How to get API discovery right
Application Programming Interfaces (APIs) are everywhere. Companies have increasingly turned to API development to quickly and efficiently create consistent, feature-rich applications. APIs have become the connective tissue of data exchange, but this raises important security questions.
One of the most significant of these questions is: What is the extent of my organization’s API usage? This isn’t as straightforward a query as it may first seem. Businesses are using hundreds and thousands of APIs — new APIs built to meet standards frameworks, third-party APIs, shadow APIs without adequate visibility and documentation, older deprecated APIs and more.
Businesses can’t effectively protect what they don’t know they have. Therefore, API discovery has an essential role to play in keeping sensitive data safe.
The state and importance of API discovery
Unfortunately, from a security perspective, it’s all too normal for organizations to not have visibility into their overall API usage. In fact, 37% of respondents to a Cequence Security and ESG survey confirm that keeping an accurate inventory of API usage is an issue affecting their use of API-based development.
Unknown and shadow APIs have become so prevalent that within minutes of using API discovery tools, customers performing API inventories often find 100 times more shadow APIs than they knew existed within their networks.
The same research found that 41% of security teams are worried about an evolving threat landscape. The attack types seen on the OWASP API Security Top 10 are being joined by issues such as content scraping, or attackers taking advantage of configuration errors to gain illicit access.
The combination of factors facing businesses today — widespread API use, low visibility, and a complex threat landscape — has led to a new era of data protection needs. Seizing the development advantages that have made API usage so popular depends on also getting the security question right.
While API discovery is absolutely essential from an overall security perspective, companies are hindered by taking a limited approach to discovering their APIs. There are two perspectives when it comes to API discovery: Inside-out and outside-in.
Inside-out means continually identifying and tracking the API inventory from within, assessing their risks and basing protection on these findings. Outside-in involves analyzing your public domain to determine a company’s API attack surface — effectively showing them what an attacker would see. These methodologies each have their limitations when companies exclusively use one or the other. This is why it’s best to combine them and get a truly comprehensive look at how data is moving through APIs.
Taking a modern API discovery approach
What does it look like when an organization gets serious about both inside-out and outside-in API discovery? The process can involve two separate tools, each responsible for a distinct part of detecting and defending an organization’s complete API footprint.
In practice, the roles of these two types of systems break down along these lines:
API discovery from the outside in
When it comes to API use, a company’s security team can’t learn everything from an internal view. Taking an exterior view of public facing APIs allows security personnel to detect issues that may otherwise go unnoticed, such as internal APIs inadvertently becoming public or issues with deprecated APIs.
An outside-in view provides a valuable perspective, revealing security and compliance issues that even standard vulnerability and penetration testing may miss. By finding every publicly visible endpoint, such a solution gives IT security teams the same view that a potential attacker would have, revealing the company’s true external attack surface.
The next step after finding a potential issue is to alert personnel so they can take action. By studying a ranked dashboard of threats, team members can prioritize the most pressing vulnerabilities facing the team.
API discovery from the inside out
Completing the story of a company’s API use requires an internal as well as external view. This allows businesses to discover, catalog and track all their APIs, whatever their origin.
By looking at an easy-to-read dashboard, team members can see both internal and public API usage. This includes managed APIs, unmanaged APIs and any third-party APIs in use. Metrics displayed on the dashboard include usage stats for the various APIs found, such as geographic traffic information.
The discovered APIs can then be sorted by risk profile, segueing smoothly from discovery into protection and risk remediation. Once security teams know the extent of their companies’ API profiles, they can get started protecting them more effectively.
API discovery’s role in Unified API Protection
Discovery is one of the essential aspects of a modern, comprehensive approach to API protection. Such a unified method is different from the common “API security” offerings that may help organizations detect some threats targeting their APIs but don’t equip them to guard against those attacks.
API discovery is step one in the Unified API Protection lifecycle. Advanced API discovery is at its best when combined with real-time detection of threats and real-time responses to the most pressing risk factors. Organizations that know the full extent of their attack surfaces, see all ongoing traffic and have defenses ready are ideally prepared to deal with today’s API-driven development environment.
