Welcome!

@CloudExpo Authors: Elizabeth White, Shelly Palmer, Pat Romanski, Karthick Viswanathan, Liz McMillan

Related Topics: @CloudExpo

@CloudExpo: Article

API Security: Six Themes for Securing Your API | @CloudExpo #API #Cloud #Security #Microservices

There are a few key areas your team should be focused on if you have responsibility for an API

API Security: Six Themes for Securing Your API
By Cameron Laird

Security certainly feels a lot more like a journey than a destination. This is especially true with APIs becoming a critical piece of any mobile or web application. With so much information being shared through APIs, teams need to ask themselves: how can you effectively secure your API?

While the security demands of developing and maintaining APIs will continue to evolve, there are a few key areas your team should be focused on if you have have responsibility for an Application Programming Interface (API):

1. Mobility
Mobility, mobility, mobility. If you want to know the top three themes for 2016 (and the last few years) that would be it. Between mobile consumers who count on results while on the go, and the ongoing explosion of the Internet of Things (IoT), the most important API trends in 2016 are centered on mobile consumption.

What makes mobile API use special? Authentication, reliability, and performance constraints.

A simple-minded design might model an API client directly on a mobile device, in communication with the API server. This is rarely appropriate, though, because it entails embedding an API key on the handheld. This effectively means that the application's API key - created as a private asset of the application developer - is available to any user of the application or mobile device. This should rarely be acceptable.

It might seem that mobile native applications have the same architectural constraints as Web applications; at a sufficiently high level of abstraction, they do look much the same.

But there are also a few crucial differences.

Web browsers build in a great deal of security sophistication, particularly in regard to certificate and DNS (domain name system) management. Native applications rarely attempt, let alone achieve, the same level of authentication refinement. This is true in a couple of complementary aspects: first, only large-scale projects like browsers currently undertake such demanding technologies as HTTP Strict Transport (HSTS).

Also, Web development culture is simply more advanced in regard to coding: many Web developers at least are familiar with the idea of generation of a new token for each use of a form, as protection against Cross-Site Request Forgery (CSRF). While CSRF is a considerably smaller threat for native applications, native application programmers too often aren't even aware of their CSRF vulnerabilities.

Source cracking is similar. Web developers generally understand that client-side code is effectively public. Most know that API keys and other constants in JavaScript are straightforward to access. Too many native application programmers succumb to the temptation of compiling credentials into their applications. While it's harder to get at the source of a native application than the corresponding client-side Web application, the difficulty is not enough that native application programmers should feel safe.

What alternative do developers have?

One way or another, secure API-based applications essentially need communication with at least two servers. Any API key must be on an application server, either in direct communication with the API server, or at least delivering API tokens for a protocol such as OAuth.

Mobile APIs also face a reliability challenge. While traditional client-server and SOA (service-oriented architecture) applications often can assume connectivity between client and server, that's unrealistic for many mobile applications. At the very least, many of the communications of a mobile application must build in retries and more care in error-handling.

Part of the solution for these difficulties is to use standard frameworks or libraries that take responsibility for secure, reliable, and adequately-performing communications and session management. At the same time, too many frameworks encourage simple-minded fine-grained exposure of underlying database tables. It's a greater consumer benefit and almost certainly more secure to define instead a higher-level API expressed in business logic, rather than data tables or low-level object attributes. Smart developers, therefore, use a framework, but carefully craft the API to provide just what client applications need, without the excess of functionality that invites attack from crackers.

2. Community success
The second big theme for API security in 2016 is thoughtful support of the developer community. Most API publishers document their offerings to the point of a reference manual of signatures, and probably a "Hello, world!"-level sample program. One of the best investments publishers can make is in richer support of their API consumers: a collection of example programs illustrating different security practices, prompt technical support, community infrastructure for public answers to questions, and continuing education through webinars or podcasts or other means. The publisher should target, not just sale of licenses, but successful deployments of working, secure applications by its licensees. Among other pay-offs, this is a great way to prevent security incidents that tarnish the API's brand.

