September 2017

API Security
in the Enterprise
API Security in the Enterprise:
How a DevSecOps Approach

How a DevSecOps Delivers Reliable API Security

Approach Delivers
Reliable API Security

September 2017
 Executive Summary

Executive
Summary
Today’s enterprise software architecture is a complex web or when linking to external APIs provided by other suppliers
of internal and external services being drawn together and partners, an enterprise can set security policies and
to enable new value to be delivered to customers at a levels of rigor that match the appropriate risk of exposure.
lightening pace. Any successful, forward-thinking enterprise
today is leveraging the power of application programming API security takes a holistic view of network and system
interfaces (APIs) to connect a wide range of services, data, level security risks, message and transport security,
external providers and internal business capabilities into authentication and authorization protocols, and ongoing
new workflows, mobile applications, and customer-facing vulnerability testing. Sensitive data exposure, customer
products. confidentiality, regulatory needs, deployment infrastructure
and business risk are all assessed. API Security processes
However, this architecture approach also introduces more educate and share common knowledge amongst all
security opportunities to enter via vulnerabilities in third business and development team members responsible
party frameworks, in unsecured access to APIs, to security for API architecture within an enterprise, and encourage
gaps when inputting data, and to application backdoors. The applying the right security protocols to address the level of
threat surface layer has widened. risk attached to each API resource.

API Security is often mentioned as a critical concern to Finally, repeatable, automated security processes
enterprise. But it is also often considered as a roadblock strengthen an enterprise’s security foundations and reduce
to speed and innovation, and left out of development and the impact of implementing new security procedures on
operational discussions. future innovation. It is here that API security management
becomes DevSecOps, enabling development and
Security must become a first class member of the API operations teams to work at the speed of innovation while
lifecycle development team. By using techniques such as implementing robust, security measures that protect
threat modeling when first defining the API to be created, protect enterprises and their customers.

2
 Contents

Executive summary 02

Introduction: The complexity

of modern enterprise Software 04

API Security Defined 05

Key API Security Risks 06

Security as risk control 08

Managing complexity in an API World by Ivan Ristic 09

The expanding landscape for defending

our digital resources by Kin Lane 09

A Holistic DevSecOps Strategy 11

Applying DevSecOps to
an enterprise API strategy 13

About 42Crunch 15

3
 Introduction: The Complexity of Modern Enterprise Software

Introduction:

The Complexity of
Modern Enterprise Software

Application programming interfaces (APIs) have redefined This has resulted in the enterprise now having a blurred
the way the modern enterprise delivers value to customers. security perimeter 1. Today’s enterprise uses internal APIs
to access their own microservices, partner and SaaS APIs
Building products faster, integrating with other services to draw in information or carry out workflow tasks, and
and businesses that a customer uses, personalizing the external APIs that provide specific functionality. In turn, this
customer experience, and offering global, always-on, mobile melting pot of internal and external services may be used
engagement is now all possible “because APIs”. to create new products which are then exposed by the
APIs are a doorway that have enabled enterprises to enterprise as an API for external developers and customers.
build new connections into their monolithic software and In this new enterprise IT API-enabled architecture, the
data systems. This has allowed them to draw on more data increased access points mean more security risks that need
to understand customer needs, speed up new product to be managed.
development, and scale up their systems to ensure access
for a global audience. 1 It is necessary to deal with uncontrolled “clients” (usually
mobile devices), that may have been compromised.
Of course, doorways work in both directions. So while
an enterprise may expose its data assets and business 2 Using APIs leads to a multiplication of endpoints that
capabilities via API, they are also making much more use of need to be managed.
external services in their own systems by relying on APIs
from third parties. This introduces new threats into the 3 Business innovation and faster creation of apps mean
enterprise as external APIs may not have been built with some shortcuts might be taken.
the same level of security as the enterprise requires when 4 The new enterprise architecture multiplies the set of
mixing in its own data and assets. These underprotected operating systems and dependency frameworks that
APIs may inadvertently offer an unsecured back door into an need to be reviewed, secured and maintained.
enterprise system.
5 In a complex web of interactions, enterprises have lost
APIs are often being used in conjunction with newer control over an application’s logic flow, opening the way
software development and delivery approaches, including to new vulnerabilities.
microservices (packaging an enterprise’s capabilities into
smaller, reusable and discrete units), containers (a method
to create consistent application objects, as needed, to
deliver services), and software-as-a-service (SaaS) tools
(drawing on third party cloud-based products to carry out
non-core business tasks).

