Welcome!

@CloudExpo Authors: Kong Yang, Liz McMillan, Elizabeth White, Carmen Gonzalez, Yeshim Deniz

Related Topics: @CloudExpo

@CloudExpo: Article

API Security: Six Themes for Securing Your API | @CloudExpo #API #Cloud #Security #Microservices

There are a few key areas your team should be focused on if you have responsibility for an API

API Security: Six Themes for Securing Your API
By Cameron Laird

Security certainly feels a lot more like a journey than a destination. This is especially true with APIs becoming a critical piece of any mobile or web application. With so much information being shared through APIs, teams need to ask themselves: how can you effectively secure your API?

While the security demands of developing and maintaining APIs will continue to evolve, there are a few key areas your team should be focused on if you have have responsibility for an Application Programming Interface (API):

1. Mobility
Mobility, mobility, mobility. If you want to know the top three themes for 2016 (and the last few years) that would be it. Between mobile consumers who count on results while on the go, and the ongoing explosion of the Internet of Things (IoT), the most important API trends in 2016 are centered on mobile consumption.

What makes mobile API use special? Authentication, reliability, and performance constraints.

A simple-minded design might model an API client directly on a mobile device, in communication with the API server. This is rarely appropriate, though, because it entails embedding an API key on the handheld. This effectively means that the application's API key - created as a private asset of the application developer - is available to any user of the application or mobile device. This should rarely be acceptable.

It might seem that mobile native applications have the same architectural constraints as Web applications; at a sufficiently high level of abstraction, they do look much the same.

But there are also a few crucial differences.

Web browsers build in a great deal of security sophistication, particularly in regard to certificate and DNS (domain name system) management. Native applications rarely attempt, let alone achieve, the same level of authentication refinement. This is true in a couple of complementary aspects: first, only large-scale projects like browsers currently undertake such demanding technologies as HTTP Strict Transport (HSTS).

Also, Web development culture is simply more advanced in regard to coding: many Web developers at least are familiar with the idea of generation of a new token for each use of a form, as protection against Cross-Site Request Forgery (CSRF). While CSRF is a considerably smaller threat for native applications, native application programmers too often aren't even aware of their CSRF vulnerabilities.

Source cracking is similar. Web developers generally understand that client-side code is effectively public. Most know that API keys and other constants in JavaScript are straightforward to access. Too many native application programmers succumb to the temptation of compiling credentials into their applications. While it's harder to get at the source of a native application than the corresponding client-side Web application, the difficulty is not enough that native application programmers should feel safe.

What alternative do developers have?

One way or another, secure API-based applications essentially need communication with at least two servers. Any API key must be on an application server, either in direct communication with the API server, or at least delivering API tokens for a protocol such as OAuth.

Mobile APIs also face a reliability challenge. While traditional client-server and SOA (service-oriented architecture) applications often can assume connectivity between client and server, that's unrealistic for many mobile applications. At the very least, many of the communications of a mobile application must build in retries and more care in error-handling.

Part of the solution for these difficulties is to use standard frameworks or libraries that take responsibility for secure, reliable, and adequately-performing communications and session management. At the same time, too many frameworks encourage simple-minded fine-grained exposure of underlying database tables. It's a greater consumer benefit and almost certainly more secure to define instead a higher-level API expressed in business logic, rather than data tables or low-level object attributes. Smart developers, therefore, use a framework, but carefully craft the API to provide just what client applications need, without the excess of functionality that invites attack from crackers.

2. Community success
The second big theme for API security in 2016 is thoughtful support of the developer community. Most API publishers document their offerings to the point of a reference manual of signatures, and probably a "Hello, world!"-level sample program. One of the best investments publishers can make is in richer support of their API consumers: a collection of example programs illustrating different security practices, prompt technical support, community infrastructure for public answers to questions, and continuing education through webinars or podcasts or other means. The publisher should target, not just sale of licenses, but successful deployments of working, secure applications by its licensees. Among other pay-offs, this is a great way to prevent security incidents that tarnish the API's brand.

The previous section, on Mobility, already mentioned cultural differences between Web and native development. Cultivation of a healthy culture around that specific API is simply a winning bet. The alternative is to assume application developers teach themselves how to make the most of the API. An API worth careful, secure engineering also deserves corresponding care with its consumers.

