Adapt Third-Party API Security to Three Specific Use Cases

COMMENTARY

API safety typically entails third-party, slightly than first-party, APIs, and every use case can have totally different necessities. Quite than attempting to make one technological method work for all cases, safety and threat administration leaders should adapt their method to the precise use case.

In line with a recent Gartner survey, 71% of IT leaders report utilizing third-party utility programming interfaces (APIs) of their organizations. Many safety and threat administration leaders should concentrate on API safety when coping with consumption and integration with third-party APIs, slightly than publicity of first-party APIs. 

As well as, in the case of third-party APIs, many remediation measures, akin to patching for exposures, usually are not below the group’s direct management. Due to this fact, the method should be basically totally different as in comparison with first-party APIs. 

Three use instances ought to be prime of thoughts for these safety leaders.

Use Case 1: Uncover and Handle Outbound Knowledge Flows to Third-Occasion APIs

On this first use case, the enterprise sends information to 3rd events through APIs, sometimes by invoking them from homegrown functions. In an e-commerce situation, as an example, the service offering the API could possibly be a fee gateway. On this instance, the outgoing visitors would comprise fee information used to course of a fee. There are alternative ways to invoke the API from inside the utility, akin to direct integration, utilizing a software program growth equipment or a webhook.

A foremost threat is that delicate information could also be despatched towards the API. This exercise could battle with enterprise insurance policies or trade rules. Third-party APIs might also put the information, or the information of shoppers, at risk. For instance, an attacker might be able to steal fee information from prospects by utilizing a weak fee API. Relying on the situation, injecting a malicious payload might additionally corrupt the database of a enterprise companion.

On this situation, safety leaders ought to uncover third-party APIs by performing visitors inspection, code repository inspection, and software program composition evaluation, as sure third-party APIs could also be invoked through third-party libraries, not homegrown code.

Safety leaders must also liaise with the staff that manages sourcing, procurement, and vendor administration (SPVM) and third-party cyber-risk to make sure software-as-a-service (SaaS) functions are vetted and adjust to organizational insurance policies.

Safety leaders should additionally establish delicate information exfiltration by monitoring the outgoing visitors in these API exchanges. That is sometimes achieved by implementing information loss prevention (DLP) capabilities. Disparate instruments might apply—for instance, safety service edge (SSE), DLP, and API safety instruments all have sure DLP capabilities.

Lastly, safety leaders can implement correct authentication and authorization of the API shopper (on this situation, the appliance) utilizing the mechanisms provided by the API supplier. At a minimal, favor tokens over API keys for authorization. Assess how opaque and proof-of-possession tokens (or no less than incessantly rotated entry credentials) and certificates pinning could effectively mitigate token leakage and interception dangers in particular use instances. Be conscious of the technical burdens they could require to set them up and points with visitors inspection.

Use Case 2: Defend From Inbound Site visitors From Third-Occasion APIs

On this use case, the group consumes the third-party API, and the information is incoming. A typical instance could possibly be an enterprise utility that makes an API name to acquire information from a industrial SaaS supplier or a enterprise companion.

One threat on this use case is receiving probably dangerous enter from the API. Malicious enter from third-party APIs could endanger functions, its customers, or the infrastructure internet hosting functions. For instance, if an API response with a malicious payload is shipped to a database, it might end in an injection assault.

Knowledge exfiltration continues to be a threat for this use case, and most of the suggestions from the primary use case nonetheless apply right here. If the outgoing API request comprises delicate information, that information could possibly be intercepted. For instance, if an API name requests an inventory of eating places primarily based on GPS coordinates, stated GPS coordinates could possibly be intercepted if the connection shouldn’t be safe. Most significantly, the third-party API could possibly be fetching the precise information of the enterprise. (Assume, for instance, of an API fetching information about prospects from particular cases of a CRM SaaS utility.)

Safety leaders ought to carry out enter validation. Ask builders so as to add enter validation controls when ingesting any enter, together with enter from third-party APIs. This can stop a big spectrum of assaults from malicious enter, akin to SQL injection assaults. Utility safety testing (AST) instruments might help automate these checks.

Use Internet utility firewall performance from a Internet utility and API safety device in-line so as to add contingencies in opposition to injection assaults and different kinds of malicious enter.

Lastly, vet the enter with an antivirus, sandboxing, or content material disarm and reconstruction answer by integrating functions sometimes through Web content material adaptation protocol or APIs with a number of of those instruments.

Use Case 3: Uncover, Vet and Handle the Knowledge for Third-Occasion Apps That Talk through APIs

Many safety leaders are targeted on API safety however describe a situation the place a number of SaaS functions sometimes talk through APIs, exchanging enterprise information. This situation will be exacerbated as a result of customers might be able to interconnect SaaS functions with out having administrative privileges. Whereas the underlying communication could also be API-based, this drawback’s answer is nearer to the most effective practices for SaaS safety.

This case is especially difficult when a certified SaaS utility person connects it through API to an unauthorized SaaS app. Many organizations can have little to no visibility of the connection’s existence, not to mention of any information transfers throughout it. Second, visibility is restricted to what SaaS suppliers reveal by their very own administration APIs, as there is no clear place to insert an in-line management. The principle threat with this situation is that the SaaS utility could expose delicate enterprise information through the API, and that information could also be transferred to an unapproved and even unknown location that safety has not vetted.

Safety leaders ought to uncover the SaaS functions utilized by performing a census, releasing a coverage, and inspecting visitors. Use SSE, firewalls, SaaS administration platforms, or different instruments to establish the SaaS functions customers are accessing, particularly these housing delicate information. Till they know what functions customers are accessing, they can not test for SaaS-to-SaaS connectivity

Uncover rogue SaaS entry tokens by querying the SaaS functions used, the place supported. Create and promote coverage to customers about connecting SaaS apps through OAuth.

For the earlier use instances, liaise with the staff that manages SPVM and third-party cyber-risk to make sure SaaS functions are vetted and adjust to organizational insurance policies, akin to information safety and third-party sharing ones. As well as, stock SaaS-to-SaaS interconnections; automated tooling, akin to SSPM choices, might help guarantee this can be a steady course of.

By adapting their approaches to those three particular use instances and their potential variations, safety leaders can tackle the dangers that third-party APIs current for his or her organizations.