1. Building the Network of the Future: Getting Smarter, Faster, and More Flexible with a Software Centric Approach,
John Donovan, Krish Prabhu, CRC Press, 2017

4
 API Security: Defined

API Security:
Defined
API Security is a critical concern to enterprise, but is often API Security involves creating a security architecture
considered a roadblock to speed and innovation. There is a that can:
fairly common experience in businesses where the security
or risk management internal stakeholder is “accidentally help an enterprise achieve its security goals and
forgotten” off team emails and left out of development effectively prevent attacks.
cycles, for fear that their participation will slow down
progress and launch dates. There is often a conflicting value Architecture that achieves security goals will be focused on
base within product development teams where the product meeting customer data regulations and company-defined
manager responsible for driving new product development privacy standards, ensuring transactions are always reliable
is reviewed on key performance indicators reflecting the and safe, and that highly competitive data and capabilities
number of product launches achieved. Any participation are only ever shared with paying customers and trusted
by security-focused team members is seen as a potential partners. Effectively preventing attacks ensures that the
obstacle to achieving the next product launch. enterprise software architecture can defend the many risk
vectors and threat surface layers that can be compromised
But participation early in the team — or having multiple in an API-enabled infrastructure.
product development team members being responsible
for security — does not need to slow down development
and can, in fact, clarify and improve product development
without creating large risks that need to be later addressed
in production.

API Security recognizes three layers:

Application Security approaches taken during a product development lifecycle to ensure security goals
security and prevent security gaps being built into an application.

System Security approaches that control access to a computer system’s resources, especially data
security and operating system files.

Network Security approaches to prevent and monitor unauthorized access, misuse, data modification
security or denial of access to an enterprise computer network and network-stored resources.

5
 Key API Security Risks

Key API
Security Risks
There are a number of vulnerability risks that can be
To achieve the twin aspects of achieving security introduced by underprotected APIs. “I think that a lot of people
goals and effectively preventing attacks across the think that because there is no graphical user interface (GUI)
three security layers, API security must uphold the on an API that no one can find it and it is invisible. But we can
following principles: find them in about five seconds with a proxy. You can get in
between the web browser and whatever it is calling and you
Data validation ensures only can see all the APIs there and you can start talking to them…
properly formed data is entering in So a lot of people are just not securing APIs whatsoever, so
an information system, preventing almost every threat that applies to a web app, can happen to
Data
malformed data from persisting an API,” said Application Security Evangelist Tanya Janca, on the
Validity
in the databases and triggering Application Security Podcast2. “A lot of people for some reason
malfunction of various downstream are not protecting them as much as their web applications.”
components.
Some of the security threats that can be introduced due to
lax API security include:
Messages and data transferred via
Integrity
APIs have not been tampered with.
Cross-site scripting (XSS)
Messages and data transferred via Cross-site scripting is an attack where the attack’s code
Confidentiality APIs are only visible to the intended presents itself as being from the user’s browser client.
target audience. “When an attacker gets a user’s browser to execute his/her
code, the code will run within the security context (or zone)
The enterprise architecture of the hosting web site. With this level of privilege, the code
is resistant to attacks such as has the ability to read, modify and transmit any sensitive
Availability data accessible by the browser. A Cross-site Scripted user
Distributed Denial-of-Service (DDoS)
attack. could have his/her account hijacked (cookie theft), their
browser redirected to another location, or possibly shown
fraudulent content delivered by the web site they are
The API caller is known and visiting,” writes the Web Application Security Consortium3.
Authentication
recognized.

The identified API caller has the

Dependency vulnerabilities
Authorization proper permission levels to access a Many APIs and third party applications are built using
resource via API. programming frameworks and libraries. This speeds up
development time by drawing on a common programming
The enterprise architecture system scaffold rather than reinventing the wheel in each new
Audit logs all machine and human actions application. Attackers often try to target frameworks
for later review, if needed. because they are not often monitored by third party users
and they offer a much wider surface layer of attack as they
may be used in multiple projects that the attacker can then
There is a legal-level of proof stored target. Often, when a framework vulnerability is identified,
Non-repudiation to demonstrate each action taking the framework makers may update their product to patch
place via API. that vulnerability. But third party services may not have
updated the version of the framework they are using in
production, leaving their API exposed to the type of attack4.

