What is API Security?

APIs (Application Programming Interfaces) are a key part of digital transformation strategies, and securing those APIs is a top challenge. APIs are a rapidly growing attack surface that isn't widely understood and can be overlooked by developers and application security managers.

Take it from the OWASP API Security Project: “APIs are a critical part of modern mobile, SaaS, and web applications and can be found in customer-facing, partner-facing, and internal applications. By nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.”

---

How are API-based apps different?

Again, from OWASP:

• The server is used more as a proxy for data.
• The rendering component is the client, not the server.
• Clients consume raw data.
• APIs expose the underlying implementation of the app.
• The user’s state is usually maintained and monitored by the client.
• More parameters are sent in each HTTP request (object IDs, filters).

---

How is API Security different from general application security?

API Security focuses on strategies to mitigate the unique security risks of APIs. Traditional vulnerabilities are less common in API-based apps:

• SQLi – Increasing use of ORMs.
• CSRF – Authorization headers instead of cookies.
• Path Manipulations – Cloud-based storage.
• Classic IT Security Issues - SaaS.

---

Why is API security important?

API security is important because businesses use APIs to connect services and to transfer data, so a hacked API can lead to a data breach.

---

API usage continues to rise

In December 2021, Cloudflare reported that API calls accounted for 54% of total requests and increased 21% from February to December 2021. Attackers have taken notice and increased their focus on APIs.

API security testing is part of the core capabilities in the Gartner MQ for Application Security Testing.

APIs have become an essential part of modern applications (e.g., single-page or mobile applications), but traditional AST toolsets may not fully test them, leading to the requirement for specialized tools and capabilities. The ability to discover APIs in both development and production environments and test API source code, as well as the ability to ingest recorded traffic or API definitions to support the testing of a running API, are typical functions.

---

What is the OWASP API security top 10?

OWASP recently announced the API Security Top 10 Release Candidate. Read more about the OWASP API Security Project. Here is the top 10:

• API1 - Broken object level authorization
• API2- Broken user authentication
• API3 - Excessive data exposure
• API4 - Lack of resources & rate limiting
• API5 - Broken function level authorization
• API6 - Mass assignment
• API7 - Security misconfiguration
• API8 - Injection
• API9 - Improper assets management
• API10 - Insufficient logging & monitoring

---

Fortify helps with API security

API security with Fortify:

• Attack surface coverage – Discover new and shadow API endpoints automatically during testing and identify the breadth of endpoints with OpenAPI, Swagger, Odata, or WSDL schemas.
• API authentication – API authentication is varied and complex. Fortify supports virtually all types of bearer tokens and implementations.
• Vulnerability detection – Ever-expanding coverage of API-specific vulnerabilities affecting areas such as bearer tokens or GraphQL introspection.
• Scan automation – Scale API testing with enterprise-grade orchestration delivered via SaaS, hosted, or on premise.