our internet experiences are driven by APIs. They create new possibilities for web applications, mobile apps, and device interactions. They tend to be open and self documenting, encouraging innovation. But these same characteristics create new vulnerabilities to attacks. If you haven’t focused on API security, your API is not secure, and you could be vulnerable to data theft, corruption, or DDoS attacks. I’ll walk through some common attack vectors so you can keep innovating without compromising on security. 5
recently had a breach exposing the information of about 500 million customers in its reservation system. Companies protect their websites carefully, but APIs are frequently left unsecured, even though API penetration is easier than website attacks. 6
have clients on multiple platforms because the API enables easy development of applications using the API. This enables innovation and exploration, and is great for customers, who can interact with a system however they want. It also enables integration between systems, which was historically a challenge. APIs are fantastic… well documented and available to the developers working with your platform, but there is a downside. 9
APIs by nature are documented and easy to access, making them tempting targets by bad actors. Additionally, you can’t secure your APIs with captcha or other security, leaving them exposed to those who want to steal your data or overwhelm your server with requests. Frequently, authentication is substandard, making it easy for attackers to get at your system. 10
APIs are targeted more often. APIs suffer 4x more credential stuffing attacks than websites, partly because it is easier to invade a system without javascript protections. 13
frequency, and sophistication of denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks will continue to grow. Organizations today interact with customers, employees, and partners through a myriad of applications, making them attractive targets for attackers. 16
analyze and mitigate developing attacks • Kona DDoS Defender is a fully managed security service, deploying adaptive rate controls to perform real-time analysis and adapt to changing attack vectors • It also provides organizations with dynamic protection against a broad range of DDoS and DoS attack types, even as they change over the course of an attack. UDP and SYN floods are deflected and application-layer attacks are absorbed at the network edge • Adaptive Rate Controls automatically protect applications against application- layer Dos and DDoS attacks by monitoring and controlling the rate of requests. Behavior-based rules respond to bursts of requests in seconds • The Security monitor provides real-time visibility into security events. 17
‘secret’, they are not secured beyond the security on the API. Attackers try differet parameters to see if they can interact with these administrative API endpoints and steal data or cause issues with your platform. 18
to protect APIs from malicious calls. Customers can define which types of requests and calls are allowed. Kona Site Defender will inspect the parameters of RESTful APIs against a whitelist of expected values, and inspect JSON body and path parameters for risky content. Rate controls are used to mitigate DDoS attacks launched via APIs. Kona Site Defender provides analytics and reporting at an API level.
data-driven applications, in which malicious SQLstatements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).[1] SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typedand unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. 20
existing, out-of-the-box rules. •If you can’t patch an application immediately, you can use virtual patching. This allows you to create custom rules to quickly address emerging injection vulnerabilities or new vulnerabilities exposed from application changes. Virtual patching can also be automated and integrated into DevSecOps processes by leveraging Akamai’s API capabilities. •Akamai assigns a Client Reputation that helps identify and block injection- based attacks from highly-active bad actors. In other words, if there’s someone out there doing this a lot, we know about it, and we put them in a basket with the other bad apples. •Injection-based attacks can also be further analyzed by the WAF with a Penalty Box Alert Mode.