2. [Link]
3. [Link]
4. From Library to Vulnerability: Dependency Security Vulnerabilities Exposure, Marcin Lewak, March 22, 2017,
6 [Link]
 Key API Security Risks

Distributed Denial of Service attacks data before continuing to pass it on8. For APIs, these type
of attacks are possible when there is no verification that the
In an API paradigm, these are attacks where the API is being requester is the legitimate API caller authorized to make the
called constantly, making it more difficult for others who API request, and/or that the message received has been
may want to make API calls to access the service because verified as untampered with and sent by the API provider.
it is being used to the network’s limit. Scott Behrens and
Bryan Payne from Netflix also describe API-focused DDoS
attacks, where attackers identify which API calls will create Message tampering
the most work inside an application, and then send excessive Message tampering is a security attack that occurs when a
requests to that API. “A single request at the edge can fan man-in-the-middle attack has successfully intercepted an
out into thousands of requests for the middle tier and API call and has been able to modify the data before it is
backend microservices. If an attacker can identify API calls then passed on.
that have this effect, then it may be possible to use this fan
out architecture against the overall service. If the resulting
computations are expensive enough, then certain middle tier SQL injections
services could stop working. Depending on the criticality of
these services, this could result in an overall service outage,” SQL injections are attacks where a nonsensical or malicious
they wrote on the Netflix Tech Blog in July 20175. dynamic query is made via an API call to test whether it
can be received and processed9. SQL injections (or XPath
One other form of DDoS emerging is to make excessive API and XQuery injections in XML databases) affect the logic of
calls to a serverless system with the aim of driving up the an executed query so that if preventative, robust secure
costs for the API provider. Because serverless systems are coding is not in place, the system tries to carry out the
scalable and can continue to support new API calls, it may query until system failure or information leakage occurs.
be more difficult to cause a service outage by flooding the For example, if an input field requires a 16-digit credit card
API with requests. Instead, in a DDoS attack for serverless number but that field has not been specified as requiring 16
systems, the goal is to drive up the costs for the API digits for input, the system may freeze or act unexpectedly
provider, who is paying for each API call being made to their when trying to process a 10-digit number. Similarly, circular
serverless architecture6. queries that request account balances from user names,
where the SQL query also asks for the customer user name
could accidentally return customer usernames or other data
Information leakage that is not intended.
One of the most dangerous forms of information that can
easily be leaked via API, are API keys, secrets and passwords. Unauthorized access
Janet Wagner, from ProgrammableWeb reported in 2015 that
attackers regularly create bots to search GitHub repositories Unauthorized access to an API occurs when there are
for any API keys and passwords stored in code as text. “API insufficient authentication and authorization protocols in
security involves more than just securing the API itself: it place to determine if the API caller should be able to make
involves protecting API Keys, cloud credentials, and other an API request or if they have the adequate permissions to
sensitive data from public exposure,” wrote Wagner7. access the data that they are requesting. This can occur due
to a lack of robust authentication standards being used, or
where the API security policy does not sufficiently define the
Man-in-the-middle attacks user roles and what data and capabilities they are allowed
Traditionally, a man-in-the-middle attack allows an attacker to access via the API.
to “intercept the network communications between a
browser and the server, and to read, block or modify” the

5. Starting the Avalanche: Application DDoS in Microservices Architecture, Scott Behrens & Bryan Payne, July 28, 2017,
[Link]
6. Could Zombie Toasters DDoS My Serverless Deployment?, Liz Rice, January 10, 2017, [Link]
7. Why Exposed API Keys and Senstive Data are a Growing Concern, Janet Wagner, Jan 5, 2017,
[Link]
8. Securing Web Applications Against Man in the Middle Attacks, Robin Sellom & William Ferguson, Feb 1, 2016,
[Link]
9. [Link]