3. Measurement
An API publisher provides and documents an entry point such as Customer. A trustworthy API publishers knows more about Customer: how often customers request it, the variations in that rate, the distribution of latencies in delivering results to customers, the defaults customers use, and so on. An essential element of security is to log, measure, and review daily operations. Among other benefits, this enables detection of anomalies as well as prioritization of security enhancements.

Measurement is necessary for rational management on all fronts. Questions about scaling, pricing, hiring, and so on all deserve answers based on measurement of actual API usage.

4. Testing
Testing is a crucial theme
of API security every year, not just in 2016. One aspect of functional testing especially timely now is beyond-ASCII data. Too many testing suites rely on data with the complexity of "Hello, World". When customers send through other-than-English Unicode data, errors too often turn up. When crackers experiment with carefully-crafted Unicode spoofs, vulnerabilities open up. In 2016, it's time not just to test that an API works, but that it works safely.

5. API Management
Service providers - Content Developer Networks (CDNs), API gateways, API proxies, and more - offer a range of values for API publishers. Most API publishers should focus on the functionality of their APIs, while buying security, scaling, and manageability expertise outside. 2016 is a good time to explore the increasingly sophisticated marketplace for API management.

6. Microservices
Microservices
are certainly fashionable now. The implications of microservice implementations for API security are complex and beyond the scope of this survey. The starting point for such an analysis is that an API publisher clearly understand its own business and technical goals with its API: is it trying to re-use assets and reduce the costs of internal projects? Profit from the interest of external application authors? Will the API grow in traffic to a constant collection of entry points, or is the intent to extend the API "horizontally" to richer services? Is the API a fine-grained exposure of data tables, or a higher-order access to business logic? All these questions bear on the role of microservices in an API architecture.

Summary
API growth has only begun; it's still more future than past. With a little care, prospective API publishers can arrange the basic security that keeps the bad guys away, and allows focus on the functionality and customer service that deserve attention.

More Stories By SmartBear Blog

As the leader in software quality tools for the connected world, SmartBear supports more than two million software professionals and over 25,000 organizations in 90 countries that use its products to build and deliver the world’s greatest applications. With today’s applications deploying on mobile, Web, desktop, Internet of Things (IoT) or even embedded computing platforms, the connected nature of these applications through public and private APIs presents a unique set of challenges for developers, testers and operations teams. SmartBear's software quality tools assist with code review, functional and load testing, API readiness as well as performance monitoring of these modern applications.