in order to fraudulently gain access to user accounts. This is a subset of the brute force attack category: large numbers of spilled credentials are automatically entered into websites until they are potentially matched to an existing account, which the attacker can then hijack for their own purposes. Credential stuffing is a new form of attack to accomplish account takeover through automated web injection. Credential stuffing is related to the breaching of databases; both accomplish account takeover. Credential stuffing is an emerging threat. Credential stuffing is dangerous to both consumers and enterprises because of the ripple effects of these breaches. For more information on this please reference the Examples section showing the connected 22
consumers and add governance to your APIs, and moves authentication to the edge, protecting your origin Kona Site Defender protects your API endpoints from malicious traffic. Additionally, Akamai Bot Manager can identify and shut down bots making intrusive attacks 23
focused on improving the security of software. OWASP is in a unique position to provide impartial, practical information about AppSec to individuals, corporations, universities, government agencies, and other organizations worldwide. Operating as a community of like-minded professionals, OWASP issues software tools and knowledge-based documentation on application security. The OWASP Top 10 is a regularly-updated report outlining security concerns for web application security, focusing on the 10 most critical risks. The report is put together by a team of security experts from all over the world. OWASP refers to the Top 10 as an ‘awareness document’ and they recommend that all companies incorporate the report into their processes in order to minimize and/or mitigate security risks. 24
definitely go and check out launchpad, our new learning management system. One of the missions in launchpad is “Protect your site from severe security threats”, which covers the OWASP top 10 security threats. 24
see API consumers on the left, API backend servers on the right. The first layer that intercepts requests are our security products: Kona and Botman These ensure that malicious users cannot exfiltrate data from your API, DDoS your endpoints When a requests passes our security checks, the Gateway gets it. The Gateway provides complimentary governance - it ensures that legitimate users of the API do not misbehave Both of these solutions sit atop our delivery products - which provide SSL offload, SureRoute, H2, and core caching capabilities 26
Whether through the Control Center portal or using the fully functional Command Line Interface, you can perform administrative tasks in an intuitive and seamless way.
facto means for securing APIs. Akamai has added OAuth provider capability to Akamai API Gateway, which enables API publishers to secure their APIs by federating with identity providers (IdPs). OAuth is an open protocol that exchanges credentials (username and password) for access tokens. Access tokens are long, random strings that carry data and can be passed around without compromising a user’s original credentials. It allows users to share private resources without having to share their credentials everywhere. Serving content from the edge has undisputable advantages. Authentication at the edge has similar advantages: it’s faster, more available, more secure, and offloads origin traffic. 31
your API. Akamai is agnostic to what identity provider you select. It can be an on-premise provider such as PingFederate or a social login such as Facebook or Github. Our sole requirement is the IdP support for OAuth 2.0. To enable the use of your APIs by users of social networks, simply register the IdPs of the social networks into the Akamai authorization server for use by your API. Akamai’s authorization server runs in Akamai data centers that are geographically distributed across the world, making our OAuth implementation highly available. Requests to the authorization server are proxied through Akamai’s edge servers, which are configured with Akamai’s own Kona Site Defender solution. This provides protection against DDoS attacks by implementing request quotas and rate limiting. Quota enforcement ensures fair access to the authorization server by authenticated client apps, while rate limiting protects the authorization server against bursts of activity from a single client. By performing token validation at the edge, API publishers reap the benefits of Akamai’s edge server network verifying Akamai-issued tokens near the client. Only valid requests make it to origin, protecting it from any traffic that cannot be authenticated by our edge servers. 31
know about who the user is, what they need, and what they’re authorized to do. JWTs are portable, decoupled, identities. If you’re building API services that need to support server-to- server or client-to-server (like a mobile app or single page app (SPA)) communication, using JWTs as your API tokens are a very smart idea. JWT clients will be making requests less frequently and authentication data can be persisted in a stateless way. JSON Web Token (JWT) is a JSON-based open standard for creating access tokens which assert a series of claims as a JSON object. JWT can also be signed using private/public key pairs in order to 32
know about who the user is, what they need, and what they’re authorized to do. JWTs are portable, decoupled, identities. If you’re building API services that need to support server-to- server or client-to-server (like a mobile app or single page app (SPA)) communication, using JWTs as your API tokens are a very smart idea. JWT clients will be making requests less frequently and authentication data can be persisted in a stateless way. JSON Web Token (JWT) is a JSON-based open standard for creating access tokens which assert a series of claims as a JSON object. JWT can also be signed using private/public key pairs in order to 33
