SEC555 CYBERSECURITY – TERM ASSIGNMENT RESEARCH
REPORT
Name:- Mohammedmiya Munshi
Student number:157497207
Date: February 24, 2023
Title: API/Secrets Management
Page 1 of 11
In the world of service-oriented organisations, application programming interface (API) is of the utmost
importance. API can be defined as a collection of procedures, building blocks, and tools for creating and
integrating applications. By facilitating the ability for developers to integrate new application aspects into
an existing architecture, API enables companies to work with IT teams. For instance, there is a need for
seamless access to all pertinent data in agriculture because plant breeding is crucial for feeding a
constantly burgeoning population. To meet these needs, various groups are attempting to develop an
Application Programming Interface (API) for breeding data. Several kinds of APIs are available and used in
compliance with standards. Brief abstract of the various categories are provided in the image below.
Secrets management is also in charge of managing, protecting, and securely storing sensitive data
like API keys, passwords, and other private information. Proper administration of APIs or secrets entails
the use of legal procedures and technology, such as API gateways, encryption, passwords, and many
others, to guarantee that APIs and confidential information are correctly managed and secured. Thus,
monitoring and protecting APIs along with sensitive data will aid in enhancing the security, dependability,
and efficiency of their systems. The main ideas and existing issues in API/Secrets Management will be
covered in this paper, along with suggestions for successful execution and oversight based on the
Page 2 of 11
findings. In a multicloud and enterprise setting, the process of building, publishing, and managing API
connections would be described as API management. By providing a scalable, unified platform, it allows
firms to share and interact socially with their API setups while limiting access, collecting and interpreting
usage data, and enforcing related security protocols. It comes with a collection of end-to-end services
that facilitate the ability to install API integrations and to record and distribute their configurations
among development teams. It includes elements like an API developer interface, an API gateway,
reporting and analytics, and API lifecycle management. API management tools include things like JMeter,
SoapUI, API Connect Test and Monitor, and others. [1]
Nevertheless, secret management refers to the instruments or procedures used to handle the
authentication credentials (or secrets). Passcodes, access keys, API keys, and tokens that can be used in
privileged accounts, apps, services, and other critical areas of the IT ecosystem are a few instances of
this.[2]
Secret management calls for the reduction of risk that is reflected on the secrets both in transit and at
rest when transferring the secrets securely. Passwords, API keys, SSH keys, certificates like TLS/SSL for
secure communication, private encryption keys like PGP, and plenty more are just a few examples of the
secrets. In addition, there are risks that can compromise the data, including manual disclosure and
failure to rotate sensitive information, hardcoded credentials, a lack of awareness and visibility, cloud
computing privileges, and third-party accounts. This issue could be remedied by merging the API with
secret management. Since this would prevent malicious access to sensitive data without jeopardizing the
efficiency and dependability of the systems, this coordination serves as a crucial component of modern
software development. As a direct consequence, it would minimise data breaches, data thefts, and
unsanctioned manipulation of corporate data. [3]
Page 3 of 11
However, just as every piece of software in the world has perks and drawbacks, so does API/Secrets
Management. Secret management contradicts regulatory standards that call for FIPS-certified hardware.
The lack of control across all IT layers, which results in incomplete visibility and awareness, poses issues
for audits as well as creating security gaps; DevOps technologies frequently have secrets hardcoded in
scripts or files, jeopardizing the automation process' security; for example, hardcoded/embedded
credentials; Some difficulties or restrictions encountered in managing secrets include third-party vendor
accounts, a lack of authorization for proper usage and suitable maintenance of secrets, and manual
secrets management processes, which are more likely to have security flaws and errors. [3]
These boundaries could be removed by implementing API/secrets management, which serves as the
foundation for software developed by various companies and organisations and which offers
authorization, appropriateness, viability, and high performance quality at a single point in time, similar to
a snapshot. For instance, in a blog entry about API management infrastructure written by an engineer
that deals with Keycloak, 3scale, and Camel, he notes that by using Keycloak as an OAuth 2.0
authorization server, designers can create an API management infrastructure that also enables API
authentication. [4]
Page 4 of 11
The image above shows an API management architecture that, leveraging Keycloak's token insurance
and management services, can simultaneously execute reverse proxy, protocol conversion, data
conversion, mash-up, flow control, API documentation dissemination, metrics, and API authorization.
Token management and issuance as a security mechanism, however, has problems, including insufficient
token validation, a lack of control of API access for each API, and a lack of deterrent for token theft,
which will eventually lead to API abuse. However, these issues could be resolved by utilising token
introspection, scope check, and OAuth MTLS.
One well-known technology is token introspection, which is used by API gateway to request an
authorization server in order to validate an access token. For illustration, the code below, which was
disclosed by a Hitachi engineer, will indeed serve as a suitable rationalisation for an introspection
request:
POST /introspect HTTP/1.1
Host: [Link]
Accept: application/json
Content – Type: application/x-www-form-urlencoded
Token = 2YotnFZFEjr1zCsicMWpAA
Page 5 of 11
If the code is active, a set of information will be displayed but if it is not active then following response
will be generated:
“active” : false
Simply explained, a grocery store owner who rents a storage unit locks the door and requires a key to
enter in order to protect his belongings and deter squatters. The resource server in this case is called the
storage house, and it only permits users with valid access privileges. To obtain this key, a user must apply
for it and go through the entire application process.
