Welcome!

@CloudExpo Authors: Liz McMillan, Elizabeth White, Yeshim Deniz, Pat Romanski, William Schmarzo

Related Topics: @CloudExpo

@CloudExpo: Article

API Security: Six Themes for Securing Your API | @CloudExpo #API #Cloud #Security #Microservices

There are a few key areas your team should be focused on if you have responsibility for an API

API Security: Six Themes for Securing Your API
By Cameron Laird

Security certainly feels a lot more like a journey than a destination. This is especially true with APIs becoming a critical piece of any mobile or web application. With so much information being shared through APIs, teams need to ask themselves: how can you effectively secure your API?

While the security demands of developing and maintaining APIs will continue to evolve, there are a few key areas your team should be focused on if you have have responsibility for an Application Programming Interface (API):

1. Mobility
Mobility, mobility, mobility. If you want to know the top three themes for 2016 (and the last few years) that would be it. Between mobile consumers who count on results while on the go, and the ongoing explosion of the Internet of Things (IoT), the most important API trends in 2016 are centered on mobile consumption.

What makes mobile API use special? Authentication, reliability, and performance constraints.

A simple-minded design might model an API client directly on a mobile device, in communication with the API server. This is rarely appropriate, though, because it entails embedding an API key on the handheld. This effectively means that the application's API key - created as a private asset of the application developer - is available to any user of the application or mobile device. This should rarely be acceptable.

It might seem that mobile native applications have the same architectural constraints as Web applications; at a sufficiently high level of abstraction, they do look much the same.

But there are also a few crucial differences.

Web browsers build in a great deal of security sophistication, particularly in regard to certificate and DNS (domain name system) management. Native applications rarely attempt, let alone achieve, the same level of authentication refinement. This is true in a couple of complementary aspects: first, only large-scale projects like browsers currently undertake such demanding technologies as HTTP Strict Transport (HSTS).

Also, Web development culture is simply more advanced in regard to coding: many Web developers at least are familiar with the idea of generation of a new token for each use of a form, as protection against Cross-Site Request Forgery (CSRF). While CSRF is a considerably smaller threat for native applications, native application programmers too often aren't even aware of their CSRF vulnerabilities.

Source cracking is similar. Web developers generally understand that client-side code is effectively public. Most know that API keys and other constants in JavaScript are straightforward to access. Too many native application programmers succumb to the temptation of compiling credentials into their applications. While it's harder to get at the source of a native application than the corresponding client-side Web application, the difficulty is not enough that native application programmers should feel safe.

What alternative do developers have?

One way or another, secure API-based applications essentially need communication with at least two servers. Any API key must be on an application server, either in direct communication with the API server, or at least delivering API tokens for a protocol such as OAuth.

Mobile APIs also face a reliability challenge. While traditional client-server and SOA (service-oriented architecture) applications often can assume connectivity between client and server, that's unrealistic for many mobile applications. At the very least, many of the communications of a mobile application must build in retries and more care in error-handling.

Part of the solution for these difficulties is to use standard frameworks or libraries that take responsibility for secure, reliable, and adequately-performing communications and session management. At the same time, too many frameworks encourage simple-minded fine-grained exposure of underlying database tables. It's a greater consumer benefit and almost certainly more secure to define instead a higher-level API expressed in business logic, rather than data tables or low-level object attributes. Smart developers, therefore, use a framework, but carefully craft the API to provide just what client applications need, without the excess of functionality that invites attack from crackers.

2. Community success
The second big theme for API security in 2016 is thoughtful support of the developer community. Most API publishers document their offerings to the point of a reference manual of signatures, and probably a "Hello, world!"-level sample program. One of the best investments publishers can make is in richer support of their API consumers: a collection of example programs illustrating different security practices, prompt technical support, community infrastructure for public answers to questions, and continuing education through webinars or podcasts or other means. The publisher should target, not just sale of licenses, but successful deployments of working, secure applications by its licensees. Among other pay-offs, this is a great way to prevent security incidents that tarnish the API's brand.

The previous section, on Mobility, already mentioned cultural differences between Web and native development. Cultivation of a healthy culture around that specific API is simply a winning bet. The alternative is to assume application developers teach themselves how to make the most of the API. An API worth careful, secure engineering also deserves corresponding care with its consumers.

3. Measurement
An API publisher provides and documents an entry point such as Customer. A trustworthy API publishers knows more about Customer: how often customers request it, the variations in that rate, the distribution of latencies in delivering results to customers, the defaults customers use, and so on. An essential element of security is to log, measure, and review daily operations. Among other benefits, this enables detection of anomalies as well as prioritization of security enhancements.

Measurement is necessary for rational management on all fronts. Questions about scaling, pricing, hiring, and so on all deserve answers based on measurement of actual API usage.

4. Testing
Testing is a crucial theme
of API security every year, not just in 2016. One aspect of functional testing especially timely now is beyond-ASCII data. Too many testing suites rely on data with the complexity of "Hello, World". When customers send through other-than-English Unicode data, errors too often turn up. When crackers experiment with carefully-crafted Unicode spoofs, vulnerabilities open up. In 2016, it's time not just to test that an API works, but that it works safely.

5. API Management
Service providers - Content Developer Networks (CDNs), API gateways, API proxies, and more - offer a range of values for API publishers. Most API publishers should focus on the functionality of their APIs, while buying security, scaling, and manageability expertise outside. 2016 is a good time to explore the increasingly sophisticated marketplace for API management.