a common problem in RESTful APIs: the under- or over- downloading of data Caching is notably absent in the GraphQL specification Edge server parses GraphQL queries for lexical tokens inside the query: whitespace, line termination, comments, commas, and Unicode byte order mark (BOM) Canonicalization of each query filters out unimportant differences between requests, enabling the edge to compute a unique cache key Errors in response body can be detected and handled 34
etc.) Set Key to parameter Move to privacy – show how that works Walk through Oauth setup, discuss scopes per endpoint, etc. Switch to key management, show that interface 35
(DDoS) protection solution, Kona Site Defender guards your online applications against the largest and most sophisticated attacks. Kona Site Defender delivers proprietary rule sets and detection logic honed from Akamai’s experience and investment in defending against the latest cyberattacks. Kona Site Defender provides complete control over protection for every business and application. Kona Site Defender is designed to deliver the lowest false positives and false negatives to ensure access to legitimate users while keeping out threats. Higher accuracy is driven by over 300 security research experts and the latest machine learning algorithms analyzing several petabytes of current threat data. Evolve defenses to stay ahead of threats Akamai interacts with 1.3 billion devices and harvests 130 TB of threat data every day, discovering new threats, following them as they evolve, 36
logic is so advanced that it often catches zero-day attacks. Protect your entire application Focus your staff-resources on securing the most valuable assets, and let automated protection cover the rest. Kona Site Defender is designed to protect your entire application footprint with a single solution, interface, and platform to ensure no part of your attack surface is left open. Secure applications anywhere Kona Site Defender protects applications regardless of location ― on premises, in the cloud, or across multiple cloud providers ― using a single security solution. With Kona Site Defender, you can protect applications wherever they reside, without having to manage multiple security solutions. Manage your WAF your way Kona Site Defender provides you with total flexibility ― integrating into change control, automating protections, providing powerful APIs for your development toolchain, and offering managed services that offload security management, monitoring, and mitigation to Akamai experts 24/7. Realize a unified view of security posture A user-friendly online portal based on a decade of real-world experience makes it easy to view and configure security settings. With the same configuration processes across all Akamai security solutions, it’s easy to change rules and monitor activity as you increase your security posture. 36
firewall that filters traffic to your website or API. At the simplest level, it lets you allow requests you want and block requests you don't want. It evaluates requests according to rules crafted and updated by Akamai's security team and the controls you set. If the request breaks a rule, your security configuration blocks it or performs another action you specify, like generating an alert notification or redirecting the request. The first level of protections you can apply checks a request's Internet Protocol (IP) information. These network-layer protections let you evaluate and act on the requesting machine's IP address or geographic location. for example, if you know that a specific IP is causing trouble, you could block requests that originate from that address. Or you could block requests from specific countries. The next level of protections checks traffic at the application layer, evaluating whether a request violates higher-level Hypertext Transfer 37
set of protections defends against attacks like SQL injection, cross-site scripting, DDoS, and other attempts to game web technologies in order to interfere with site performance or gain unauthorized access. To do so, your security configuration evaluates a request against a set of rules. For example, a rule could trigger on any request containing the HTTP Method PUT, which a hacker could use to attempt a file upload to your server. 37
that wraps Akamai's {OPEN} APIs to help simplify protection to the properties delivered by Akamai. This kit can be used as a no-fuss command line utility to interact with the library. You can manage your configurations, rules and policies. This package, like the API Gateway package, is part of the Akamai CLI, and can be easily installed for use on your own system. 38
organizations tend not to secure them as tightly as their websites. Threats come in many flavors – I’ve covered a few of them here, and you can find more information in the launchpad mission. API Management can help protect your origin, and handle authentication duties close to your users. How you implement authentication is highly important. Username/password or simple API keys are easy to breach. The combination of API Gateway and Kona Site Defender protects your origin by moving security to the edge. 39
hubbleinc
kazuma777777
mercari_inc
arid2
kintotechdev
makaibito
.jpg){kind=avatar}
ikuodanaka
uemura2024
kgmotors
hiyoriyamakankou
behealthy
nwiizo
sstephenson
lara
techseoconnect
mraible
reverentgeek
deanohume
productmarketing
aleyda
keavy
jonoalderson
