The world runs on code. We secure it.
Solution Brief
CHECKMARX API SECURITY
You Can’t Secure What You
Can’t See
Challenges of API Security in a Modern, Cloud-Native World
The Decades-Long History of APIs. Љ Lower development effort - APIs allow
When observing common, monolithic developers to incorporate functionality
applications that are still in use today, APIs by borrowing it from third-party services
were considered a niche technology used instead of writing it themselves.
only in specific circumstances and to perform Љ Simplified user experience - APIs drive
certain functions in those environments. better user experiences by allowing users
However, in the early 2000s, companies like to share data with multiple applications
Salesforce, eBay, and Amazon built their seamlessly.
business on the usage of APIs and forever
changed how business is done online.
API Sprawl in a MAD World
Soon to follow, social media companies like Modern, cloud-native applications also
Facebook, Twitter, Flickr, etc., began building increasingly consist of microservices,
their platforms on APIs, which became the containers, open source libraries,
backbone of social media companies today. infrastructure as code, and an abundance
of APIs. In fact, so many APIs has caused a
And now, APIs are everywhere modern phenomenon called API sprawl.
applications can be found. APIs have grown
from a few dozen in the early 2000, and now, API sprawl challenges affect both internal APIs
estimates demonstrate that by 2030, nearly 2 that a company develops in-house to connect
billion APIs will be in operation. its own microservices or applications, and
external APIs which are APIs created by third
APIs Powering Cloud Transformation parties to support integrations with outside
As organizations embrace the benefits of the resources.
cloud transformation and begin moving their
monolithic applications to modern, cloud- API sprawl can become so great, and the API
native architectures (often assembled using documentation so haphazard, that security
loosely couple microservices), APIs are the teams have trouble keeping up. And in some
foundation of this transformation and enable: cases, developers aren’t telling security teams
about new or updates to existing APIs. As a
Љ Integrations – APIs make it easy to share result, security teams don’t know about them,
data between applications and services. and can’t configure other security controls to
Љ Distributed environments - APIs allow help protect them.
developers to take advantage of modern,
distributed infrastructures.
SOLUTION BRIEF | API SECURITY | 2
Common API Security Approaches are much sooner, within the software development
Inadequate life cycle itself.
Most organizations already have WAFs and API
gateways today to protect their applications – Not only can APIs be better secured with
including APIs. However, these solutions can’t superior secure coding practices, but they
protect what they can’t see. They don’t always can also be discovered in source code using
sit in front of the entire application and – in advanced static application security testing
the case of WAFs – often don’t have API- solutions like Checkmarx SAST, that discovers
level context to protect individual APIs. APIs during various phases of the SDLC.
Other solutions attempt to discover APIs
by integrating with and analyzing the traffic Even better, shadow APIs that are
flowing through these and other network undocumented and zombie APIs that should be
solutions, such as load balancers. These decommissioned can also be discovered and
solutions can discover APIs, but only for the inventoried, and then compared against what is
APIs that are behind these devices, so they defined in API documentation.
don’t fully address the problem of shadow and
zombie APIs. Being a leader in the application security
testing (AST) domain, Checkmarx has
API Security During Software developed a completely new and innovative way
Development of securing APIs that complements WAFs and
Although run-time security controls do help API gateways, so organizations can improve
to secure APIs, here at Checkmarx, we believe their API security posture overall.
there is a better way of addressing API security
Checkmarx API Security – A New Approach That’s Badly Needed
Checkmarx API Security, which is part of Љ Prioritized remediation: Focuses
the Checkmarx OneTM Application Security developers and AppSec teams on solving
Platform, provides a differentiated approach the most critical issues by prioritizing API
that becomes embedded into the modern API vulnerabilities based on their real impact
lifecycle to help organizations understand their and risk.
API footprint and overall security risk.
Љ Holistic view into application risk:
Scans the entire application with a
Checkmarx API Security Benefits: single solution, eliminating the need for
additional API-specific tools to reduce
Љ Complete API visibility: Provides AppSec
the overhead on over-burdened AppSec
teams with the most accurate and up-
teams
to-date view into their entire API attack
surface, eliminating the problem of
shadow and zombie APIs.
Љ True shift-left approach: Discovers APIs
in application source code to identify and
fix problems earlier in the SDLC—faster,
with less cost, and lower risk.
SOLUTION BRIEF | API SECURITY | 3
Checkmarx API Security Integrates With the Way You Build Software
Modern API lifecycle
Train Design Code Check-in Build Test Deploy
Train – Begins with our AppSec learning Check-in – Identifies vulnerabilities with
platform. API discovery and builds API inventory.
Helps your developers learn about potential Automatically scans source code at check-in
security vulnerabilities and improves secure or code merge to identify vulnerabilities in your
coding practices when starting to build APIs, APIs. Discovers every API in the application at
with content structured the way developers scan time, and aggregates findings for a full
want to learn, and making learning fun to help API inventory. Then compares the inventory to
drive adoption and consumption. your API documentation to find discrepancies
and pinpoint your shadow APIs.
Design – Takes an API-first security
approach. Build – Integrates into your pipeline with
Scans API documentation (i.e., Swagger, real-time feedback and automatic bug
RAML) files before your developers start tracking.
coding to ensure that security is added into Automatically scans source code in your
the design phase. Enforces API design best pipeline through CI/CD integrations, and
practices and assesses your overall API design immediately sends developers or AppSec
for misconfigurations, identifying risks in teams updates about vulnerabilities discovered
path definitions, authentication schema, and during Check-in or Build, then automatically
transport encryption. opens tickets for newly discovered
vulnerabilities and closes them when resolved.
Code – Integrates and automates scans
in the tools you use. Deploy – Secures application
Enables developers to remediate vulnerabilities deployments using infrastructure as
in their favorite tools where they can kick code.
off an application scan at any time using the Using KICS by Checkmarx, this open source
CLI, and not wait until after code check-in solution parses common IaC files to detect
to focus on security. It also provides guided insecure configurations that could expose
remediation to help resolve vulnerabilities your APIs to attack. It also integrates with CI/
faster by prioritizing, recommending mitigation CD tools and supports all mainstream IaC
points, and surfacing just-in-time learning for platforms, including Terraform, Kubernetes,
discovered vulnerabilities. Docker, AWS CloudFormation, Ansible, and
Helm.
SOLUTION BRIEF | API SECURITY | 4
Checkmarx One: API Security Results Overview
© 2022 Checkmarx Ltd. All rights reserved. Checkmarx is a registered trademark of Checkmarx Ltd. All other marks and trade
names mentioned herein belong to their respective owners. Checkmarx reserves the right to modify, transfer, or otherwise revise this
publication at its sole discretion and without notice.