Dan Kirsch – The Imperative of Securing Your API-Centric Applications

This is texturing TV. All right. So, my name is Dan Kirsch.

I'm with tech strong research. We're part of a tech strong and just quick little about me and about our organization principal analysts and managing director of tech strong research of co-authored a number of books including hybrid Cloud for dummies an update to Cloud for dummies Cloud for Domino's second edition augmented intelligence the business power of human machine collaboration. And the thesis of that is really Ai and ml aren't going to automate everyone out of a job that the real the real power of AI and ml is the fusion of mlnai along with human intelligence.

So machine machine learning has great capabilities, but the human brain is also amazing and can understand context thinking bring together items in ways that Franklin machines can't do and you know, maybe it's on the horizon. And I've been an industry analyst for about a dozen years and on Twitter. You can join me at a DD Kirsch and Linkedin and elsewhere as well.

And quickly about our research organization text wrong research. com Security Boulevard digital cxo and a number of other sites and we're research organization. What I think makes us a little bit different is we've got a huge membership of about 450,000 members.

That's every everyone from practitioners and individual contributors to it and Technical Executives. And so our research is informed by our members, and then we also educate our members on our research findings. So today I'll be talking about API security, but I'll also be Injecting a few research points and as a research organization, we focus on cloud security Ai and data devops and infrastructure and we go deep within each of these areas.

But our core belief is that all of these intersects you can't talk about Cloud without inevitably of course talking about security and then whatever infrastructure you're you're on is is important even though we talk about the cloud obviously there is some infrastructure there. So why am I talking about API security as I was saying a little earlier? I was talking to someone one of the sponsors here who likened API security to low tire pressure.

So if you're a low tire pressure salesman, you're not gonna on some monitoring system. You're not going to go around to automakers and say I've got the best low pressure tire sensors because who really cares But if you go around and say say, you know, I can cut your accidents down. I can make your customers happier as gas prices go up.

I can reduce I can increase your your vehicles miles per gallon that starts getting a little bit more interesting. So with API security, I think a lot of Cisco's and and security officers and Security leaders are really focused on front end attacks that we read about every day and You know, the reason I think API security is so important is because of the data that that goes across apis. So, you know, of course you got apis that we're not all that concerned about if you've got on your website a location tool that that calls up the Google Maps API low priority, you know, that that's not something you really need to be worried about on the other hand.

If you're a Healthcare company and you're you're connecting to various partners and transferring patient data that that's something that is a concerning. It's in scope of audits and could get you in big trouble if it's not properly secured. So the reason I'm interested in API security is because of the the data and the services that go across apis.

But devops and Cloud native application architecture and all all in context of apis. So these are sort of four. I would say Hallmarks of cloud native development.

One big push is that applications are getting smaller whether you want to call it microservices or service oriented architecture. We're breaking down these huge monolithic applications into a variety of micro services that might live on Prem or on the cloud and what's connecting all these microservices. It's apis.

Then another part of devops is everyone wants to move faster. Eliminate bottle necks automate wherever possible automate and orchestrate your cicd pipeline. And what's tying all of that automation together again?

It's apis. Now when we talk about Cloud native we're of course infrastructure is important whether it's in infrastructure is code multiple clouds a private Cloud. You're on-prem Data Center.

And again, you're developers are interacting with that underlying infrastructure through apis. And then a lot of modern modern application design is about assembling assembling applications instead of writing from scratch. So, you know developers are still doing a lot of work but there's a lot of pre-built microservices that they're taking advantage of whether it's a third third party who created the microservice or an internal internal group and then again what's connecting all of these pre-built micro Services it's apis.

So as you can see apis are becoming more and more part of modern application development yet. We're not really focused on the security around apis and I think a lot of times the security organization things apis are for developers and engineers and Developers, you know, even though there's increasingly talk of devsecops. What I find is developers are security aware and they're concerned about security, but they're not they're not Security Experts.

You want your developers focused on building great applications and user experiences and not necessarily becoming Security Experts. Being said I am seeing progress in terms of organizations investing in API security. So we recently asked our audience.

