In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
When IT elements are connected, they form an integration. Any IT solution can be viewed as a system of interconnected elements. That is why integration security is fundamentally important. API (Application Programming Interface) security is a subset of it.
Authentication (AuthN) and authorisation (AuthZ) are two major components of integration security. For more information, see: Pocket Guide: Authentication and Pocket Guide: Authorisation.
OAuth2 is the most common protocol for API authentication, as it is flexible, extensible, and supports federation. Instead of passwords, it transmits access tokens. The tokens are typically short-lived, which makes it harder to re-use them for another (malicious) API session.
In addition to that, IP whitelisting is a strong security control – also known as firewalling. It allows definition of permitted traffic flows based on protocol, source and destination addresses, source and destination ports, and traffic direction.
We distinguish between stateful and stateless firewalls. Stateful firewall is aware of the connection context, thus it is more secure and easier to configure. Thanks to connection tracking tables, it is able to deny traffic not associated with the existing connection context and prevent certain types of attack, for example, port scanning.
Another major integration control is encryption in transit, which protects data from eavesdropping while in motion. Similarly to encryption at rest, it requires encryption keys and strong encryption algorithm. As the algorithm is typically negotiated for every transit sessoin, make sure only strong algorithms are allowed.
Contrary to the encryption at rest, the encryption keys can be discarded as soon as the transmission is complete. That allows for Perfect Forward Secrecy, where compromise of a session key does not lead to the compromise of all sessions.
Input validation is crucial for integration security. If we accept input from untrusted source, we need to validate it does not contain malicious code like SQL injection commands or cross-site scripts (XSS).
We will discuss rate limiting and Denial of Service (DoS) protection in this article.
Application examples
Bank employees connecting to internal bank systems use Transport Layer Security (TLS) to encrypt their communications in transit. The bank firewall blocks all connections to internal systems that do not originate from within the bank’s Virtual Private Network (VPN).
Risks
Encryption in transit is ubiquitous, and it protects well against eavesdropping and data tampering.
Things would likely go wrong in authentication and authorisation domains. 5 out of OWASP Top 10 API Security Risks relate to authentication and authorisation. Common risk is over-powered API implementation, which does not follow the principle of least privilege or principle of least data.
Quirks
IP whitelisting as a security control loses its effectiveness as modern IT systems often have dynamic source and destination addresses, making it hard or impossible to implement accurate firewall rules. Advanced firewalls partially solve that problem by operating on network tags or resource names instead of IP addresses. That is especially useful in cloud environments, where IP addresses change frequently, and not guaranteed to belong to a certain resource.
A less obvious risk with third-party API integrations is that changes to the API specification can disrupt our service.
Further reading
Pocket Guide: Securing Availability
Please check out the map of cyber security controls below. It is simple yet awesome.