6. Microservices
Microservices
are certainly fashionable now. The implications of microservice implementations for API security are complex and beyond the scope of this survey. The starting point for such an analysis is that an API publisher clearly understand its own business and technical goals with its API: is it trying to re-use assets and reduce the costs of internal projects? Profit from the interest of external application authors? Will the API grow in traffic to a constant collection of entry points, or is the intent to extend the API "horizontally" to richer services? Is the API a fine-grained exposure of data tables, or a higher-order access to business logic? All these questions bear on the role of microservices in an API architecture.

Summary
API growth has only begun; it's still more future than past. With a little care, prospective API publishers can arrange the basic security that keeps the bad guys away, and allows focus on the functionality and customer service that deserve attention.

More Stories By SmartBear Blog

As the leader in software quality tools for the connected world, SmartBear supports more than two million software professionals and over 25,000 organizations in 90 countries that use its products to build and deliver the world’s greatest applications. With today’s applications deploying on mobile, Web, desktop, Internet of Things (IoT) or even embedded computing platforms, the connected nature of these applications through public and private APIs presents a unique set of challenges for developers, testers and operations teams. SmartBear's software quality tools assist with code review, functional and load testing, API readiness as well as performance monitoring of these modern applications.

@CloudExpo Stories
SYS-CON Events announced today that Outscale, a global pure play Infrastructure as a Service provider and strategic partner of Dassault Systèmes, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2010, Outscale simplifies infrastructure complexities and boosts the business agility of its customers. Outscale delivers a secure, reliable and industrial strength solution for its customers, which in...
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet th...
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory?
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloudistics delivers a complete public cloud experience with composable on-premises infrastructures to medium and large enterprises. Its software-defined technology natively converges network, storage, compute, virtualization, and management into a ...
SYS-CON Events announced today that A&I Solutions has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 1999, A&I Solutions is a leading information technology (IT) software and services provider focusing on best-in-class enterprise solutions. By partnering with industry leaders in technology, A&I assures customers high performance levels across all IT environments including: mai...
Every successful software product evolves from an idea to an enterprise system. Notably, the same way is passed by the product owner's company. In his session at 20th Cloud Expo, Oleg Lola, CEO of MobiDev, will provide a generalized overview of the evolution of a software product, the product owner, the needs that arise at various stages of this process, and the value brought by a software development partner to the product owner as a response to these needs.
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software in the hope of capturing value in IoT. Although IoT is relatively new in the market, it has already gone through many promotional terms such as IoE, IoX, SDX, Edge/Fog, Mist Compute, etc. Ultimately, irrespective of the name, it is about deriving value from independent software assets participating in an ecosystem as one comprehensive solution.
SYS-CON Events announced today that EARP will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. "We are a software house, so we perfectly understand challenges that other software houses face in their projects. We can augment a team, that will work with the same standards and processes as our partners' internal teams. Our teams will deliver the same quality within the required time and budget just as our partn...
SYS-CON Events announced today that delaPlex will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. delaPlex pioneered Software Development as a Service (SDaaS), which provides scalable resources to build, test, and deploy software. It’s a fast and more reliable way to develop a new product or expand your in-house team.
SYS-CON Events announced today that Tappest will exhibit MooseFS at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. MooseFS is a breakthrough concept in the storage industry. It allows you to secure stored data with either duplication or erasure coding using any server. The newest – 4.0 version of the software enables users to maintain the redundancy level with even 50% less hard drive space required. The software func...
SYS-CON Events announced today that Systena America will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Systena Group has been in business for various software development and verification in Japan, US, ASEAN, and China by utilizing the knowledge we gained from all types of device development for various industries including smartphones (Android/iOS), wireless communication, security technology and IoT serv...
SYS-CON Events announced today that Outscale will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outscale's technology makes an automated and adaptable Cloud available to businesses, supporting them in the most complex IT projects while controlling their operational aspects. You boost your IT infrastructure's reactivity, with request responses that only take a few seconds.
Regardless of what business you’re in, it’s increasingly a software-driven business. Consumers’ rising expectations for connected digital and physical experiences are driving what some are calling the "Customer Experience Challenge.” In his session at @DevOpsSummit at 20th Cloud Expo, Marco Morales, Director of Global Solutions at CollabNet, will discuss how organizations are increasingly adopting a discipline of Value Stream Mapping to ensure that the software they are producing is poised to o...
DevOps at Cloud Expo – being held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real r...
Cloud applications are seeing a deluge of requests to support the exploding advanced analytics market. “Open analytics” is the emerging strategy to deliver that data through an open data access layer, in the cloud, to be directly consumed by external analytics tools and popular programming languages. An increasing number of data engineers and data scientists use a variety of platforms and advanced analytics languages such as SAS, R, Python and Java, as well as frameworks such as Hadoop and Spark...
Interested in leveling up on your Cloud Foundry skills? Join IBM for Cloud Foundry Days on June 7 at Cloud Expo New York at the Javits Center in New York City. Cloud Foundry Days is a free half day educational conference and networking event. Come find out why Cloud Foundry is the industry's fastest-growing and most adopted cloud application platform.
Cloud promises the agility required by today’s digital businesses. As organizations adopt cloud based infrastructures and services, their IT resources become increasingly dynamic and hybrid in nature. Managing these require modern IT operations and tools. In his session at 20th Cloud Expo, Raj Sundaram, Senior Principal Product Manager at CA Technologies, will discuss how to modernize your IT operations in order to proactively manage your hybrid cloud and IT environments. He will be sharing bes...
SYS-CON Events announced today that delaPlex will exhibit at SYS-CON's @CloudExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. delaPlex pioneered Software Development as a Service (SDaaS), which provides scalable resources to build, test, and deploy software. It’s a fast and more reliable way to develop a new product or expand your in-house team.
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In his Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, will explore t...
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...