Do you have an API security project planned in 2022? So almost 50% said yes, so about 15% said yes, and it's funded and about a third said yes, but we're investigating it only. And then the rest about another 50% said it's either on the Strategic roadmap, but not in 2022 or we're not planning to pursue an API security project.

So I'm seeing the Rumblings of you know, organizations are understanding this is important. But then also you know who's responsible for is is a concern. Yeah, you have an abstract team.

You've got a security team. You've got devops team. And apis are sort of in the middle.

So again, we ask our audience who selects API security products for your organization, not surprisingly. The majority said the security team about 64% said security. But the the rest about a little over a third said the development team.

Now talking about API Security tax. I'm not gonna go deep into different different types of attacks. There's a variety of organizations that list, you know top 10 attacks, but it ranges from really simple random types of attacks or you're changing resource IDs do try and bounce around and discover other customers data, then there's more advanced and complex attacks.

You have Brute Force attacks. You've got attacks where you're looking at different types of authentication methods. Can you find a weak authentication within an API?

And then there's really targeted attacks where they're either going after a company and targeting that company or the targeting targeting a specific API because of the the data that runs across it. so let's talk about some of the traditional defenses that That organizations use so there's web application firewalls and APA API gateways along with managed application security services. So that last one managed application Security Services is sort of a mashup of wafts API gateways DDOS protection and those are usually done by Cloud providers or cdns like Akamai because they've already they already see the traffic they're in the middle and and those can be helpful and offload some of the work but But it's not it's not sufficient.

So if we quickly go back up to wax and API gateways. What they're good at is understanding or seeing a an attack if it follows a prescribed set of action. So if it follows if you have an API attack that that's you know, let's say standard or simple a web application firewall can help you out or sometimes an API Gateway but These systems weren't designed for cloud native and and highly distributed environments and along with sophisticated API attacks.

And then in terms of API gateways, they're not really a security tool. They were designed for performance and security is at best and afterthought but API, but all of these do have have a place you can't just you can't just throw out your Web application firewall for instance and your API Gateway as you'll see is actually still an important part of your overall API security strategy. so modern API security You know, we talk about it all the time and security.

You can't secure what you don't see this is absolutely true in terms of apis. So another question that we asked our membership is give an inventory of all of your apis that your organization uses. 28% said yes.

55% said no. And 16% said they're not sure. Now that's pretty it's pretty frightening.

If you think about all the types of data that go across apis and the majority of respondents are saying we don't even have a handle on what apis are in our environment. And then if you start thinking about what what types of data go across that apis. Yes, another question what types of data are shared through apis.

So we personally personally identifiable information pii 7% said pii 5% said financial data 5% said corporate IP and secrets. So you wonder you know, what did everyone else say? That's it.

And 83% said all of the above all of that data is being shared across apis. So you need to understand. What is your API landscape look like and then what types of data is are going across your apis.

So then you can start start to prioritize. What are those really high risk apis where Mission critical data or corporate IP or increasingly customer data that could get you in trouble with gdpr and California privacy regulations. What what are those apis?

And what are the the low level apis where you're not all that concerned about the data. So, how do you find how do you figure out what apis are in your environment? Let's first go back to API gateways.

I said they're not as security tool, but they do have a role and so so since they see the traffic they can help you identify apis and spot them also security security testing. It's not it's not really the most efficient way of searching for apis. But but as you scan applications, it'll help you uncover apis and then the last is passive monitoring of your network.

It's going to Help you identify apis along with the data that's flowing across apis. Absolutely. complex Ity, if someone is working on with something like zip code and they're trying companion code.

I'll work with it. Validation is always just numbers between girls. and then the clock watch so we'll just drive messing with the dresses.

Therefore. You should be using this. API that in the pipeline yet, um in terms of the pie.

Yeah, they're certainly systems sort of understand. You know, what's normal in terms of an API? And what's not normal.

I'm not I'm not sure. I'm not sure that specific use case. Yeah assemble versus custom, right?

