Daniel Kirsch – The Imperative of Securing Your API-Centric Applications

This is texturing TV. Good afternoon, everyone. Thanks for joining me.

We'll be talking about API security securing API Centric applications and really answer the question. Why why you need to think about API security and why it's important. My name is Daniel Kirsch.

I'm principal analyst and managing director of tech strong research texturung research is an industry analyst Consulting and research firm. com Security Boulevard container Journal digital cxo, and of course Tech strong research. I myself am a co-author of several books including hybrid Cloud for dummies Cloud for dummies and a business book called augmented intelligence the business power of human machine collaboration.

I've been an industry analyst for about a dozen years and then don't hold it against me. I'm also a recovering attorney so you can join me on Twitter at DD Kirsch always like interacting with people and sharing ideas fun place to Listen to various opinions and some of them are good. Some of them are not so good, but it's always welcome to hear people's opinions.

So I'm going to tell you quickly about Textron research. I'm not going to spend a huge amount of time plugging our company, but we are a analyst and advisory firm and what really differentiates us is we've got a huge membership base of about a half million people. So our research is really informed by our members and our members our everyone from Individual contributors devops practitioner security security folks SRE folks to Business Leaders it leaders and so our research is informed by them.

And then we we amplify out our findings to that group. And our core competencies are Cloud security Ai and data devops and believe it or not infrastructure still important In This Cloud world and within each of these five areas. We'll go we'll go really deep but at the end of the day our core belief is that businesses are really interested in the business outcomes of technology.

So, you know Ai and data and devops are really cool, but you're not gonna start a devops program just because hey, that's the flavor the week you read the Phoenix project great, you're attacking business problems customer challenges. And our other belief is that all of these areas interact? You can't look at devops for instance in isolation devops.

You're gonna have Security even if you're not doing to have sex Ops security is important cloud of course is important. You're going to You're Gonna develop on some sort of infrastructure whether that's on the cloud a private cloud. Even on the Mainframe.

So all these areas really interact. So why today are we talking about API security? First and foremost apis are the lifeblood of many businesses.

It connects you to customers it can actually two partners. It connects different services to different platforms. It connects your data.

I mean very few companies have you know one perfect data Lake instead you're connecting data between different different resources and many times in security. We're focused on sort of front end attacks and not API vulnerability. So it's really a weak point where there hasn't been a lot of investment.

So there's a, you know, lots of security investments in And you know the type of attacks misconfigurations that get a lot of headlines API security isn't getting that type of attention and therefore isn't getting the same. But why else is it important? It's it's the date of that goes across apis.

If you if you're transferring customer data or financial data across apis, you're that's obviously right for an attack. So as a research organization, we're always going out polling our members asking research questions. So one one question, I recently asked our audience in a in a survey was what types of data are shared through apis.

So personal data pii 7% said that type of data is shared across apis 5% said financial data is shared between apis corporate IP and secrets 5% So that that's not a huge percent. And then you I asked all of the above 83% of folks said all of the above so people are sharing pii financial data corporate IP across apis. Gee obviously that's a huge security risk and something you need to to think about as you're creating a security strategy.

Now, let's look at the apis and context of modern application infrastructure. And the way applications are developed. So here are four things that I sort of see with modern devops and Cloud native application development.

Things are getting smaller. We're taking huge monolithic applications turning them into microservices at a discussion last night. Some people don't like the term microservices if you want to call, SOA.

0? That's fine. But however, you're gonna whatever you're going to call it.

All these small small containerized Services need to be connected. How do you connect them apis? Another Hallmark is we need faster higher velocity development key to that is automation throughout your entire devops pipeline, whether that's a code check-ins testing QA all depends on Automation.

And how are you sort of automating managing orchestrating your CI/CD pipeline. You guessed it also apis. What about Cloud native whether whether we're talking about developing applications for a private cloud or infrastructure as code or public Cloud.

How are developers interacting with the infrastructure? apis Finally a major Trend I'm seeing and I think everyone here is probably seeing the same thing is we've moved from writing applications to assembling applications. So it's not just you know, there's still writing and developers are doing a lot of work but there's pre-built micro servers that you're able to take advantage of whether that's pre-built internal micro services or third-party microservices.

