API Security

Maintaining a comprehensive and continuously updated inventory of all APIs across your organization is crucial for an effective API security strategy. On-demand or daily discovery is insufficient due to the severity of risks associated with API attacks. Moreover, visualizing actual API behavior (API calls) is necessary to enable key team members from security, development, and operations to understand how APIs are being used or misused. This facilitates communication and investigation across your organization’s teams. 

API Security offers automated and continuous discovery of APIs across various technologies and infrastructure. It also identifies newly deployed APIs and compares their properties with existing documentation. API Security detects often-missed shadow APIs and known API vulnerabilities, such as those outlined in the OWASP API Security Top 10. 

API discovery is an ongoing process, and our continuous monitoring finds new APIs and changes to existing ones around the clock. Security teams gain unparalleled visibility and are the first to know when developers deploy a new API or service.

APIs fuel every digital product and service an enterprise rolls out. So it’s no surprise APIs are growing in scope and scale. But this proliferation leads to an API sprawl that is reshaping your attack surface.

Today’s attackers look for API vulnerabilities — including software bugs or configuration errors — that they can exploit to:

• Gain access to sensitive application functionality
• Find, compromise, and/or steal sensitive data
• Misuse the API in malicious ways 

The OWASP API Security Top 10 provides a helpful summary of some of the most commonly exploited API vulnerabilities and threats that organizations should try to identify and address.

With API security, you can prevent vulnerable and misconfigured APIs from exposing your enterprise to API attacks by promptly notifying security, developer, and API teams of potential risks, configuration errors, and vulnerabilities. You can also easily determine if a partner has set up your API incorrectly or if there are vulnerabilities in the code. 

Contextual and conditional alerts work seamlessly within your existing workflows, such as by automatically creating a Jira ticket, enabling you to swiftly resolve any issues.

APIs are designed to be used programmatically, which makes differentiating legitimate usage from attacks and abuse extremely challenging.

While API threats attacks vary in approach, some of the most common ways include:

• Business logic abuse. Logic abuse is when a malicious actor exploits application design or implementation flaws to prompt unexpected and unsanctioned behavior benefitting the attackers. Legacy security controls cannot prevent this type of abuse, causing tremendous stress and pressure for CISOs and their teams.
• Unauthorized data access. Another common form of API abuse is exploiting broken authorization mechanisms to access data the attackers should not be allowed to access. These vulnerabilities carry many names, such as broken object level authorization (BOLA) and insecure direct object reference (IDOR), as well as broken function level authorization (BFLA).
• Account takeover. After a credential theft or even a cross-site scripting attack, an account can be taken over. Once that happens, abuse of even the most well-written and thoughtfully secured API is possible. After all, if you’re not performing behavior analysis, any authenticated activity is considered legitimate.
• Data scraping. As organizations make datasets available through public APIs, malicious actors may aggressively query these resources to perform wholesale capture of large, valuable datasets.
• Business denial of service (DoS). By asking the back end to perform heavy tasks, API attackers or users can cause “erosion of service” or a complete denial of service at the application layer (a very common vulnerability in GraphQL, but something that can happen with any resource-intensive API endpoint implementation). This can happen through an intentional attack or through overuse by a partner that causes the API to go down for other partners. 
• Vulnerability exploitation. Technical vulnerabilities in the underlying infrastructure can lead to server compromise. Examples of these types of vulnerabilities range from the Apache Struts vulnerabilities (CVE-2017-9791, CVE-2018-11776, and friends) to the Log4j vulnerabilities (CVE-2021-44228 and friends).

Identifying and mitigating these and other API security risks requires security controls that are sophisticated enough to address this complex and fast-evolving threat landscape. 

The API Security solution provides business context that cannot be gained by analyzing technical elements like IP addresses and API tokens alone. Using AI/ML –informed real-time traffic analysis, API Security outputs business context that enables you to do a thorough analysis of what happened before and after an alert, to identify a root cause. API Security also allows you to search APIs by specific entities, such as your users or partners, or even business process entities (invoice, payment, order, etc.), to make it possible to find anomalies that would otherwise go undetected.