The previous section, on Mobility, already mentioned cultural differences between Web and native development. Cultivation of a healthy culture around that specific API is simply a winning bet. The alternative is to assume application developers teach themselves how to make the most of the API. An API worth careful, secure engineering also deserves corresponding care with its consumers.

3. Measurement
An API publisher provides and documents an entry point such as Customer. A trustworthy API publishers knows more about Customer: how often customers request it, the variations in that rate, the distribution of latencies in delivering results to customers, the defaults customers use, and so on. An essential element of security is to log, measure, and review daily operations. Among other benefits, this enables detection of anomalies as well as prioritization of security enhancements.

Measurement is necessary for rational management on all fronts. Questions about scaling, pricing, hiring, and so on all deserve answers based on measurement of actual API usage.

4. Testing
Testing is a crucial theme
of API security every year, not just in 2016. One aspect of functional testing especially timely now is beyond-ASCII data. Too many testing suites rely on data with the complexity of "Hello, World". When customers send through other-than-English Unicode data, errors too often turn up. When crackers experiment with carefully-crafted Unicode spoofs, vulnerabilities open up. In 2016, it's time not just to test that an API works, but that it works safely.

5. API Management
Service providers - Content Developer Networks (CDNs), API gateways, API proxies, and more - offer a range of values for API publishers. Most API publishers should focus on the functionality of their APIs, while buying security, scaling, and manageability expertise outside. 2016 is a good time to explore the increasingly sophisticated marketplace for API management.

6. Microservices
Microservices
are certainly fashionable now. The implications of microservice implementations for API security are complex and beyond the scope of this survey. The starting point for such an analysis is that an API publisher clearly understand its own business and technical goals with its API: is it trying to re-use assets and reduce the costs of internal projects? Profit from the interest of external application authors? Will the API grow in traffic to a constant collection of entry points, or is the intent to extend the API "horizontally" to richer services? Is the API a fine-grained exposure of data tables, or a higher-order access to business logic? All these questions bear on the role of microservices in an API architecture.

Summary
API growth has only begun; it's still more future than past. With a little care, prospective API publishers can arrange the basic security that keeps the bad guys away, and allows focus on the functionality and customer service that deserve attention.

More Stories By SmartBear Blog

As the leader in software quality tools for the connected world, SmartBear supports more than two million software professionals and over 25,000 organizations in 90 countries that use its products to build and deliver the world’s greatest applications. With today’s applications deploying on mobile, Web, desktop, Internet of Things (IoT) or even embedded computing platforms, the connected nature of these applications through public and private APIs presents a unique set of challenges for developers, testers and operations teams. SmartBear's software quality tools assist with code review, functional and load testing, API readiness as well as performance monitoring of these modern applications.