Let's also review some examples of this technology being used in the real world. Let's commence with
PingOne, which simplifies customers' work by taking on the difficult task of developing a token
verification system and offering the customer with an API endpoint that completes the task on the
provider's backend.[5]
There are further instances of API/Secrets Management in use, including:
Weather Snippets: Rich weather snippets, which can be obtained on Google Search, Apple's
weather app, or a smart home device, seem to be very prevalent.
Log-in Using XYZ: XYZ stands for Facebook, Twitter, Google, Github, and so on in this sentence.
Applications with this functionality employ the APIs of these platforms to verify a person's
Page 6 of 11
identity with each login even though logging into users' social media accounts would raise a
security risk. The Instagram Login API, for instance.
Pay with PayPal: Pay with PayPal is developed utilising APIs, just like logging in through a social
network service, to make sure that the end application can only conduct the necessary things
without being exposed to sensitive data.
The application of API/Secrets Management extends beyond the aforementioned instances because APIs
play a significant part in corporate sectors where efficiently storing and transmitting data is essential to
day-to-day operation. Human life is powered by API/Secret Management as it joins:
Private APIs are used by financial institutions like banks to monitor and regulate accounts,
credits, and other things.
Major retailers that use APIs to track packages and connect with courier networks
Web applications- APIs make it possible for front ends that interact with people to access crucial
back end functionality and data.
Streaming services- APIs are used by various companies, like Spotify, Amazon, Hotstar, Netflix,
and many more, to distribute content.
APIs are used by automakers like Tesla to distribute software upgrades. Even car data is unlocked
for third parties using APIs. [6]
When there is a significant risk of high danger of data loss, revenue loss, credibility loss, the
introduction of malicious code, and other related risks, token introspection or API/Secrets
Management cannot be applied.
Consistent guidelines are required for the actions taken during the API lifecycle, such as the
following:
Restricting the amount of times a client can call an API within a defined timeframe
Page 7 of 11
Classifying sensitive and personally identifiable information that APIs handle
Inventory of APIs, especially those in testing and development
Logging all abnormal behaviour
Implementation of central security API
Whenever possible using established authorization and authentication standards like
Oauth 2.0 and OpenID Connect [7]
To conclude, this report shows the importance of implementation of API/Secrets management in
corporate sectors by ensuring the security of sensitive information. There is detailed explanation
of how token introspection and API/Secret management maintain the proper control and
management of company’s APIs which in general prevent the unauthorized access and misuse.
Apart from this, there is also brief discussion about the disadvantages of API/Secrets
Management and what factors lead to it. In addition, some practices to overcome such problems
have been described in the end of the report along with some complement technologies such as
DevOps automation tools. Some aspects such as monitoring, incident response, risk
assessment, training and upgrades should be considered by organizations implementing
API/Secrets Management as maintenance is a crucial key for this technology. Analysis of risks
and benefits should be conducted by businesses who are willing to implement this technology to
determine whether the company is making a right choice or not. Therefore, careful consideration
and proper implementation of API/Secrets management can improve the efficiency of several
sectors.
Page 8 of 11
Reference Page:
1. What is API management? IBM. (n.d.). Retrieved February 24, 2023, from
[Link]
2. Puneet. (2022, August 18). What is secret management? Encryption Consulting.
Retrieved February 24, 2023, from [Link]
center/what-is-secret-management/#:~:text=What%20is%20Secret%20Management
%3F%20Secret%20Management%20refers%20to,or%20other%20sensitive%20areas
%20of%20the%20IT%20ecosystem.
3. What is secret management: Tools & Best Practices: Imperva. Learning Center. (n.d.).
Retrieved February 24, 2023, from
[Link]
4. A high-security API management infrastructure using APACHE CAMEL. Apache
Camel. (n.d.). Retrieved February 24, 2023, from
[Link]
Page 9 of 11
5. [Link]
[Link]
6. Bush, T. (2019, December 10). 5 examples of apis we use in our everyday lives:
Nordic apis |. Nordic APIs. Retrieved February 24, 2023, from
[Link]
#:~:text=5%20Examples%20of%20APIs%20We%20Use%20in%20Our,automate
%20posts.%20...%205%205.%20Travel%20Booking%20
7. Titouan Compiègne Co-founder of [Link] the company behind the [Link]
API Platform. (n.d.). API security – risks, attacks, and some good security practices.
[Link] - API Management Platform. Retrieved February 24, 2023, from
[Link]
%20risks%20of%20APIs%201%20Data,can%20dent%20the%20image%20of
%20any%20firm.%20
8. What is an API? Red Hat - We make open source technologies for the enterprise.
(n.d.). Retrieved February 24, 2023, from [Link]
are-application-programming-interfaces
Page 10 of 11
9. Hari Krishna, S. M., & Sharma, R. (2021). Survey on application programming
interfaces in software defined networks and network function virtualization. Global
Transitions Proceedings, 2(2), 199–204. [Link]
10. Selby, P., Abbeloos, R., Backlund, J. E., Basterrechea Salido, M., Bauchet, G.,
Benites-Alfaro, O. E., Birkett, C., Calaminos, V. C., Carceller, P., Cornut, G.,
Vasques Costa, B., Edwards, J. D., Finkers, R., Yanxin Gao, S., Ghaffar, M., Glaser,
P., Guignon, V., Hok, P., Kilian, A., … Verouden, M. (2019). BrAPI—an application
programming interface for Plant Breeding Applications. Bioinformatics, 35(20),
4147–4155. [Link]
Page 11 of 11