7
 Security as Risk Control

Security as Risk
Control
When incorporating a DevSecOps approach As Chairman of the OpenID Foundation
into API lifecycle management, there are and identity and privacy standardization
some definite must-do tasks. Ensuring the expert Nat Sakimura writes, “security is a
whole development and operational team has risk control measure.” Sakimura argues that
an understanding of broad security issues, there is always a need to balance the cost and
having processes in place to monitor potential benefit of focusing on and implementing any
vulnerabilities in third party frameworks and security measures. A threat model of all APIs
libraries, and ensuring appropriate barriers are within an enterprise architecture can help
in place to prevent SQL injections and that limit determine how business critical each API and
risk of DDoS attacks are all part of a robust API the assets and capabilities are that are being
security plan. exposed. Sakimura suggests protecting an API
resource with a low value can be done with
Another core task is to develop a security policy existing authentication protocols, for example.
that defines the threat model of all components However, for something like writing data to the
of the enterprise API-enabled software Financial API (which records a user’s financial
architecture10. A threat model is a structured account transactions), then higher levels of
approach that analyzes API and identifies and security protocol coding around authentication
quantifies any potential security risks. But once and authorization may be needed.
this threat model has been defined, the level of
10. OWASP Adds Unprotected APIs, Insufficient Attack Protection
security required for each component may vary “In the security sphere, one size does not fit
to Top Ten 2017 Release, Madison Moore, April 12, 2017,
depending on the risk that any attack would all. We have to take ‘appropriate measures’
[Link]
present to the enterprise. instead,” writes Sakimura11.
attack-protection-top-ten-2017-release/
11. Fixing OAuth?, Nat Sakimura, July 20, 2016,
10. OWASP Adds Unprotected APIs, Insufficient Attack Protection to[Link]
Top Ten 2017 Release, Madison Moore, April 12, 2017,
[Link]
11. Fixing OAuth?, Nat Sakimura, July 20, 2016, [Link]

8 8
 Managing Complexity in an API World

Managing At the lowest level, the main challenge

is to know where your infrastructure
being discovered and even Certifica-
tion Authorities (CAs) are being shut

Complexity in is located. Next step up, to know if it

is configured correctly. Next step up,
down. The most recent case affects
the certificates issued by Symantec—

an API World if the performance is adequate. Next

step up, if basic security measures are
one of the biggest CAs—which will
see thousands of already-deployed
place. Next step up, if you’re making certificates stop working before their
A View from Industry by the most of all available performance natural expiration dates. Unless
Ivan Ristic, Security Expert and security standards. A well-desig- these certificates are monitored and
ned architecture is like a battlefield replaced before the deprecation takes
Complexity is one of the principal where the odds are firmly stacked in place, the corresponding services will
enemies of security. We can keep track your favour. simply stop working.
of only so much information, yet our
networks continue to grow. Today it’s APIs have all these problems, just Even when some of the problems are
not unusual to see even the smallest worse, because they’re typically known, the question that commonly
organisations with many servers and invisible. There are no users to quickly arises next is what to do. Computer
services spread across providers. detect and report problems. In this security expertise is difficult to come
It’s even worse at the application space in particular, automation is by and there’s always something more
layer, where there is a constant fast key to availability, performance, and urgent to do elsewhere.
growth of platform features and new security. Take encryption, for example.
security standards. The end result is It is all too easy to deploy encryption What is needed is a platform that not
an enormous machinery that exposes incorrectly or forget to renew the certi- only provides monitoring services,
an equally large attack surface. Many ficates. Transport Layer Security (TLS) but also gives meaningful advice and,
things can and do go wrong: miscon- and public key infrastructure (PKI) ideally, is a collaborative platform for
figuration, unavailability, security and are also quite turbulent and complex; stakeholders to work together as they
performance issues are rife. protocol weaknesses are frequently evolve the security of the organization.

The Expanding me the default, and the awareness

introduced by analytics and logging
codified this awareness into our
practices can be seen in the form of

Landscape For have contributed significantly to overall

API security awareness amongst the
API definitions like OpenAPI, which are
helping us develop maps of our API in-

Defending Our leading API providers. However, in

2017, the API landscape is continuing
frastructure, and communicate across
teams, partners, and with third party

Digital Resources its rapid expansion, and while these

proven, and hardened approaches to
developers. API definitions are essential
to helping us solidify the awareness of
delivering API security via API mana- our API operations developed through
A View from Industry by gement are still applicable, there are sensible API management practices,
Kin Lane, API Evangelist an increasing number of stops along and be applied consistently across the
the API lifecycle that need to also be API lifecycle. API definitions are helping
For the last decade API security has considered by providers. us secure our API management, but
been something that is squarely under also our deployments, DNS, testing,
the umbrella of API management. API Definition Driven monitoring, and every other stop along
Companies like Mashery, Apigee, and the API lifecycle.
3Scale started pioneering ways to API management practices have
secure, enforce authentication, and brought us a significant amount of Hardening API Deployments
access limitations to help companies, awareness when it comes to our API
organizations, institutions, and surface area, and how web, mobile, Once just a shadow behind API
government agencies secure their device, and other applications are management, in 2017 there is more
digital resources. As API management putting these resources to use. The discussion occurring regarding how
practices matured, encryption beca- most significant shift in how we have we deploy our APIs beyond just the