@CloudExpo Stories
SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in compute, storage and networking technologies, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology, is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/...
Amazon has gradually rolled out parts of its IoT offerings in the last year, but these are just the tip of the iceberg. In addition to optimizing their back-end AWS offerings, Amazon is laying the ground work to be a major force in IoT – especially in the connected home and office. Amazon is extending its reach by building on its dominant Cloud IoT platform, its Dash Button strategy, recently announced Replenishment Services, the Echo/Alexa voice recognition control platform, the 6-7 strategic...
Bert Loomis was a visionary. This general session will highlight how Bert Loomis and people like him inspire us to build great things with small inventions. In their general session at 19th Cloud Expo, Harold Hannon, Architect at IBM Bluemix, and Michael O'Neill, Strategic Business Development at Nvidia, discussed the accelerating pace of AI development and how IBM Cloud and NVIDIA are partnering to bring AI capabilities to "every day," on-demand. They also reviewed two "free infrastructure" pr...
Judith Hurwitz is president and CEO of Hurwitz & Associates, a Needham, Mass., research and consulting firm focused on emerging technology, including big data, cognitive computing and governance. She is co-author of the book Cognitive Computing and Big Data Analytics, published in 2015. Her Cloud Expo session, "What Is the Business Imperative for Cognitive Computing?" is scheduled for Wednesday, June 8, at 8:40 a.m. In it, she puts cognitive computing into perspective with its value to the busin...
SYS-CON Events announced today that Hitachi, the leading provider the Internet of Things and Digital Transformation, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Hitachi Data Systems, a wholly owned subsidiary of Hitachi, Ltd., offers an integrated portfolio of services and solutions that enable digital transformation through enhanced data management, governance, mobility and analytics. We help globa...
Blockchain is a shared, secure record of exchange that establishes trust, accountability and transparency across supply chain networks. Supported by the Linux Foundation's open source, open-standards based Hyperledger Project, Blockchain has the potential to improve regulatory compliance, reduce cost and time for product recall as well as advance trade. Are you curious about Blockchain and how it can provide you with new opportunities for innovation and growth? In her session at 20th Cloud Exp...
Cognitive Computing is becoming the foundation for a new generation of solutions that have the potential to transform business. Unlike traditional approaches to building solutions, a cognitive computing approach allows the data to help determine the way applications are designed. This contrasts with conventional software development that begins with defining logic based on the current way a business operates. In her session at 18th Cloud Expo, Judith S. Hurwitz, President and CEO of Hurwitz & ...
The explosion of new web/cloud/IoT-based applications and the data they generate are transforming our world right before our eyes. In this rush to adopt these new technologies, organizations are often ignoring fundamental questions concerning who owns the data and failing to ask for permission to conduct invasive surveillance of their customers. Organizations that are not transparent about how their systems gather data telemetry without offering shared data ownership risk product rejection, regu...
Financial Technology has become a topic of intense interest throughout the cloud developer and enterprise IT communities. Accordingly, attendees at the upcoming 20th Cloud Expo at the Javits Center in New York, June 6-8, 2017, will find fresh new content in a new track called FinTech.
SYS-CON Events announced today that Interoute, owner-operator of one of Europe's largest networks and a global cloud services platform, has been named “Bronze Sponsor” of SYS-CON's 20th Cloud Expo, which will take place on June 6-8, 2017 at the Javits Center in New York, New York. Interoute is the owner-operator of one of Europe's largest networks and a global cloud services platform which encompasses 12 data centers, 14 virtual data centers and 31 colocation centers, with connections to 195 add...
In recent years, containers have taken the world by storm. Companies of all sizes and industries have realized the massive benefits of containers, such as unprecedented mobility, higher hardware utilization, and increased flexibility and agility; however, many containers today are non-persistent. Containers without persistence miss out on many benefits, and in many cases simply pass the responsibility of persistence onto other infrastructure, adding additional complexity.
@DevOpsSummit at Cloud taking place June 6-8, 2017, at Javits Center, New York City, is co-located with the 20th International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long developm...
The age of Digital Disruption is evolving into the next era – Digital Cohesion, an age in which applications securely self-assemble and deliver predictive services that continuously adapt to user behavior. Information from devices, sensors and applications around us will drive services seamlessly across mobile and fixed devices/infrastructure. This evolution is happening now in software defined services and secure networking. Four key drivers – Performance, Economics, Interoperability and Trust ...
Grape Up is a software company, specialized in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market across the USA and Europe, we work with a variety of customers from emerging startups to Fortune 1000 companies.
Cloud Expo, Inc. has announced today that Aruna Ravichandran, vice president of DevOps Product and Solutions Marketing at CA Technologies, has been named co-conference chair of DevOps at Cloud Expo 2017. The @DevOpsSummit at Cloud Expo New York will take place on June 6-8, 2017, at the Javits Center in New York City, New York, and @DevOpsSummit at Cloud Expo Silicon Valley will take place Oct. 31-Nov. 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Multiple data types are pouring into IoT deployments. Data is coming in small packages as well as enormous files and data streams of many sizes. Widespread use of mobile devices adds to the total. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will look at the tools and environments that are being put to use in IoT deployments, as well as the team skills a modern enterprise IT shop needs to keep things running, get a handle on all this data, and deli...
SYS-CON Events announced today that Grape Up will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company specializing in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market across the U.S. and Europe, Grape Up works with a variety of customers from emergi...
Automation is enabling enterprises to design, deploy, and manage more complex, hybrid cloud environments. Yet the people who manage these environments must be trained in and understanding these environments better than ever before. A new era of analytics and cognitive computing is adding intelligence, but also more complexity, to these cloud environments. How smart is your cloud? How smart should it be? In this power panel at 20th Cloud Expo, moderated by Conference Chair Roger Strukhoff, pane...
SYS-CON Events announced today that Juniper Networks (NYSE: JNPR), an industry leader in automated, scalable and secure networks, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Juniper Networks challenges the status quo with products, solutions and services that transform the economics of networking. The company co-innovates with customers and partners to deliver automated, scalable and secure network...
SYS-CON Events announced today that Twistlock, the leading provider of cloud container security solutions, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Twistlock is the industry's first enterprise security suite for container security. Twistlock's technology addresses risks on the host and within the application of the container, enabling enterprises to consistently enforce security policies, monitor...