Question 1

BN: Can zero trust architecture protect APIs?

Accepted Answer

YB: Unfortunately, many API risks can't be mitigated by zero trust. The goal of zero trust is to restrict access, whereas APIs need access to function. Most APIs are public or open, designed to be consumed by the internet as a whole and a large customer base, presenting unique challenges to zero trust. What's more, API attacks typically occur in trusted channels and authenticated sessions. Attackers know if they can obtain an authorized user's keys or credentials, they can access valuable data. By piggybacking or hijacking authenticated sessions with stolen active session cookies, authentication tokens, two-factor authentication challenges, API keys and other authentication material, hackers aren't hindered by zero trust architecture. Keep in mind that, according to the State of API Security report, a staggering 94 percent of exploits occur against authenticated APIs. When it comes to zero trust, organizations must go beyond the principles of authentication and authorization. They require API runtime protection to continually validate an authorized user's access and behaviors against API resources, spot the anomalies, and pinpoint the bad actors.

Question 2

BN: Can cloud security offerings protect APIs?

Accepted Answer

YB: While some cloud security providers do provide tools such as API management or API gateways, point products such as these aren’t sufficient for protecting enterprises against API attacks. These tools have limited API security capabilities at both the application and API layer, leaving APIs underprotected. API attacks are effectively zero-day exploits, meaning that security tools designed to look for known 'bad' behaviors -- signatures or blacklisted IPs, for example -- will never be able to properly protect APIs. It's also worth noting here that as APIs are application logic, cloud customers hold the ultimate responsibility for protecting them within the shared responsibility model for security.

Question 3

BN: Why can't IAM, WAFs or API gateways protect APIs?

Accepted Answer

YB: While IAM, WAFs and API gateways are all necessary and important tools in every organization's security stack, they fall short of protecting APIs -- largely because they don't provide the necessary visibility or security controls. Attackers consistently bypass access controls, as well as harvesting keys and tokens. Contemporary hackers are experts at circumventing access controls, piggybacking on an authenticated user session or harvesting authentication material from traffic, device storage, or application code These attack techniques cannot be detected by IAM, API, or WAF solutions. These tools also fail to detect API specific problems -- business logic abuse and authorization exploits, for example -- because they rely on signatures and rules for attack detection. To make matters worse, the API management components inherent with them may also be exploitable. What's more, IAM, WAFs and API gateways all rely on proxying. As proxy models slow API communication, organizations typically fail to mediate every API in use with a gateway or WAF -- especially for inner or internal APIs. This results in a lack of visibility into how those APIs are being used.

Question 4

BN: Can APIs be secured with workload protection?

Accepted Answer

YB: Workload security protections provide a lot of benefits. Among other things, they aid in providing infrastructure security to ensure you aren't running workloads on vulnerable software versions, and are also useful for blocking access to a workload to external users. However, they fall short of providing API or application-level context, thus failing to secure APIs themselves.

Question 5

BN: How effective is shift-left for securing APIs?

Accepted Answer

YB: While implementing security in the development stage is a worthwhile practice, shift-left support doesn’t mean that every API will be secured pre-production. Developer testing tools simply cannot identify all vulnerabilities. Many common API security issues can't be identified as part of automated design, development, and build scans with common security analysis and testing tools -- business logic flaws cannot be spotted unless the APIs are exercised. Photo Credit: Panchenko Vladimir/Shutterstock

Peloton

The challenge of securing APIs [Q&A]

Recent Headlines

Microsoft will let you remove AI Action from the Windows 11 context menu

Microsoft is bringing some massive visual changes to PowerToys v0.97

Tuxedo unveils Gemini 17 Gen4 Linux laptop for high performance workloads

Threats improve to slip past firewalls and filters

Paranoia rules -- how automation can enable better detection and response [Q&A]

Google reveals Year in Search 2025

Apple announces more changes at the top

Most Commented Stories

Spotify Wrapped 2025 is here, and this time it’s interactive and competitive

Crucial brand to disappear as Micron shifts focus to AI data center memory

Open-source BitTorrent app FrostWire 7 launches with rebuilt engine and zero ads

Google shares its favorite Chrome extensions of 2025 as AI takes over the browser

Microsoft is preparing to give the Windows 11 Run dialog a much-needed makeover

Opera brings upgraded Google AI to its browsers

Tuxedo unveils Gemini 17 Gen4 Linux laptop for high performance workloads

Apple appoints new vice president of AI as John Giannandrea steps down

NEWS