This week we are mostly discussing best practices and tools, such as:
- The best methods to pass API keys and other sensitive data
- Tools that attackers use to discover APIs
- Why API security is never set-&-forget
Risks
Never put API keys or other sensitive information in URLs or query parameters. These are visible to browser extensions, server logs, browser history, shared links, and as the referrer address. Always use headers or POST method instead. See this article by Paris Mitton for details.
Tools
According to ย Akamai’s Tony Lauro, 83% of web traffic is API traffic. Although this may not necessarily be the best way to track API usage (traffic is significantly skewed by streaming applications like Netflix), but it does show how APIs are starting to power pretty much everything we do online.
In his article, Lauro talks about how APIs are also becoming increasingly hard to hide from attackers. He discusses some of the tools that attackers are using, including:
- Fierce.pl
- Certificate Transparency Logs
- GitRob
Best Practices
Andrew Useckas, CTO of ThreatX, has written a blog post that lists and explains his key points for building and connecting security-friendly APIs:
- Strong authentication
- Short-lived tokens
- TLS transport encryption
- Standard authentication and authorization on every endpoint
- Sanitized user input
Opinions
ComputerWeekly has done a fascinating interview with Andrew van der Stock (Synopsys and OWASP). Andrew argues that API Security cannot be “set-and-forget”:
- API security needs to become part of API development and testing.
- Protection needs to be a part of API design.
- Full monitoring must be an integral part of runtime.
You can subscribe to this weekly newsletter at https://APISecurity.io
Get API Security news directly in your Inbox.
By clicking Subscribe you agree to our Data Policy
