JENNY: Hi.
I'm Jenny, and today I'll be talking to you
about the top security threats APIs
face as well as best practices for how to secure your APIs.
Let's get started.
[MUSIC PLAYING]
API security is a broad field with many vulnerabilities,
threats, and protection practices
to take into consideration.
APIs face the same threats as software and web apps,
but because they have a unique set of vulnerabilities,
they also face unique threats.
We've boiled all these down to six main security threats
that you should protect against--
basic software bugs, injection threats, service availability
threats, user identity threats, insider threats,
and spam and abuse.
The first API security threat is your basic software bug.
Protecting against basic software bugs
is a matter of organizing regular tests and reviews,
and this is vital to your success.
Start by ensuring your organization
has good software engineering in place.
This means using standardized coding guidelines
and instituting code reviews.
Ensure that new code is tested regularly
by reproducing security issues in your own environment,
fixing them, and quickly rolling them into production.
You haven't already, implement security reviews.
Doing so ensures that the security
issues that one API faces will not be repeated or resurface
with another API.
You may also consider engaging in 3rd party penetration tests
in order to get a realistic picture of how vulnerable
your systems, data, and APIs are from an outside perspective.
APIs also face injection attack threats
like SQL injection, remote code execution, or cross site
scripting.
Injection attacks occur when malicious code
is injected into a vulnerable software program.
Luckily, since APIs have open API specifications or swagger
specs with well identified inputs and outputs,
these threats are easy to protect against using
consistent input validation.
API management platforms like Apigee
provide a host of policies that allow you to easily deploy
input validation.
Service availability threats are also a large concern
to organizations.
These attacks target APIs by flooding your network
with requests, resulting in denial of service issues.
To protect against these attacks,
we recommend that you use the volumetric defense
tools Apigee provides, such as rate limiting and quota
policies.
Using these with other Google Cloud tools
like Google Frontend Load Balancers, which
are built specifically to deal with DDoS protection,
is a great best practice to follow.
Although many people consider good customer experience
as supporting and guiding a customer through their purchase
journey, great customer experience
also means protecting the user and their identity
at every moment in time.
To protect against user identity threats,
you'll want to use an API gateway that
allows you to integrate OAuth, JSON Web Tokens, signatures,
API keys, and more defense mechanisms that validate
and ensure authentication and authorization.
With API management, you don't need
to sacrifice user satisfaction for security.
Building and deploying a developer portal
is a great way to give your API consumers
a self-service experience to understand
the APIs you're exposing and request the access they need.
Plus, Apigee offers API monitoring and analytics
dashboards so that you can gain a holistic view of the health
and security of your API programs.
Insider threats are an increasing problem
for enterprise security and remind us
that security breaches don't just come from the outside in,
but can also come from within.
With so many employees and contractors having access
to sensitive information in an organization,
a key first step to defend against insider threats
is to integrate your API management
system and your Google Cloud console
with your enterprise single sign on system.
You also want to centralize and structure
your change management processes so that developers
have clear visibility of any changes that
are occurring to your software infrastructure.
This includes knowing who is making the changes, what
the changes are, who approved them,
and why the changes are being made.
Last but not least, let's talk about spam and abuse.
A considerable amount of API traffic
comes from automated actors that engage
in credential stuffing, brute forcing, and content scraping.
The most important thing to remember
is that you can't secure your APIs against threats
that you can't see.
Establish API traffic visibility through an API management
platform like Apigee, where you'll
be able to observe and capitalize
upon good, legitimate traffic, while also
being able to identify and block against bad actors.
In summary, APIs face several security threats
ranging from basic software bugs to spam and abuse.
API management is a key part of your security architecture
and will help you spend less time reacting
to security issues and more time innovating.
Assessing opportunities for improvement
and prioritizing security efforts
based on perceived risks is an important part
of doing business in today's increasingly digital world,
and Google Cloud is here to make your security defenses
intuitive, intelligent, and reliable.
To learn more, please review the resources below.
[MUSIC PLAYING]