9
 The Expanding Landscape For Defending Our Digital Resources

enterprise gateway, or from develo- layers of API security that could have Security Communication
pers using an open source framework. helped prevent this breach. First, at
We are thinking more deeply about, the API deployment layer, if the Apache Last, but not least. Communications
and having conversations around API Struts vulnerability patch had been around API security is the lubricant
deployment healthy practices, coupled applied, the attack wouldn’t have that makes the technology, and
with several waves of cloud API deplo- occurred. Second, with proper API operational aspects of security work. It
yment solutions, have had a significant management on top of the exposed, won’t matter how many technological
impact on API security. While there still any attack could have been identified acronyms you are applying to your API
is a significant amount of work ahead and minimized through API analytics operations, if you aren’t communicating
of us, the API deployment conversation and rate limiting. Third, if APIs were internally and externally around API
is moving out of the shadow of API being properly monitored and tested at security, your security practices will
deployment, and we are thinking the individual response level, the kind eventually break down, creating gaps
about how better secure the backend, of attack that was injected would have within all the dimensions of API security
virtualization, and even network layers been identified early on. Monitoring API discussed so far. Sharing of API defini-
our APIs depend on. It is important to infrastructure is essential, but actually tions, and healthy practices for security
secure the front-end with proven API testing API calls as part of this process, API deployment, API management, DNS,
management practices, but when the ensuring requests and responses testing, and monitoring is a hallmark
conversation ends there, it can leave are well-formed, and performing as of API providers who you haven’t read
a significant number of security holes intended, is an essential aspect of about having major breaches. Teams
opened up by the deployment of our securing APIs, not just once, but in are actively sharing stories internally,
APIs, whether they are in the data-cen- real-time as the landscape changes. API training team members, as well as with
ter, on-premise, or in the cloud. monitoring and testing has emerged on partners, third party providers, and
the API landscape as an essential part publicly in general, demonstrating that
DNS API Layer of API developer’s toolbox, but is also they have their API security strategy in
being used to make sure API security is place, and evolving in a practical way.
In a Distributed Denial of Service (DDoS)
world, DNS has become the front-line also on the radar of everyone involved API management has established a
for securing our APIs. DNS isn’t just across the API lifecycle. foundation for companies, organiza-
the addressing for how your APIs and API Lifecycle Operations tions, institutions, and government
developers portals will be discovered. agencies of all shapes and sizes to think
It is how they will be probed, attacked, With a rapidly expanding landscape more critically about the securing of
and manipulated by bad actors across the API security discussions are digital assets, while also still making
the space. The awareness introduced moving well beyond just API manage- them available for using in web, mobile,
by API management has spread to the ment, and is something that every API devices, and other applications. Much
DNS layer, giving us insight into API architect, designer, developer, tester, like APIs themselves, API security has
traffic, both good and bad. DNS APIs are and evangelist is thinking about (or begun to be decoupled from API mana-
also allowing us to be more proactive should be). API security isn’t just it’s gement, and is being applied across the
and responsive to security threats own stop along the API lifecycle, it is API lifecycle, making it something that
on API infrastructure, allowing us to something that is considered, applied, can be baked into every API or service
build in redundancy, back plans, and and constantly evaluated at every stop being exposed, independent of how
actively respond to global and regional along the API lifecycle. API security isn’t those APIs will be put to use. Striking
threats by configuring the DNS layer in just a checklist done at launch time, a balance in how we are doing busi-
real-time. The DNS layer is the single it is something that is applied, and ness on the web, acknowledging the
most important layer for defending, re-evaluated at each stop, but cons- expanding threat landscape, but also
and securing API infrastructure in an tantly being monitored and tested for taking full advantage of the benefits API
increasingly hostile landscape, making it at the deployment, management, DNS, bring to the table to help ensure our
one area you don’t want to be overloo- and application layers in an ongoing operations are agile, flexible. Allowing
king when putting together your API basis. In a continuous integration us to successfully conduct business
security strategy. (CI) and continuous deployment (CD) across the growing number of channels
environment, API security is something beyond just web, mobile, and device
API Testing & Monitoring developers need to be well trained in, applications, but also looking towards
When you stop and analyze the recent adding a SecOps dimension to every voice, bots, and any emerging ways in
Equifax breach you’ll see see three existing DevOps conversation that is which our resources are being put to
going on across any teams. work on the web.