Yep going down in the custom, right? Yeah, because the analyst became even work didn't know of existing India guys animals should say so now the programmer is writing code something that watches this process and says, oh your work your evening mailing address. Yeah.

Yeah. I do not see you this API. we have a standard API, yeah, so in terms of your standardizing apis with it within the organization.

Absolutely. I mean a lot of that is about adding, you know Automation and best practices into the devops pipeline. A lot of times.

I'm I see develop development and devops is a bit of a pendulum where developers sometimes. So I think we're leaving in a several years of developers having a lot of freedom and in terms of choosing their apis and and you know choosing what open source they want to want to use. I think I'm seeing I'm seeing the pendulum swing back a little bit in terms of your you can't say to your development team.

You can only use this set of tools because you're gonna you're gonna ruin the developer experience and you know, even though the maybe the the great resignation might be changing but we're still in an economy. We're good developers can find other jobs. So if you say you can only use these these tools Um, that's not going to work on the other hand.

If you have automated systems that can make informed suggestions developers. What I what I'm finding are receptive to that because they don't want to make mistakes. I mean, there's no doubt even though developers aren't Security Experts or They that's exactly what I was gonna.

Exactly. They want to do it, right? They don't want to be the cause of a failure and and you know, they might be able to write something from scratch a little bit better.

But if if something's already been approved and looked over by several teams, there's no reason there's no business reason and for yeah from a personal reason if you're a developer, you don't want to be getting that three am phone call. You don't want to be responsible for taking down the system because you build some custom thing where the organization has already blessed an API to do it. years, this is New character.

Yeah. Well, I think I think it's something that Organizations are trying to you know, sort of set guardrails within the devops organization. I mean, there's a lot there's a lot of guard not not hard rules, but guardrails and you can go outside of the guardrails if there's a reason and you don't have to maybe get you know, 17 people to approve that but there's there's prescribed guardrail.

So to keep things secure high quality and keep developers from the 3am phone calls. You know and then in terms of securing apis, you know, there's not there's not a Magic Bullet, of course, there's vendors who will tell you that. They're a Magic Bullet, but I'm not gonna endorse one over another but when you're looking at API security there's there's three things I think are important to just think about if you're talking to a vendor if you're doing it yourself, if you're just at the first steps in terms of you know, you want to put together a program.

I think these are the three things that you need to think about. So the first is API scanning, so you need to Scan your apis. Look for our weak authentication loose definitions check apis against internal policies.

A lot of what we were just talking about in terms of automating best practices is if a developer uses an a unsupported API or an API that falls outside of outside of your internal security protocols, raise a flag in the devops pipeline and the pipeline the developers comfortable with and it gives them the The knowledge to you to use something else. Otherwise, they you know, you can't blame a developer if they use an API. They had no no clue that it fell outside of security parameters.

Now another thing to look at is detection and and blocking. so my modern-day API Security Solutions understand these you know the API attack surface along with with new types of attack methodology so older wafts and things along those lines I was saying, you know, you have to follow a certain attack pattern or it won't be recognized more more modern systems understand these new types of attacks and then also for a positive security approach you might want to restrict apis from doing anything outside of what their their contracted to do now that can be it a little bit tricky because you don't you don't want to be so secure that apis don't work correctly because you've locked down what they can do. So it's a it's a balancing act.

But if you're gonna start adopting zero trust and things along those lines, of course, pause positive security is important. And then anomaly detection is a big issue. Bring it brings in a A term that some people love some people don't within security machine learning.

So anomaly to not anomaly detection. Really what it does is it helps to set a baseline for what your environment should look like you using things like machine learning? There's a lot of ml washing when you talk to vendors.

I think you get probably get a 10% boost in your private Equity raise. If you if you say machine learning within the first 10 10 words of your pitch and your your boss will be happy. But machine learning is real and there are applications and a lot of that is is around security understand, you know, what's normal and then you can start understanding, you know, what's not and and send up a flare and say we're seeing a strange activity.

So what one use case is even in terms of online ordering and retailers using so I was talking to someone recently and there's a retailer who sells limited edition consumer goods, and so What was happening what and the retailer wants these consumer goods to actually get to Consumers. What was happening was within seconds? They were all being bought up by Bots and then a few days later.