And how do you connect all those microservices that are pre-built? You guessed it apis. So clearly apis are sort of this center point of modern application development and the architecture of cloud native applications.

Now when we talk about API security tax It's complex. There's not you know, one way that apis are exploited. It can be really simple.

You can you can have wrongdoers or cyber criminals randomly changing resource IDs to just sort of bounce around and hope to find other customers data and you know, it's not an efficient attack method, but you'd actually be surprised at How effective it can be if whoever produced the API didn't think about security and then there's more advanced complex attacks. Brute Force attacks. You can look for weaknesses in the API API authentication targeted attacks, where where you might have a wrongdoer looking at a specific company and wanting to exploit it and you know, looking through the apis that they take advantage of you also have Apis that are no longer supported so, you know, it may have not been updated so you could have an API in your environment that hasn't been updated in several years.

So let's take a look at you know, this isn't new apis have been around for decades. So there are methods and techniques and plenty of vendors willing to sell you API security offerings. So so what there's a few a few that I list here are web application firewalls API gateways and then manage application Security Services.

So if we talk about wafts and API gateways, they're really they're good. If an API attack follows a certain signature, so so if you have Which a lot do I mean we read about state-sponsored attacks all the time highly sophisticated zero day attacks targeted attacks. The reality is the huge majority of cybersecurity attacks are fairly routine and and looking for open doors poorly configured systems poorly configured apis and a lot of times they will follow a predictable pattern.

And then a third defense is manage application Security Services oftentimes. Those are offered by CDN providers like like the akamaize of the world or Cloud vendors and those use of a combination of DDOS protection. API gateways wax.

Although it's the same. It's the same underlying problem where they weaknesses where it really has the attack really has to follow a specific pattern and and then just like to mention in terms of API gateways. They're great at seeing the traffic and discovering apis, but they were never designed for for security.

So the good at performance. But if you're if you're relying on your API Gateway for security, you're using it in a way that it was never designed for and it'll it's going to come up short. So we talk about it in security.

We talked about in devops all the time. You can't secure what you don't what you don't see. so when you're talking about visibility in apis First you kind of understand what apis are in your environment.

So a question a question that we asked in a recent survey was do you have an inventory of all of the apis that your organization uses? 28% said yes. 16% said not sure and 55% The majority said no.

They don't have an inventory of what apis are in their environment. Is that a surprise not at all? And those of you with large devops organizations know that developers have the freedom to choose a variety of apis it?

Believe it or not. It's not often documented. Well, and then if an application was created, you know years ago who that whoever created it might be long gone.

No, no one knows what apis are built into that. into that application and then in terms of What what else in terms of visibility you besides knowing what apis are in your environment? You got to think about what are your apis doing?

What data is being transferred across apis? There's some apis where yeah are very low in terms of security risk because it it's not transferring customer data. It's not transferring partner data or financial data.

And then there's other ones where you really need to be concerned about. So you get it visibility is important. But how do you gain visibility and there's a there's a few ways one is those API gateways that I said aren't a security tool.

They sort of are you know, they they were designed for API performance, but the reality is They see the traffic going across apis in your network, and they'll help you discover apis. Other other techniques include application security testing and then passive monitoring of your network. So if you see as you monitor traffic along your network, you're going to be able to identify apis and the track and the types of data that flows across those apis.

However, as I've been talking about it's not just about finding apis you got to think about that the the data so in addition to security you got to think about governance compliance regulations, you know, all the sudden you have gdpr. You've got California data privacy issues emerging privacy issues all over the world. And so are you really securing your customer data going across those apis?

You might actually be non-compliant once you start figuring out. All right. I've got these apis and this is the type of data flowing from one system to another so securing apis There's no magic bullet.

I'd love to say, you know, go, you know, here's the list of four vendors pick one and you're you're all set, but we all know the world isn't that easy? So instead I've created a list of three things to look at and think about as your as your creating a strategy for API security and then before we hit those let's just go to another research point in terms of planning API security. So question.

I recently asked are membership was do you have an API security project plan in 2022? And it almost 50% said yes, so about 15% said yes, and it's funding funded. 32% So a third said yes, and we are currently in an investigative phase.

and then 20% said No, but it's planned. It's on our strategic roadmap. And then about a third said they're not planning to pursue any sort of API security.