10
 A Holistic DevSecOps Strategy

A Holistic
DevSecOps
Strategy

The best way to address the many security risks that can
occur across the application, system and network layers of A holistic DevSecOps approach takes 3 core actions:
an enterprise architecture is to take a DevSecOps approach.
As APIs are designed, a set of
A DevSecOps approach recognizes API security as a part of
pre-approved, pre-tested security
the API lifecycle rather than being seen as an afterthought
policies are put in place that match
or an obstacle to innovation. Application security expert,
the security level required. APIs are
Tanya Janca refers to this as “pushing left”. It is the idea
tagged depending on the exposure
that security must be a part of the conversation amongst
risk of the data and a threat level
development teams early in the lifecycle, preferably at the
Democratization evaluated. This will include setting
initial design and requirements setting phase12. By ensuring
the proper transport layer security
collaboration of development, security and operations
to protect the data being channeled
teams during the API lifecycle — from business case
by API, OAuth and OpenID Connect
and design to deployment and consumption — security
authentication configuration and
responses can be built into an API strategy, reducing the
applying data confidentiality and
deceleration impact that addressing security issues are
integrity settings to the API.
perceived to have on product development.

Too often, a “road of least resistance” is taken when Development, security and
thinking about API Security. Enterprises using API operations teams work together
management solutions may mistakenly assume that on the the API lifecycle, discussing
their API management service takes care of security. API Collaboration the API definition, where it will
management is useful for setting API rate limits so that be deployed, who will use it, and
API architecture is available to all users and not taken complete a fine-grain discussion of
offline because one customer is making excessive API calls. the risks associated with the API.
Other enterprises think that managing authentication
processes using OAuth or OpenID Connect are sufficient
to prevent attacks via an API. But as Gartner analyst Mark Security aspects are then
O’Neill pointed out at the Global APIdays conference in automated. Threat detection
2016, “saying ‘use OAuth’ does not solve the problem13.” and protection tools are used
Authentication is just one risk vector into an API-enabled Industrialization throughout the development and
architecture. production stages. Security policies
are incorporated into continuous
Given the range of attack surface layers and potential delivery and testing processes.
API security risks, a holistic approach using a DevSecOps
strategy is needed. Taking a holistic approach to API security
also benefits the entire development team.

12. Pushing Left, Like a Boss, Tanya Janca, June 29, 2017, [Link]
13. OpenID Foundation FAPI WG: June 2017 Update, Nat Sakimura, [Link]

11
 A Holistic DevSecOps Strategy

Develop Document
API is developed by dev team Document and annotate API with API
using API lifecycle tools specification format, e.g. OpenAPI.

Deploy Assess
Implement specific API security Assess API description
measures such as deploying a proxy and evaluate risk level.

Test Secure
Continuous API testing, Configure and apply security policy
including security testing from assessed risk.

Can be executed automatically

API Security needs to be approached as a whole in order Product development that draws on internal microservices,
to integrate with business, and API development and partner APIs and public API services must orchestrate the
deployment goals. APIs to ensure that no security gaps are introduced as APIs
and additional frameworks are consumed. This also helps
A DevSecOps approach begins with developing APIs using the entire development team ensure they are following the
API lifecycle tools. The API is documented using an API most efficient and performant business logic workflow, and
description format file like OpenAPI. The defined API is then helps the entire development team maintain an inventory
assessed by creating a threat model that secures the API of what external frameworks and APIs are used so that any
by identifying the levels of risk inherent with each resource external resource updates can be reviewed as needed.
being exposed via API. Security policies are put in place
to address the highest priority concerns. Continuous API Internal APIs must adhere to best practice security
testing is then carried out as the API code is built, including standards, including payload encryption and digital
regular security testing. The API is then deployed alongside signatures. Again, this helps an enterprise development
security implementations such as using an API proxy, team deliver on commitments to managing customer data
ensuring adequate logging of all transactions, and robust confidentially.
storage of any API keys and passwords.
When using external APIs, from SaaS products for example,
Overall, DevSecOps includes attack protection, ensuring API keys — which are akin to passwords — must be stored
confidentiality and integrity of transactions, as well as the confidentially and encrypted, and not hardcoded into
availability of the API infrastructure. application code or stored in readable text files. This also
helps the development team maintain a directory of SaaS
It is equally important to ensure that application flow control tools being consumed by the enterprise and helps the
is maintained on the server side and not in the client code, in development team identify new opportunities to maximize
order to enforce security and the proper order of API calls. the value they are receiving from these SaaS tools. Again,
The use of authentication standards, such as OAuth, are documenting and storing external API keys and securing
complex and often do not alone provide the necessary data being transmitted also helps the entire development
fine-grained permissions that reflect an enterprise’s API team better clarify the business logic flow of the API
business case. Matt Carter from Axiomatics points out that orchestration.
OAuth implementations merely allow discretionary access Along the way, write transactions carried out via API must
control, where a resource owner can authorize a client to be stored in permanent storage to allow for forensic
access data. But if an enterprise wants to manage who has review if there are any security breaches and to ensure
access to an API’s resources based on their user permission there is a legal record confirming any transaction made by
role, it is necessary to put in place additional Mandatory customers. These logging records can also be used by other
Access Control policies14. By addressing security goals, an development team members in the API lifecycle who may
API can better achieve its goals of preserving customer data be monitoring performance issues or assessing demand for
and ensuring that the API business case is upheld by limiting additional API products to be created by the enterprise.
access to data and capabilities to paying customers and
agreed partners.

