Developing modern applications can be highly complex due to several disparate services that communicate with each other. Developers need to be deliberate about how they include business logic in their code. This can become time-consuming, and developers are forced to tack on security as an afterthought. Inevitably, this lax approach to security gives attackers a chance to easily compromise critical workloads. In fact, a recent report found that a shocking two-thirds of organizations lack a basic API security strategy.
Why do APIs need API security?
Traditionally, Application Programming Interfaces (APIs) have been used to help one server communicate with another server. However, with the advent of microservices, APIs have become essential for many-to-many communication between servers.
As applications grow in value to the end user so do they grow in complexity. Developers are pressured to increase productivity. Startups like Tabnine and Raycast have had impressive funding rounds recently, indicating how important developer productivity has become. With this pressure to perform, developers don’t have the time to test each API connection for vulnerabilities or perform periodical penetration testing to ensure that new attack surfaces are not being introduced.
The API Security Checklist
As mentioned, security, like most things, is easier when you have a good plan in place. Developers and reviewers can perform checks on APIs at their level without compromising on due dates. An exhaustive checklist would cover all bases and help teams streamline their API security strategy.
1. OWASP threats
The most important checks to cover as part of this checklist are the OWASP API Security Top 10 threats. Both developers and reviewers should perform reviews to ensure that these threats are covered in the API security strategy. The top API security threats are well-documented, and teams can find plenty of material online to understand them and find ways to protect their APIs from these common threats.
2. Authorization and authentication
Authorization and authentication checks are critical and should be performed rigorously to ensure APIs are fully secure. Teams can enter user input to see how APIs react and confirm no sensitive information is exposed on the client-side. Teams should also ensure any data filtration is done on the server-side and not on the client side. An authorized user might not see additional, sensitive data, but attackers can easily access this data. Rate limits and throttling are effective ways to prevent DDoS. If users have no limits on the number of times an API is called, attackers could deliberately ping that API till the server crashes.
3. Security configuration
APIs can also be compromised if the security configuration is incorrect. Security misconfigurations could happen if developers aren’t well-versed with API security processes or due to a compromised API update. Either way, these security flaws allow attackers to access critical workloads. Checks on security configuration are a vital part of any API security checklist.
4. Hidden form fields
Attackers can also manipulate APIs via hidden form fields. Security and development teams should use the inspect element option in web browsers to check for hidden form fields. If any hidden form fields are found, teams should enter random inputs to understand the API response and document the observations.
5. SQL/NoSQL injections
Injections can be a little tricky to deal with. Attackers can use SQL and NoSQL injections to an API to access data on the server. With command injections, attackers could try to manipulate the servers directly. To ensure attackers cannot access the server, teams can append OS commands in the API inputs and check the servers’ response.
6. Data encryption
Data encryption is another crucial step developers can take to ensure the security of their APIs. Teams should show relevant data only to authorized users upon decryption on the client-side. This ensures data isn’t accessible to malicious actors. Developers should architect an encryption strategy that is up to industry standards. Developers should also effectively abstract any data like passwords or keys so unauthorized personnel do not have access to sensitive data.
7. Clear ownership
Tasks like encryption and elimination of sensitive data should be developers’ responsibility. At the same time, Ops teams should focus on updating APIs, eliminating obsolete APIs, and security configuration checks. Testing teams can own tasks like input fuzzing, parameter tampering checks, and authentication checks. It finally boils down to how teams are structured and how the responsibility can be shared across different members without creating silos.
Download our API security checklist
API security is multi-faceted and requires a lot of attention to detail. Today, security cannot be an afterthought. With thousands of API connections being used in workloads, it is hard for security teams to do patch-up work once a build is done. With a complete checklist, organizations can standardize API security across teams. And, teams can focus on what really matters while also making security a priority. To help with this, we created an API security checklist with all vital criteria listed in an organized manner. Download this checklist to plug any loopholes in your API security strategy. This checklist will also help teams truly collaborate and deliver products that aren’t just up to the mark, functionally, but are also secure.
