May 2022 Summaries

Martin Buhr, founder of Tyk, shares the journey of building the company with a focus on sustainability and responsible growth, motivated by a past experience where a charismatic leader abruptly shuttered his company, leaving employees jobless. Determined to avoid repeating such mistakes, Tyk was established with a balanced approach to hiring developers and salespeople to ensure neither product development nor sales demand suffered. Despite facing financial challenges early on, including a significant cash flow crisis, Tyk avoided layoffs through strategic financial maneuvers like securing an equity-backed loan and negotiating with customers for early payments. This experience reinforced the company's commitment to fostering a supportive and trusting work environment, rejecting the notion of routinely firing employees to boost performance. Instead, Tyk invests in employee development and a strong company culture, demonstrated by initiatives like a bespoke coaching program and a clear work-life balance. Buhr takes pride in building a company that genuinely cares about its employees, aiming to leave things better than found and encouraging a culture that reflects this ethos.

Improper asset management in API security, as outlined by OWASP, is a critical vulnerability resulting from a lack of comprehensive oversight of deployed API assets, leading to stagnation and potential exploits. Examples include APIs created by former team members with inadequate documentation and products integrated without clear ownership, which can result in outdated, unsecured systems vulnerable to attacks. To mitigate these risks, organizations should implement robust asset management systems like a CMDB, assign clear ownership for all services, and track API usage to update or retire obsolete services. API Management systems (APIMs) play an essential role in enforcing asset deprecation and access controls, while tools like Tyk can aid in managing API versions, ensuring documentation is current, and integrating analytics to identify and address stagnant APIs. Proper asset management is vital for maintaining secure, up-to-date systems and should be integrated into the delivery workflow, with documentation updates considered as part of the definition of done.

Insufficient logging and monitoring, while not a direct vulnerability, leaves organizations blind to current and past attacks, making them susceptible to future breaches. Effective logging and monitoring require both application and transaction logs to be secured in separate storage and analytics systems. This ensures that, even if a system is compromised, forensic data remains trustworthy. The Tyk API Gateway enhances data collection by integrating with third-party tools and providing features such as increased log verbosity and real-time event handling. By differentiating but not separating application and transaction logs, organizations can better detect and analyze attacks. It is crucial to maintain synchronized timestamps across systems to aid in correlating attacks and ensure timely alerts for any discrepancies.

The blog post introduces a series focused on addressing the top 10 API security threats identified by the Open Web Application Security Project (OWASP) within the context of API management. It emphasizes that API security requires a comprehensive, full-stack approach, as threats are diverse and demand various solutions to mitigate them. The article highlights the importance of continuous security processes as APIs evolve and outlines how API management can be strategically utilized to mitigate specific threats. It underscores that there are no universal solutions for all attack vectors and stresses the necessity for both automated and manual testing strategies in the development lifecycle to ensure robust security measures. The post also touches upon OWASP's risk rating methodology, which evaluates risks based on criteria such as exploitability and technical impact, and advises organizations to conduct their own risk assessments tailored to their specific circumstances.

Security misconfiguration is a prevalent vulnerability that occurs when services exposed over the internet are improperly configured, leaving them susceptible to attacks. Common issues include the exposure of sensitive information through default configurations, such as HTTP servers displaying version numbers or returning stack traces with valuable data. To protect against these vulnerabilities, service owners should ensure that all services and dependencies are updated with the latest security fixes and carefully manage the data returned in all scenarios. API Management (APIM) solutions like Tyk offer tools to mitigate these risks by manipulating response headers and bodies, enforcing secure connections, and implementing access controls. Tyk provides features such as mutual TLS, CORS functionality, policy-based permissions, and schema validation for GraphQL APIs, which help in minimizing security misconfiguration risks. Additionally, Tyk recommends regular penetration testing and offers resources to guide users through OWASP best practices, emphasizing the importance of maintaining robust security measures for APIs.

Broken Object Level Authorization (BOLA) is considered the most significant security threat to APIs, as outlined by OWASP, due to the common practice of using object identifiers in API endpoints without proper authorization checks. This vulnerability allows malicious actors to alter object IDs within requests to gain unauthorized access to data. Effective countermeasures include implementing object-level authorization checks and using globally unique identifiers (GUIDs) instead of integers to make it harder for attackers to guess object IDs. However, GUIDs alone do not solve the authorization issue and should be considered a complementary practice. API Management (APIM) faces challenges in addressing BOLA, as API Gateways typically lack the necessary data for making authorization decisions, often stored in backend databases. To mitigate BOLA, solutions include direct integration with backend systems, leveraging identity providers like Keycloak, and utilizing policy engines such as Open Policy Agent (OPA). These approaches require significant configuration and integration efforts, and it is generally best practice to conduct object-level authorization within the backend application itself. GraphQL APIs introduce additional challenges by allowing clients to specify fields in API responses, potentially exposing sensitive data without proper authorization, referred to as Broken Field Level Authorization. Tyk can implement object-level authorization using direct integration and identity providers while offering field-based permissions to mitigate GraphQL vulnerabilities.

