particularly since highly sensitive information is often shared between two pieces of software using the API, such as login credentials. This means that integrating cybersecurity best practices when developing an API must be considered the benchmark upon release.

Since open authorization (OAuth) is the standard for transferring data across the Internet without the need for sharing passwords or other identifying information, API security solutions usually rely on representational state transfer (REST) or Simple Object Access Protocol (SOAP) to ensure data is both encrypted and unmodified.

REST works by using either Transport Layer Security (TLS) encryption or JavaScript Object Notation (JSON). REST API security relies on the TLS standard that keeps Internet connections private and checks that data sent between two systems is private and unmodified. REST APIs also use JSON to make data packets easier to transfer over the web, negating the need to repackage data, making the process faster than SOAP.

SOAP API security uses web security services defined by two major international bodies for confidentiality and authentication. These are the Organization for the Advancement of Structured Information Standards (OASIS) and the World Wide Web Consortium (W3C). SOAP API security implements XML encryption, XML signatures, and SAML tokens to verify authentication and authorization and is highly recommended for organizations that deal with sensitive data.

Benefits of API Security 

When best practice API security development is implemented, the benefits are clear. They include:

• Increased user protection when sending or receiving sensitive data between different applications, programs, or platforms.
• Increased protection for developers when transporting user data between different applications, programs, or platforms.
• Greater trust in B2B and B2C products and their security levels.
• Seamless and secure handling of operations without the need for multiple logins, data sharing, or other unwieldy processes.

Having said this, API vulnerabilities still exist, and understanding these is key to improving cybersecurity and data protection.

Common API Vulnerabilities and How Attackers Can Exploit Them

The OSWAP top ten serves as a guide for developers to identify the most common API vulnerabilities. Each is given its own code as follows:

• API1: Broken Object Level Authorization
• API6: Mass Assignment
• API2: Broken Authentication
• API7: Security Misconfiguration
• API3: Excessive Data Exposure
• API8: Injection
• API4: Lack of Resource & Rate Limiting
• API9: Improper Asset Management
• API5: Broken Function Level Auth
• API10: Insufficient Logging & Monitoring

Developers must address each of these vulnerabilities before release, and this list should form the foundation of any API cybersecurity approach. However, there are further threats that must also be recognized after release:

• When a cyberattacker applies sophisticated access control rules, the API may be tricked into believing they are a real user. Often, these API cybersecurity breaches are conducted by insiders using fake accounts.
• A cyberattacker can access the first layer of control rules by purchasing valid credentials from places like the dark web. This allows access to take over legitimate accounts. 
• There is a possibility that OAuth tokens can be obtained through phishing and other malicious vectors. Since they are often lightweight bearer tokens, they can be used anywhere and by anyone.
• Cyberattackers can look for vulnerabilities in your app by bypassing the client-side app. Mostly, these vulnerabilities are hidden from the API provider too.

How to Protect Your APIs Against Attacks

APIs and cybersecurity are critical to consumers, customers, and developers. Consumers must know that their data is safe when it is being transferred, customers (or app owners) need to know that the API will not undermine their security, and for the API developers, weak API protection means fewer customers.

• Tokens: This approach to API security employs tokens to establish trusted identities which then use those tokens to control access to resources.
• Encryptions and signatures: Encryption remains among the most powerful tool in deterring hackers across a wide range of cybersecurity areas. TLS is commonly used and ensures only authorized users can decrypt and modify data when combined with signatures.
• Vulnerabilities: Always be on the lookout for vulnerabilities. Identify weak spots in your API that were either there from design or appeared when working with other apps.
• Quotas and throttling: An increase in calls on your API may indicate that it is being hacked or that there is a programming mistake that may lead to vulnerabilities. Place quotas on API tracking and introduce rules for throttling to protect from denial-of-service attacks.
• API gateways: — In API, cybersecurity gateways are your fundamental point of traffic enforcement. A high-quality gateway will allow you to authenticate traffic and analyze API use.

Data Protection for Users

With the introduction of the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act of 2018 (CCPA), API security has been pushed to become more protective of user data. Using the above protections and best practices discussed below, any API can be easily compliant while offering high-level user data protection.

Data Protection for Customers

Protecting the software and apps that use APIs as a gateway is equally as important, and because they work in tandem, malicious cyberattacks may compromise both. Again, following security best practices alongside cloud API security protocols can help to protect customer data.

API Security Best Practices

API security follows a set of best practices that should be supported by other IT and security teams in any organization. However, at the API level, the following can be applied to increase security before and after release.

API Inventory

Using AI engines, you can inventory both existing and new API security levels that security professionals may have missed. API metadata helps identify and minimize blind spots. Additionally, resolutions can easily be transmitted to new and existing APIs when new threats are detected.

Access Control

OAuth and JWT allow you to authenticate traffic and define rules for who is allowed access. Going further, applying zero trust security principles enable each layer to make its own decisions based on the propagated identities.

Threat Detection

Using a combination of real-time and out-of-band threat detection balances the potential for both user and AI-generated threats. While connected to the Web, API security uses an API gateway, WAF, or agent applying a set of rules, with each request and response subjected to these rules.

However, since too much intervention may affect functionality and latency, out-of-bad API security tests can be run offline using an AI engine. When an AI engine identifies a vulnerability, that information can then be transferred to the active API.

Security Testing 

API security solutions should include continuous testing. This involves taking the cyberattacker's perspective and employing tools such as JavaScript and Postman to access the API in ways that the application doesn't while attempting to trick the API into sharing data that should not be available to the user.

Incident Response and Audits

It's imperative to log and refer precious API traffic and cybersecurity events. Regular audits of this data will help shape your response should an API security breach occur. Additionally, this data can be used for compliance and investigations to help repair damage. 

The Future of API Security

Digital transformation is growing exponentially, which means more APIs to handle cross-communication between many applications. The future of API security lies in greater awareness of the threats that, until now, have often gone under the radar.

However, other technologies such as GraphQL, Event-Driven-Architecture (EDA), and microservice APIs lead the way toward a more secure future for consumers and customers alike.

The Bottom Line

API security concerns are on the rise, and while IT, developer, and security teams have often been siloed, with the advent of SecOps, it's increasingly likely that API protection will become a core concern of these consolidated processes and methodologies. For now, however, following basic API best practices will help to provide robust protection for all stakeholders.

**This blog was originally published on November 9, 2022.