Optimize APIs with API security best practices

Enterprise businesses are continuing to move toward digitalized and cloud-based IT infrastructures. Digital systems enable unprecedented flexibility, scalability and speed when compared to their more traditional, on-premises counterparts.

However, digital infrastructures are highly dependent on application programming interfaces — or APIs — to facilitate data transfers between software applications and between applications and end users. As the backend framework for most web and mobile apps, APIs are internet-facing and therefore vulnerable to attacks. And since many APIs store and transfer sensitive data, they require robust security protocols and attentive monitoring practices to prevent information from falling into the wrong hands.

Explaining API security

API security refers to the set of practices and products an organization uses to prevent malicious attacks on, and misuse of, APIs. Given the complexity of API ecosystems, the growth of IoT platforms and the sheer volume of APIs organizations utilize (about 20,000 on average), getting a handle on API security is both increasingly challenging and increasingly necessary.

APIs sit between an organization’s IT resources and third-party software developers, and between IT resources and individuals, delivering data and information at process endpoints. It’s at these endpoints that company and user data is vulnerable to various types of attacks and security risks, including:

• Authentication-based attacks: where hackers try to guess or steal user passwords or exploit weak authentication processes to gain access to API servers.
• Man-in-the-middle attacks: where a bad actor steals or modifies data (e.g., login credentials or payment information) by intercepting requests and/or responses between the API.
• Code injections/injection attacks: where the hacker transmits a harmful script (to insert false information, delete or reveal data, or disrupt app functionality) through an API request, exploiting weaknesses in the API interpreters that read and translate data.
• Denial-of-service (DoS) attack: these attacks send scores of API requests to crash or slow down the server. DoS attacks can often come from multiple attackers simultaneously in what’s called a distributed denial-of-service (DDoS) attack.
• Broken object level authorization (BOLA) attacks: occur when cybercriminals manipulate object identifiers at API endpoints to gain unauthorized access to user data. This issue arises when an API endpoint allows a user to access records they normally shouldn’t. BOLA attacks are especially common, because implementing proper object-level authorization checks can be difficult and time-consuming.   

These and other types of cyberattacks are all but inevitable in today’s dynamic IT landscape. And with cybercriminals proliferating and gaining access to more sophisticated hacking technologies, implementing API security protocols will only become more crucial to enterprise data security.

API security best practices

APIs enable businesses to streamline cross-system integration and data sharing, but with this interconnectivity comes increased exposure to cyberattacks. In fact, most mobile and web application hacks attack APIs to gain access to company or user data. Hacked or compromised APIs can lead to catastrophic data breaches and service disruptions that put sensitive personal, financial and medical data at risk.

Fortunately, advancements in API security make it possible to prevent or mitigate the impact of cyberattacks by malicious actors. Here are 11 common API security practices and programs organizations can leverage to protect computing resources and user data:

1. API gateways. Installing an API gateway is one of the easiest ways to restrict API access. Gateways create a single entry point for all API requests, and act as a security layer by applying security policies, helping to standardize API interactions and offering features like request/response transformation, caching and logging. 
2. Robust authentication and authorization. Using industry-standard authentication protocols — like OAuth 2.0, API keys, JWT, OpenID Connect and more — ensures that only authenticated users can access enterprise APIs. Also, implementing role-based access controls prevents users from accessing resources they aren’t authorized to use.   
3. Encryption protocols. SSL connection or TLS encryption protocols — like HTTP Secure (HTTPS) — help teams secure communication between the API and client applications. HTTPS encrypts all network data transmissions, preventing unauthorized access and tampering. Encrypting data at rest, such as stored passwords, can further protect sensitive data while it’s in storage.
4. Web application firewalls (WAFs). WAFs provide an extra layer of protection for enterprise APIs, especially from common web app attacks like injection attacks, cross-site scripting (XSS) and cross-site request forgery (CSRF). WAF security software can analyze incoming API requests and block malicious traffic before it reaches the server.
5. Data validation. In the same way that people screen phone calls and avoid opening attachments from unknown senders, organizations should screen everything its servers accept and reject any large data or content transmissions (including those from consumers). Using XML or JSON schema validation and confirming parameters can also be helpful in preventing attacks.
6. Rate limiting. This protects resources against brute force and DoS attacks by restricting the number of requests a user or IP address can make in a certain amount of time. Rate limits ensure that requests are processed quickly, and that no user can overwhelm the system with harmful requests.
7. Security testing. Security testing requires developers to submit standard requests using an API client to assess the quality and correctness of system responses. Conducting regular API security tests — for example, penetration tests, injection tests, user authentication tests, parameter tampering tests and more — to identify and address vulnerabilities helps teams fix vulnerabilities before attackers exploit them.
8. API monitoring and patching. As with any software application or system, regular monitoring and maintenance are integral to maintaining API security. Keep a watchful eye for any unusual network activity and update APIs with the latest security patches, bug fixes and new features. Monitoring should also include awareness of and preparation for common API vulnerabilities, like those included on the Open Web Application Security Project (OWASP) top 10 list.
9. Auditing and logging. Keeping comprehensive, up-to-date audit logs — and reviewing them often — allows organizations to track all user data access and usage, and record every API request. Staying on top of API activity can be challenging, but implementing auditing and logging procedures can save time when teams need to retrace their steps following a data breach or lapse in compliance. And since they provide a record of normal network behavior, audit logs can also make it easier to spot anomalies.
10. Quotas and throttling. Like rate limiting, throttling restricts the number of requests your system receives. However, instead of operating at the user or client level, throttling works at the server/network level. Throttling limits and quotas protect the API’s backend system bandwidth by limiting the API to a certain number of calls or messages per second. Regardless of quotas, it’s important to assess the volume of system calls over time, as increased volume can indicate abuse and/or programming errors.
11. Versioning and documentation. Every new version of API software comes with security updates and bug fixes that shore up security gaps in earlier versions. And without proper documentation practices, users can accidentally deploy an outdated or vulnerable version of the API. Documentation should be thorough and consistent, including clearly stated input parameters, expected responses and security requirements.

AI and API security

Among existing API security measures, AI has emerged as a new — and potentially powerful — tool for fortifying APIs. For instance, companies can leverage AI for anomaly detection in API ecosystems. Once a team has established a baseline of normal API behavior, it can use AI to identify system deviations (like unusual access patterns or high-frequency requests), flag potential threats, and respond immediately to attacks.

AI technologies can also enable automated threat modeling. Using historical API data, AI can build threat models to predict vulnerabilities and threats before bad actors can exploit them. If an organization is dealing with a high volume of authentication-based attacks, it can use AI to install advanced user authentication methods (like biometric recognition), making it more difficult for attackers to gain unauthorized access.

Furthermore, AI-powered tools can automate API security testing protocols, identifying security gaps and risks more efficiently and effectively than manual testing. And as API ecosystems grow, so too can AI-based security protocols. AI enables businesses to monitor and secure many APIs simultaneously, making API security as scalable as the APIs themselves.

Stay on top of API security with IBM

The importance of API security cannot be overstated. As we move further into the age of digital transformation, reliance on APIs will only continue to grow, with security threats and bad actors evolving in kind. However, with API management tools like IBM API Connect, organizations can ensure their APIs are managed, secure, and compliant throughout their entire lifecycle.

Securing APIs will never be a one-time task; rather, businesses should see it as a continuous and dynamic process requiring vigilance, deftness and openness to new technologies and solutions. Using a combination of traditional API security practices, and newer AI-based approaches like Noname Advanced API Security for IBM, companies can ensure that IT resources remain as secure as possible, protecting both the consumer and the enterprise.

Register now for our webinar on AI, automation and API security

Learn more about the IBM partnership with Noname Security