They were showing up on third party sellers at three four ten times the price and that's frustrating to the retailer. You know, they know that they're leaving some money on the table. They could be selling it for more money.

But what's frustrating to them is their customers are really unhappy because none of them are actually getting the product instead. It's going to middle men who are reaping the profits. And so you say, you know, this doesn't seem like an API issue but actually the API to make the purchase what was seeing this, you know, High spikes and volume and through API API security they were able to shut down that that bad activity.

So devsecops, that should solve everything right? I mean as long as we Change the term and smush Security in into devops. We're all we're all set, you know shift shift security left.

And you know it helps some companies move move seats around I think what's really important with devsecops is that security is part of your entire process. So it's not it's not about devops taking over some of what security does instead. It's about security informing your devops team giving them the tools giving them the knowledge to make good security decisions because I haven't met a single developer who's ever said I I don't care if what I develop has security holes.

It's not my job. They might say I don't have the knowledge. I don't have the context we've done a lot of a lot of research into due developers have the skills the knowledge the background to around Cloud security Cloud native security and they just don't and you're not going to be able to turn every developer into security expert.

So it's really about about the security organization working with development giving them the the tools they need and it's about that the development Community working with security to help educate Security in terms of you know, specifically with apis. What's the importance of apis? What are what are the concerns and then raising those concerns to the security organization?

so with that I'm part of tech strong group, and if anyone's got any questions or any discussion items happy to to take them or we can talk after the discussion. You know. I understand.

fill up materials or the Enterprise he hired. yeah, I mean and so I see these even so it always the problem the software. How do I find what's out there?

I mean that's a huge concern. I mean how many times I think you know understanding the bill of materials and software supply chain is a massive concern. I mean a lot of it is what we've been talking about, you know giving developers had a lot of autonomy, but they were bringing in different tools different apis different open source standards and Obviously aggression and many not.

You know by the code working earlier, if you're having that there's a lot of that there's a few things at play here. There's a lack of technical knowledge at the at the board level and a lot of companies. There's a lot of yeah.

there's a there's a lot of you know we On the other hand, sometimes you have companies that you you care about outcomes. So only technologists care about building the most beautiful technology stack and that's gonna take too long. I mean, we're in a market where you don't have two years to modernize your stack instead.

You need to come out with new software using what you have. And so I think I think it's a bet a balancing act and there's poor documentation to say the least and So yeah and with the movement. Well, and so yeah and slack is even worse.

Yes, I think it's it's a lot of it is the the discovery aspect in terms of apis and and discovering data. I mean if you want to start with the data, that's that's what it's all about. It's you know, where where's your data going?

And who's who who has potential access to it? Talk is about Nina data data data. There is never any thought about the systems that make the data.

Yeah, I saw I mean that is a huge. Yeah. I said to talk about the idea of data data data and no one cares about the infrastructure.

No one cares about the security. Is it on the cloud? Is it on Prime?

Is it on in you know on your main frame where you're taking that data to perform analytics, you know and part of this is because security has always been thought of as Dr. No, I mean you go you go to your security team and say I'm going to take my our customer data that sits on the Mainframe. I'm going to put it on to the cloud onto snowflake or some other cloud data warehouse.

Your security team is gonna say, you know, I I need you know, six months to evaluate all of the security credentials. So you have business units just going going forward with it. So, I mean that brings us back to the whole idea of guardrails.

And you know, if you can have business teams do this safely that that's a lot of it's about building hybrid teams, whether you want a team that's got someone from legal someone from privacy someone from security along with those data experts and platform experts and that's how you're you know, you're not gonna get yourself in trouble, hopefully and you're also not gonna get rolled over by a vendor who promises, you know, we've got all this covered and then you're security team is is sitting there saying, oh have you thought about this this and this because just you know a good security team is thinking about All of the worst-case scenarios all the things that can get them fired along with you fired, but I'll get them fired and we'll get your data. stolen and I think with that we've got to wrap up.