14. Externalized Dynamic Authorization in a Microservices World, Matt Carter, December 12, 2016,
[Link]

12
 Applying DevSecOps to an Enterprise API Strategy

Applying DevSecOps to
an Enterprise API Strategy

A state of the art DevSecOps API

Strategy is a comprehensive approach
to ensuring an enterprise is secured in
its own use of external and internal APIs, Application Ensure detection and blocking of standard
and in how it creates and publishes APIs 1
Data Validity applicative attacks, such as SQL injections,
for others to consume. cross-site scripting and information leakage.
Jeff Williams, OWASP Top 10 project
creator and coauthor, says applying
a DevSecOps approach is a crucial Network 2
Ensure the data transferred by API cannot be
business strategy. This will mean Confidentiality read in transit. This can be done at the message
security experts within an enterprise level with encryption and at the transport level
will need to learn how to delivery with transport layer security (TLS).
‘security as code’, Williams told Madison
Moore of Software Development Times. Network 3
Implement verification procedures to ensure
“Essentially, they have to translate Integrity that data has not been tampered with while in
every security requirement, every transit, typically by signing the content.
coding guideline, every ‘best practice,’
every threat model, and every security
architecture into code that can run Network Control the rate of API traffic to avoid
4
during the development, build, test, and Availability Denial of Service attacks.
deployment process. Even in operations,
it’s critical that attack detection and
response is fully automated15.”
System Verify the identity of users and implement
Properly securing an API involves 5
Authentication identification methods, such as two-factor
addressing multiple security aspects,
authentication.
such as confidentiality, integrity and
non-repudiation. A comprehensive
DevSecOps approach secures the three
System Once users are authenticated, check that the
security layers and applies the eight 6
Authorization user is authorized with the proper permission
DevSecOps principles.
to access API resources.

A DevSecOps
Network Log all API transactions for availability
Implementation Audit
7
to security forensics.
Timeline: Phase One
When first migrating to an API-enabled
enterprise architecture, or when Network Ensure logging of transactions includes legal
8
developing or consuming a new API Non-repudiation proof of the execution of the API call.
in the enterprise, the following steps
reflect a comprehensive DevSecOps
approach.

15. OWASP Adds Unprotected APIs, Insufficient Attack Protection to Top Ten 2017 Release, Madison Moore, April 12, 2017,
[Link]

13
 Applying DevSecOps to an Enterprise API Strategy

A DevSecOps Implementation
Timeline: Phase Two
Application Reviews of external framework
1
Once these processes are in place for an Integrity dependencies can be monitored so
enterprise API-enabled architecture, there is Accessibility that when they are upgraded, systems
now the opportunity to implement “security as can be alerted to review the impacts
code”. The same threats detection and protection of the latest version on an enterprise
tools can be used from API development through architecture.
to production. Security policies can be applied
System Security policies that classify the API
to APIs as part of a continuous integration and 2
Confidentiality exposure risk level, define permission
continuous deployment process (CI/CD).
Authentication rules and operational capabilities,
In today’s modern digital enterprise, applications are Authorization and that describe the deployment
being released around 30 times per year in order to Audit infrastructure, can now be used as
keep up with innovation driven by customer demand. Non-repudiation standard templates for the creation of
This requires an approach where developing and any further APIs. These security policies
testing code is part of an ongoing pipeline that can should also be regularly reviewed and
allow developer teams to collaborate effectively, monitored for any scope breach.
test new code updates, incorporate into production
and monitor for any emerging issues. DevSecOps Network Opportunities to automate the
3
must form part of this CI/CD pipeline rather than Integrity review of dependency frameworks
be treated as a separate one-off process. Confidentiality and that can automatically trigger
Accessibility the implementation and adherence
The following steps help incorporate API Authentication to security policies should be added
security into enterprise processes for the Authorization to API deployment and continuous
continuous development and deployment of new Audit delivery systems.
applications and customer-focused services. Non-repudiation

