Importance of API security
Even with the simple code and template examples you have seen here, an attentive reader will realize that potential security flaws may arise from them since those simple data structures and queries can result in extensive resource consumption with a small number of lines. Secure software development is not a new buzzword but has gradually received more focus as new threats and attacks enter general awareness.
Some companies prefer investing more of their time and money into containment strategies, such as implementing an incident response team, bound to a business continuity plan. Albeit very important, we know that such teams are put into action when something has already happened. They can only do damage control, trying to reduce the impact some intrusion has on the company’s assets. Some other companies believe that their systems are secure simply because they are running on a public cloud. It is well known that public cloud players share this responsibility with their customers in a way that is called the shared responsibility model:
Figure 1.2 – The public cloud shared responsibility model
As it is valid with any substantial software being developed, APIs have their life cycles, and they belong to a pipeline. There is a general sense that security should be shifted left as much as possible, which means that concerns about potential flaws should be taken into consideration sooner rather than later. You need to think about security starting with the API design. However, this may not be exactly easy for companies with a small budget or without proper technical enablement. This is to say that not all companies adopt security countermeasures in the early stages because they simply cannot.
When developing an API, you should start by choosing the protocol your API will use. Consider the ones discussed here and select one that you believe will fulfill the application’s needs and user expectations. Look for the protocol’s drawbacks and verify the possibility of letting a public cloud player implement the API for you. All major players have API management or gateway offerings. They usually implement security best practices and are integrated with web firewalls.
APIs are frequently the only entrance doors, or at least the most used ones, for applications. This is why reinforcing them is paramount for any business segment. All parts of an API should get their corresponding protection. For example, how do you handle AuthN and Authorization (AuthZ)? Do you use tokens or only user/password credentials pairs? How are such tokens or credentials stored and how do they flow between your API endpoints and clients? Do you handle their life cycles? Do you record every time a token or credential is used and what parts of your system a user with such tokens or credentials tries to access? Do you frequently rotate tokens or credentials? Can you see how many questions were raised for a single point of attention? Badly handled AuthN and AuthZ may lead to potential intrusions and massive damage.
