API Security:

An Introduction

Head of API Security

Proprietary and confidential. Do not distribute.

Digital transformation is driving
an rapid increase in API usage

Organizations are exposing more APIs are the core of service-

data to B2B partners and customers oriented and microservices
architectures

APIs power mobile, single-page APIs are the underpinning of

apps, and IoT DevOps, CI/CD, and Infra-as-code

70%+
Of web requests are API calls

Proprietary and confidential. Do not distribute.

API Security Challenges

Critical business functions and Security teams struggle to keep up

data are increasingly exposed via with the rapid proliferation of API’s
APIs

300 80% 50%

Of breached records +50%
Of businesses use
Minimum average APIs3 accessed Of enterprise APIs are not
of APIs an org via APIs and apps1 managed4
manages2

Fragmented technology ecosystem is Companies are leveraging 3rd party

too complex to secure APIs without APIs more frequently and place security
impacting business agility as high as reliability

1. Verizon 2019 Data Breach Incident Report, 2. Imperva poll, 3. MuleSoft 2020 Connectivity
Benchmark report, 4. Gartner Predicts 2021

Proprietary and confidential. Do not distribute.

Categories of API Attacks
API Becoming the New Attack Surface

Authentication Service Abuse Malicious Request Business Logic

Abuse/Data Theft

Credential abuse DoS/DDoS Injection Broken

Token API call volume Schema violation Object/Function
abuse/overuse based charging Level
Server-side
abuse Authorization
Authentication Request Forgery
bypass Message structure Excessive Data
Client agent
level abuse Exposure
Weaponization bypass (bad bot)
Data Exfiltration

Proprietary and confidential. Do not distribute. 4

Security Solutions for API
Protection
From Web Application Firewall(WAF) to Web Application and API Protection(WAAP)

Evolution of Conventional Solutions API Specific Protections

API Access Management Authentication/Access

Gateways Management API Business Integrity Automated detection and
Detect
and Data Protection remediation against anomalies

+
API Service Abuse
Protection DoS/DDoS Protection
Proactive/auotmated discovery
API Security Testing of vulnerabilities
From humans vs. bots to
good vs. bad bots
Bot Protection
Always up-to-date inventory of
Visibility APIs and their data exposure
Credential theft -> API Account Takeover
abuse Protection

Rule/Signature Based
API Fuzzing Protection
WAF

Proprietary and confidential. Do not distribute.

Why Reconnaissance API Gateway
Schema
Protection API Service

Conventional Analyze API call structure using

test accounts to collect valid
tokens

Solutions Are Not Broken Object Level Authorization

Enough?
(BOLA) attack

Use test user session to access

other users data

Get https://….com//api/v1/get_user_details …

● Typical API Access Management control …

authorization: Bearer eyJhbGciOiJIUzUxMiJ9 eyJhbGciOiJIUzUxMiJ9 1
…

cannot stop attacker leveraging an {

…..
Id: “11111”
✅ ✅
authorized session }

● Typical schema validation cannot Return Data

About User
2

detect/stop API calls with completely “11111”

conforming object payloads Get https://….com//api/v1/get_user_details …

…

● Applications are left to fend for authorization: Bearer eyJhbGciOiJIUzUxMiJ9

…
{
eyJhbGciOiJIUzUxMiJ9
3

themselves when it comes to object

…..
Id: “11112” ✅ ✅
}

level authorization
Return Data 4
About User
“11112”
Proprietary and confidential. Do not distribute.
API Security
starts with
discovery
● API’s app specific data layer make
automatic discovery necessary
● Beyond technical specifications,
automatic discovery must be able
to identify sensitive data
● Automatically updated API
Inventory is the foundation for
detection and remediation

Proprietary and confidential. Do not distribute.

Deployment Architectures
Prioritization Driven by Exposure Risks

Browsers, Apps, & Things

WAAP Gateway
Partner Access Devices

1. North-South
Public APIs
2. Externally exposed
API Gateway
Private APIs

Private Cloud

API Gateway 3. East-west Internal

APIs

Proprietary and confidential. Do not distribute.

A Full Life-cycle
Approach
● Start with deep discovery API Governance API Secure Operations
of production APIs
● Maintain an always up-to-
date API inventory to help BUIL
D C
TES
T
CD RUN
RUN
improve API governance I

● Enhance API security test

coverage automatic Help Dev with secure
API Design:
Help Dev/DevOps with
API security testing
Help DevOps and
SecOps secure APIs in
production
generation of tests from 2 Auto test gen
Spec Security 3 Discover APIs in 1
discovered APIs Assessment
from discovered
APIs
production

Spec Generation Proactive API API Anomaly

and Validation anomaly scan Detection and
Remediation

Proprietary and confidential. Do not distribute.

API Security Roadmap

DELIVERED COMING SOON (H2 2022) 2023 Future 2024

● Automated API Discovery ● Continue expansion of ● Expansion of API protocol ● Cloud Native, hybrid
with Data Classification auto-discovery (e.g. support mode, auto-scale
● API Schema Protection custom data ● Consolidation of deployment with
enhanced by auto- classification) management plane centralized management
merging of discovered ● Data centric anomaly ● Multi-form factor option
APIs detection (e.g. excessive remediation (e.g. actions ● Full support of API
● Support both SaaS and sensitive data exposure) against compromised Detection/Response
private cloud ● Tighter integration with accounts behind API ● Automated, Full Lifecycle
deployments platform features (e.g. abuses) API security:
● Automatic API Security bad bot prevention, ATO ● Cloud Native WAAP data ○ Auto-discovery driven
Test generation for protection) plane security verification
discovered APIs ● Expansion of integration ○ Auto-generation of
● API design security risk with existing API baseline from
assessment based on API Gateways monitoring API test
specifications (also called ○ Automated
API Security Audits) remediation actions
in response to API
anomaly

Proprietary and confidential. Do not distribute. 10

Back-up Slides

Proprietary and confidential. Do not distribute.

API Security Anywhere (more details) Serverless Platforms Imperva Controller Console
k8s Cluster

Management Console
Node

Pod Lambda Lambda

@ Edge Layers
Sidecar
Microsenso
r Advanced API Controller
Application (public or private cloud)

Container(s)

API Controller
Server / VM
Containers
Sniffer
Microsenso
r Additional Sources

Consumer
Services
Legacy Apps / Microservices

Server / VM

Packet Capture Log Consumer

Service Service
Microsensors Microsensors

Legacy Apps / Microservices

Network
Tap/Sniffer or
Proprietary and confidential. Do not distribute.
Traffic Mirroring
What We Found (1): Data Object Authz Risk
POST /…/…/…/orders/list/summary

13
What We Found (2): Authentication

14
API Verification
Cloud WAF API Security Add-on New Feature

Proprietary and confidential. Do not distribute.

Feature Highlight
● A new feature of the Cloud WAF API Security Add-
on
○ Generally Available now
○ Available to all add-on customers
● Two verification tools
○ API test generation for customers with no API
specification
■ Automatically generate API security tests based on discovered APIs
○ API specification security assessment for customers
who uploaded their API specification
■ Scan API specifications to generate a security assessment report on
the API design
● Customer Values
○ Enable secure API development.
■ Buyer: Security Team
■ Operator: Dev Test
○ Natural next step after API Discovery:
■ Discover and fix API vulnerabilities before they are exploited

Proprietary and confidential. Do not distribute.