Tools
A new range of tools is emerging Actively scan APIs consumed in an Hardenize is a continuous
to assist DevSecOps teams to test enterprise architecture by using monitoring platform that focuses on
the security risks in their enterprise tools such as ZAP, an OWASP open infrastructure health. It keeps an eye
architecture. Here is a selection of source penetration testing tool. on the hundreds of things that can
some available options. go wrong, covering the entire stack
The OWASP Dependency-Check from the domain name registration,
The DevSecOps team can build a utility allows DevSecOps teams
shared understanding of security the domain name system (DNS),
to check if there are any known email, encryption, and web
by reviewing the Top 10 Open vulnerabilities with dependency
Web Application Security Project applications. Today, less than 1% of
frameworks that may be being used organisations have the best security
(OWASP) risks. by applications and APIs that the they could have. Hardenize is on a
OWASP’s new DevSlop Tool enterprise is consuming. Products mission to push this number much
Project provides a training ground such as Snyk and VersionEye also higher not only with its commercial
in security testing for DevSecOps aim to continuously search for product, but also by making its
teams implementing an API security security issues in dependencies and comprehensive ad-hoc analysis
strategy in modern enterprise can integrate with CI/CD pipelines. freely available, forever.
architecture. OWASP lists a wide range of
vulnerability scanning tools. Comprehensive API Platform
Make use of static and dynamic 42Crunch is a fully-fledged end-to-
code analysis tools that can be Deployments can be tested end API security platform that includes
integrated with CI/CD pipelines for any infrastructure security tools to help document and enforce
to ensure application upgrades holes by using SSL Labs, and security policies, store API keys and
and new code maintains security [Link]. These services passwords securely, integrate with
robustness. OWASP lists a range encourage DevSecOps teams to CI/CD pipelines for DevSecOps, and
of their own and open source thoroughly apply best practices to continuously monitor all aspects of
source code analysis tools. API development lifecycles. API security in both development and
production stages.
14
Credits About 42Crunch
Main text written and researched by Mark Boyd with 42Crunch’s platform allows your enterprise to quickly
guidance and input from Isabelle Mauny, Philippe Leothaud, deliver apps built on top of secured APIs, through a
and Matthieu Estrade. complete complement of security components:

Industry insights written by:

Kin Lane is the API Evangelist paying attention to the Guardian

technology, business, and politics of APIs. Keeping an
eye on what companies, organizations, institutions, and The next generation enterprise app firewall, built
government agencies of all shapes and sizes are doing when to protect your legacy web apps and new API-
it comes to APIs in the digital age. based apps, with smart learning and innovative
automatic configuration from API definitions.
Ivan Ristic builds tools and writes books that push the
boundaries of what we know about computer security. He
designed ModSecurity, built SSL Labs, and wrote Bulletproof Directory
SSL and TLS. He’s the founder of Hardenize, which focuses Our directory lets you manage all the meta-data
on continuous infrastructure monitoring coupled with attached to your technical and business APIs,
usable security. including definition, security requirements and
Design by [Link] even infrastructure requirements, all leveraging
the de-facto OpenAPI standard.

Maestro
The maestro component lets you compose API
orchestrations in a simple and efficient manner,
allowing you to map interfaces, data formats and
security tokens formats from a single interface
across REST and SOAP APIs. The maestro engine
is designed to be container-ready, allowing to
deploy an unlimited number of instances with
minimum resources.

Vault
Store all of your security credentials in a fully
encrypted space. Unprecedented security for
your business with ease.

Insights
Your business is real-time and needs accurate and
fast information in all aspects of its operations.
With Insights, your operations, security but
also business teams have access to up-to-date
information on the security and stability of your
infrastructure and are alerted in real-time when
specific business or technical conditions occur.