Security is becoming more fragile as APIs rapidly increase.

An Interview with Menachem Perlman Director, Global Solutions Engineering at Akamai Tech

Who is responsible for API security?

API security is becoming more and more important every day. Could you tell us about the recent developments and why API security has become such a hot topic?

There is no doubt that APIs have existed for quite some time. However, digital transformation has progressed, the pandemic, working from home or anywhere, mobile device adoption, and companies becoming open and digital created more APIs. The diversification and growth of APIs are creating new challenges.

APIs connect services within an organization, end users, and businesses with each other. For example, restaurant and hotel chains connect with reservation sites and other websites through third-party B2B APIs. Companies need to think about where APIs are, how they function, and how to protect them.

"Who is responsible for the API?" In the past, the development group was often responsible for everything from building an API to deploying it, but now the security team may be in charge of the security part of the API.

There are three major challenges when companies realize who is responsible for this API

1) To Discovery.

It's about identifying your API, knowing where it is and what it does. everywhere, internal, external, 3rd party and end users. 

2) To Diagnose and protect.

The second thing to do is to check carefully within your organization. From existing systems and permissions to newly developed APIs, it is necessary to carefully examine settings for mistakes and security concerns. The industry is also aware of the challenges, and in 2019, the OWASP (The Open Worldwide Application Security Project) Foundation announced the "OWASP API Security Top 10." This is a list ranking the risks of the APIs most used in attacks, and the latest version released in 2023. The OWASP API is a good start for every organization where you can check what types of attacks there are and if your company is protected against them. 

3) To Decipher.

To understand the behaviour of APIs and applications. There are advanced types of attacks based on behaviour. Every application has its own business logic for each company and service that dictates what it can access and what it can do. To protect against advanced behavioural-based attacks, you need to understand not only vulnerabilities and exploit code, but also all of your application's code, behaviour and logic, and identify any unusual behaviour over a long period of time. This is because attackers can exploit this business logic and use it in sophisticated attacks.

Tell us about a recent use case your team encountered 

Recently, there have been cases where loyalty points were targeted through APIs. Many companies have fairly strong protections where payments and cash are directly involved, but other areas may not be sufficiently protected.

Some people don't have that many points, but in that case, a couple of whale wallets with a large number of points were attacked, so it can be a significant amount in monetary terms. The attack accessed a couple of wallets from a single source which was abnormal behavior for this application and source. By introducing our product to the affected companies, we stopped the theft of over $100,000 in points within 24 hours.

More and more companies are looking to strengthen API security

Where should companies start when considering API security?

APIs have a lifecycle process: design, plan, develop, execute, implement, and deploy. Companies must test early. During design development, you must continue to monitor after implementation to ensure that it is functioning as intended and identify gaps or undocumented APIs. Especially when deploying to a production environment, it is necessary to check thoroughly and continuously.

As many companies become globalized, APIs are used in a wide range of countries, so the challenges are common. Therefore, regardless of region or country, everyone is facing similar challenges, so I believe that the types of attacks that will emerge in the future and the concerns they have are the same all over the world.

Please tell us about Akamai's strategy, strengths, and plans in the area of API security.

Akamai has been in the IT industry for many years with many solutions and offerings and has long decided to focus on cybersecurity. In other words, we have a wide range of cybersecurity solutions, not just CDN solutions, and we are confident that when companies consider API security, we will provide the right and appropriate solutions and services for their needs. 

If you use Akamai products such as WAF, you can enable and use API Security in a few clicks. If you don't use Akamai's products, you can integrate API Security with other companies' products and cloud environments and get full visibility to your entire API landscape. Our customers deploy the solution everywhere from QA to Production environments so that they can protect any API.