Excessive data exposure in APIs occurs when sensitive information such as email addresses or personally identifiable information is unintentionally included in responses, potentially allowing attackers to exploit this data. API developers often rely on clients to filter out such sensitive information, a practice that can lead to data being inadvertently exposed during transmission or accessed by unauthorized users. To mitigate this risk, APIs should be designed to either exclude sensitive data from responses or present it in a redacted form, ensuring that the responsibility for data protection does not fall solely on the client. API gateways can assist by transforming and validating data to prevent exposure, with tools like Tyk offering features to redact sensitive data within JSON or XML responses and enforce schema validation in GraphQL environments. These strategies emphasize securing data at its origin and provide mechanisms to control data access at a granular level, contributing to a more robust defense against excessive data exposure vulnerabilities.

User authentication is a critical aspect of API security, as highlighted by OWASP, which identifies broken user authentication as a major vulnerability that can expose sensitive data and harm both API providers and users. To mitigate these risks, API providers are encouraged to prioritize secure authentication practices, including the implementation of industry standards like OpenID Connect and Mutual TLS, secure data storage and transmission, and adherence to strong password policies. API Gateways play a crucial role in managing authentication by routing traffic through a centralized point and supporting various authentication methods, which can be enhanced by integrating with identity providers (IdPs) such as Okta and Auth0 for advanced processes. Tyk, a provider of API management solutions, offers multiple authentication options, advocating for secure methods like mutual TLS and supporting the use of external IdPs for identity management, thereby facilitating Single Sign-On and reducing credential exposure. Additionally, mechanisms like rate limiting, multi-factor authentication, and threat detection are recommended to protect against exploitation, such as credential stuffing attacks.

Injection vulnerabilities arise when user input is not properly validated and is used directly in systems like databases, program logic, or shell commands, leading to potential security breaches such as SQL injection, command execution, or privilege escalation. These flaws are prevalent in SQL, LDAP, NoSQL queries, OS commands, XML parsers, and ORM, and can result in information disclosure, data loss, denial of service, or even a complete system takeover. To mitigate these risks, it's crucial to sanitize and validate input at all levels using tools like stored procedures, JSON schema validation, body transformation, and custom plugins. This challenge is compounded by the variety of implementations across languages, libraries, and business logic, making a one-size-fits-all solution difficult. As a general rule, user input should never be trusted and should be validated thoroughly before use to prevent such vulnerabilities, with resources like the OWASP guide offering essential practices for securing APIs.

APIs can suffer from performance, availability, and security issues when they face excessive requests due to lack of resources and inadequate rate limiting, as highlighted by OWASP. Without proper restrictions, APIs risk being overwhelmed by both legitimate and malicious requests, such as Denial of Service (DoS) attacks, which can render them unresponsive. To mitigate these issues, various strategies like execution timeout, payload size limitation, rate limiting, throttling, quotas, response caching, circuit breakers, IP restrictions, and complexity limiting can be employed, particularly through API Gateways. However, these measures might not suffice against Distributed Denial of Service (DDoS) attacks, which require specialized infrastructure and services like those offered by Cloudflare for effective handling. Tyk's API Gateway incorporates many of these protective functionalities, but it is recommended to leverage third-party services for robust defense against DoS attacks.

Broken Function Level Authorization (BFLA) is a security vulnerability that arises when client requests are improperly authorized, allowing unauthorized access to higher-level functionalities such as administrative functions. To prevent BFLA, it is crucial to validate client permissions against requested resources and reject requests from clients with insufficient permissions. Exploitation typically involves legitimate API calls being sent to endpoints that should be inaccessible, and APIs are particularly susceptible due to their structured nature. Proper authorization checks, often managed via configuration or code, are necessary, but they can be complex due to varying user roles and hierarchies. Application Programming Interface Management (APIM) systems address BFLA by offering methods like access control lists to manage HTTP method and path access. API gateways can enforce these controls by rejecting unauthorized requests and providing feedback through status codes. The process requires ongoing attention to security policies, which must evolve alongside API development. Tools like Tyk offer solutions through policies and plugins that manage access to API endpoints, allowing firms to tailor their security strategies without disrupting existing workflows.

The mass assignment vulnerability in APIs occurs when an attacker manipulates payload data to modify or elevate privileges due to inadequate input validation, allowing unauthorized data alterations. This security flaw is prevalent because APIs inherently expose application implementations, making it easier for attackers to exploit weaknesses by binding input directly to internal objects without proper validation against authorization levels. To mitigate this risk, it is crucial to validate API payloads against a defined schema, ensuring only expected fields are processed and employing authorization checks to verify client privileges. APIM solutions like Tyk provide tools such as JSON schema validation, custom plugins, and the separation of admin and client-facing APIs to enhance security and manage different policies effectively. These measures, combined with continuous monitoring and adherence to OWASP guidelines, help safeguard against mass assignment exploitation and maintain robust API security.

APIs can face significant challenges related to resource constraints and rate limiting, particularly when overwhelmed by excessive requests, which can originate from both legitimate users and malicious actors such as those conducting Denial of Service (DoS) attacks. OWASP highlights this as a critical security issue, as a lack of proper rate limiting can render APIs unresponsive or unavailable. To mitigate these risks, API Gateways can employ various strategies, including execution timeouts, payload size restrictions, rate limiting, throttling, quotas, response caching, circuit breakers, IP restrictions, and complexity limiting, particularly for GraphQL APIs. However, these measures may be insufficient against Distributed Denial of Service (DDoS) attacks, for which specialized infrastructure and services like Cloudflare's DDoS mitigation are recommended. Tyk, as an API management product, supports several of these protective measures and emphasizes the importance of using third-party services for handling more severe threats such as DDoS attacks.