@CloudExpo Stories
SYS-CON Events announced today that N3N will exhibit at SYS-CON's @ThingsExpo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. N3N’s solutions increase the effectiveness of operations and control centers, increase the value of IoT investments, and facilitate real-time operational decision making. N3N enables operations teams with a four dimensional digital “big board” that consolidates real-time live video feeds alongside IoT sensor data a...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
Mobile device usage has increased exponentially during the past several years, as consumers rely on handhelds for everything from news and weather to banking and purchases. What can we expect in the next few years? The way in which we interact with our devices will fundamentally change, as businesses leverage Artificial Intelligence. We already see this taking shape as businesses leverage AI for cost savings and customer responsiveness. This trend will continue, as AI is used for more sophistica...
SYS-CON Events announced today that SourceForge has been named “Media Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. SourceForge is the largest, most trusted destination for Open Source Software development, collaboration, discovery and download on the web serving over 32 million viewers, 150 million downloads and over 460,000 active development projects each and every month.
Today most companies are adopting or evaluating container technology - Docker in particular - to speed up application deployment, drive down cost, ease management and make application delivery more flexible overall. As with most new architectures, this dream takes significant work to become a reality. Even when you do get your application componentized enough and packaged properly, there are still challenges for DevOps teams to making the shift to continuous delivery and achieving that reducti...
Today traditional IT approaches leverage well-architected compute/networking domains to control what applications can access what data, and how. DevOps includes rapid application development/deployment leveraging concepts like containerization, third-party sourced applications and databases. Such applications need access to production data for its test and iteration cycles. Data Security? That sounds like a roadblock to DevOps vs. protecting the crown jewels to those in IT.
SYS-CON Events announced today that Interface Corporation will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Interface Corporation is a company developing, manufacturing and marketing high quality and wide variety of industrial computers and interface modules such as PCIs and PCI express. For more information, visit http://www.i...
SYS-CON Events announced today that mruby Forum will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. mruby is the lightweight implementation of the Ruby language. We introduce mruby and the mruby IoT framework that enhances development productivity. For more information, visit http://forum.mruby.org/.
What is the best strategy for selecting the right offshore company for your business? In his session at 21st Cloud Expo, Alan Winters, U.S. Head of Business Development at MobiDev, will discuss the things to look for - positive and negative - in evaluating your options. He will also discuss how to maximize productivity with your offshore developers. Before you start your search, clearly understand your business needs and how that impacts software choices.
In his session at @ThingsExpo, Greg Gorman is the Director, IoT Developer Ecosystem, Watson IoT, will provide a short tutorial on Node-RED, a Node.js-based programming tool for wiring together hardware devices, APIs and online services in new and interesting ways. It provides a browser-based editor that makes it easy to wire together flows using a wide range of nodes in the palette that can be deployed to its runtime in a single-click. There is a large library of contributed nodes that help so...
IBM helps FinTechs and financial services companies build and monetize cognitive-enabled financial services apps quickly and at scale. Hosted on IBM Bluemix, IBM’s platform builds in customer insights, regulatory compliance analytics and security to help reduce development time and testing. In his session at 21st Cloud Expo, Lennart Frantzell, a Developer Advocate with IBM, will discuss how these tools simplify the time-consuming tasks of selection, mapping and data integration, allowing devel...
SYS-CON Events announced today that Cedexis will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Cedexis is the leader in data-driven enterprise global traffic management. Whether optimizing traffic through datacenters, clouds, CDNs, or any combination, Cedexis solutions drive quality and cost-effectiveness.
SYS-CON Events announced today that Mobile Create USA will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Mobile Create USA Inc. is an MVNO-based business model that uses portable communication devices and cellular-based infrastructure in the development, sales, operation and mobile communications systems incorporating GPS capabi...
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, will discuss how data centers of the future will be managed, how th...
Why Federal cloud? What is in Federal Clouds and integrations? This session will identify the process and the FedRAMP initiative. But is it sufficient? What is the remedy for keeping abreast of cutting-edge technology? In his session at 21st Cloud Expo, Rasananda Behera will examine the proposed solutions: Private or public or hybrid cloud Responsible governing bodies How can we accomplish?
SYS-CON Events announced today that MIRAI Inc. will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MIRAI Inc. are IT consultants from the public sector whose mission is to solve social issues by technology and innovation and to create a meaningful future for people.
SYS-CON Events announced today that Keisoku Research Consultant Co. will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Keisoku Research Consultant, Co. offers research and consulting in a wide range of civil engineering-related fields from information construction to preservation of cultural properties. For more information, vi...
SYS-CON Events announced today that Massive Networks, that helps your business operate seamlessly with fast, reliable, and secure internet and network solutions, has been named "Exhibitor" of SYS-CON's 21st International Cloud Expo ®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. As a premier telecommunications provider, Massive Networks is headquartered out of Louisville, Colorado. With years of experience under their belt, their team of...
Most of the time there is a lot of work involved to move to the cloud, and most of that isn't really related to AWS or Azure or Google Cloud. Before we talk about public cloud vendors and DevOps tools, there are usually several technical and non-technical challenges that are connected to it and that every company needs to solve to move to the cloud. In his session at 21st Cloud Expo, Stefano Bellasio, CEO and founder of Cloud Academy Inc., will discuss what the tools, disciplines, and cultural...
SYS-CON Events announced today that Enroute Lab will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Enroute Lab is an industrial design, research and development company of unmanned robotic vehicle system. For more information, please visit http://elab.co.jp/.