Building usable API layer requires balancing between security and usability. Operating API endpoints includes addressing fraud and delivering privacy-by-design. Modern management frameworks and gateways guarantee stateful operations whether the APIs themselves are stateful or not.

1. © Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners.
© Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners. 1
Building Secure and
Resilient APIs
Manah Khalil
ExecutiveDirector
Identity,Fraud& EmergingTechnologies

2. © Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners.
2
Security
Identity of Caller
Fraud Privacy
Defining API Security

3. © Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners.
3
● New OWASP Top 10 (A10) highlights importance of API security
● Bot attacks and relay attacks (through trusted parties)
● CAPTCHA mainly designed for UI, not suitablefor API
● IP blacklisting, velocity attacks
● Certificate pinning is costly and not scalable
● TOR network and other anonymizers weaken traditional controls
● 4th generation 1 bots becoming smarter, emulating humans
● Trusted parties expose bigger risk when channeling attacks (e.g. retailers)
1 https://blog.radware.com/security/2019/09/meet-the-four-generations-of-bots/
Fraudsters and hackers focus on openAPIs

4. © Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners.
4
● Code vulnerabilities
● OSS vulnerabilities
● Input validation
● Session hijacking
● Data leak(unintendedexposure of data)
● Data handling (masking,redaction,tokenization,encryption...)
● Unauthorized callers, misconfigured access control
● Data consistency (cache-poisoning,latent/lazypersistence)
● Thread management and parallel execution
● Denial of service, throttling,resource pooling
API inherits and extends the app surface of attack

5. © Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners.
5
● Business logic
● Insiders attack
● Attack from within the network
Emerging types of attack

6. © Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners.
6
Complexity for securing APIs
● Limited device fingerprinting
● IP-based metadata
● Custom data submitted by caller and not device
● Certificate management
● Authentication and authorization
● Session management (state, caching, synchronization)
● Chaining/relaying through trusted 3rd parties

7. © Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners.
7
Designing for security and privacy by design
● Layering and defense-in-depth
● Centralized choking point, but also more control
● WAF
● Identity gateway for AuthN/AuthZ
● API gateway
● Centralized risk scoring and policy
● API inventory (allow <api>, deny *)
● Assume everything WILL fail
● Focus on the asset not the caller
(external or internal users)
● Privacy-by-design
● Authentication AND Authorization
● Session Management
● Multi-factor Authentication (MFA) at API level
CHOKE POINT
LAYERED
DEFENSE

8. © Verizon2019, AllRights Reserved. Informationcontainedhereinis providedAS IS andsubject to changewithout notice. All trademarksused herein arepropertyoftheir respectiveowners.
8
Audit and Traceability Usable Logging Actionable Monitoring
Other related capabilities

9. Verizon confidentialand proprietary. Unauthorizeddisclosure, reproduction or otheruse prohibited. 9