So about two thirds are at some phase of approaching this big problem and then a third. say it's not on our roadmap, which is concerning given the the amount the importance of apis. So let's look at those three three things that I think are important when you start putting together your API security strategy.

So the first is API scanning. And what the what this capability does is it looks are weak authentications loose definitions and it checks apis against internal security policies. The real the real power of API scanning is it'll create Flags in your devops pipeline.

So if a developer goes to using API and it it goes against security your internal security protocols. It's going to set up flag and the developer is going to be aware aware of the issue that that's often one of the problems with devops and SecOps is your developers are focused on creating your great applications. Great outcomes.

They are of course need to be security where but they're not Security Experts. They're not gonna do a deep dive into you know, the authentication of an API and and the documentation of an API. So if you can give them the knowledge, then they'll make better decisions.

But if they don't have the knowledge it's hard to create a SecOps environment or promote security and shift left if developers don't have tools to help them. Create secure applications. So this is sort of the API scanning is sort of in the guardrails type bucket where you're creating Safeways for developers to create applications.

Then there's detection and blocking. and this is different, you know, we talked about wax earlier and you've got to follow a and they'll protect you against, you know, very prescribed methods of attack detection and blocking is more of a I have a modern approach to API security and these are these are solutions and systems that understand modern modern attack parameters the way. Emerging threats are attacking apis the the vulnerabilities of apis and then if you want to take a a positive security approach, you can also set parameters where you only allow apis to act the way that it's contracted that so if it goes outside of that parameter, it's blocked.

Now, of course, you know security would love that but that also make you really need to understand the way your application interacts with the API. Otherwise, you're going to potentially block legitimate API calls. Now the third the third thing that you're going to want to look at is anomaly anomal anomaly detection always a word I stumble on and machine learning is really fundamental to this and I know some of you probably roll your eyes and hear machine learning and security and devops every vendor, you know, I I always think you every vendor puts it in their pitch because they'll get some extra money from private Equity maybe a maybe a customer will be impressed and their bosses will be impressed when they say machine learning but the reality is machine learning is is valuable in this area and and the role of machine learning is that it can understand your system.

What's what's normal and instead of Baseline for your environment and and then what the detection platform will do is it'll raise a flag. We're seeing something unusual. It's deviating from the Baseline.

We need security to take a look at this and it's not necess. Currently going to automatically shut down an activity, but it'll raise a flare or raise a red flag and security can be proactive and say this is this is fine or you know gee this is unusual. We're seeing a huge amount of data flow across this API and then all of a sudden you might discover that a, you know, a partner or a employee who soon to be fired is a taking huge amounts of data out of your environment or something along those lines or a, you know, an external wrongdoor as well.

So obviously devops is a hot-term and then you know, why not throw Security in that with SecOps and that should solve everything right? You know, we're gonna shift security left. We're going to say that we're a SecOps organization and and walk away.

Maybe we'll change the seating of the office so that security Folks at closer to to developers and operations and that should solve everything but it's of course more complex than that, you know as we've all read I've written many many. Papers articles books about you know cultures really important. I think another another aspect of SecOps is that it's not devops versus security.

The idea of SecOps isn't that the devops folks become security practitioners and the security team isn't important anymore instead. It's about the security team working with the devops team and giving developers tools platforms that they can understand. So it's unrealistic that you're developers are going to start understanding, you know security log data and and you know, they're not gonna they're not gonna come, you know, become sock analysts and things like that but instead it's really about integrating security insights into the devops pipeline.

And then finally what I really believe is that we're sort of an error where we need to start rethinking security tools. So all of those traditional laughs and and API gateways that we discussed they're still important by all means. Yeah, you're not going to get rid of them.

But you need more cloud-native Cloud specific security practices and security tools. So the so the security tools that were really designed for on-prem and traditional application development. They they sort of work in the beginning as you shifted the cloud, but they don't scale and they were never really designed for a distributed system and Cloud native development.

And then finally you really need to start understanding your tax service and you know your API environment and and how wrongdoors might attack apis. So just want to thank everyone for joining me today, and as a reminder, we're part of a tech strong group, and my name is Daniel Kirsch with tech strong research. Thank you.