The content of this page has been automatically translated by AI. If you encounter any problems while reading, you can view the corresponding content in Chinese.
API (Application Programming Interface) can be applied to all computer platforms and operating systems, connecting data invocation in different formats. Users can track the location of goods purchased on e-commerce platforms, an effect achieved through real-time location invocation between e-commerce platforms and logistics companies using APIs.
Many organizations focus more on rapid API and application delivery, neglecting API security protection. This has been the main cause of API attacks and data leakage in recent years.
The invocation scenarios for APIs can be divided into the following three types:
API Types
API Description
Current Security Status
Public API
Supports access to the service from anywhere, exposed on the internet. Callers can complete related data and process scheduling by providing relevant fields through the associated interfaces. Public APIs have the highest level of monitoring and disposition in terms of security and usability.
Fewer network restrictions may be present, but there could be related authentication and authorization limits. However, business authentication logic vulnerabilities are more frequent, and attackers prefer to target such APIs through automated fuzz testing and targeted security testing.
Internal API
Typically deployed and operated within data centers or private cloud network environments, focused on operations management and internal service support. Generally used for rapid scheduling and usage within internal user interactions and usually not exposed to the public network
Network restrictions are significant, possibly involving related authentication operations. Generally, the verification is weak, and the security protection is low. If attackers discover and sniff these internal API interfaces, they will launch targeted attacks on such APIs. In multiple data leakage incidents, attacks on internal APIs were the main cause of the breaches.
Channel API
Usually deployed and operated in data center or private cloud network environments, providing limited access to internal APIs for specific external partners and suppliers. Typically used for targeted data extraction and management for specific partners. Sensitivity to data extraction is low, but sensitivity to data leakage is high.
Access control rights are positioned between internal and external APIs, with the security management level being the same. The mainstream method is to manage via API Gateway, but it lacks consideration of security aspects. Such APIs rarely undergo business management related to unauthorized access. If partners in the upstream or downstream supply chain are breached and the related APIs are used for data abuse, Channel APIs usually lack mechanisms for monitoring and supervising abuse. Therefore, several data leakage incidents have occurred due to the lack of abuse control on Channel APIs.
Why conduct API Sensitive Data Discovery
According to the <Salt Labs State of API Security Report, Q1 2022>, among the API security issues that respondents are most concerned about, Zombie APIs ranked first with 43%; far exceeding the second-ranked issue, Account Takeover/Abuse, which accounted for 22%. Additionally, 83% of respondents are not confident in the completeness of their Organizational API Asset Inventory.
Why are companies so concerned about their API assets? Security risks often lurk in the "unknown", such as unknown zombie APIs, unknown shadow APIs, and unknown sensitive data exposures. The root cause is the company's lack of complete knowledge about their API assets. Effective management and protection start with what is "known" and "visible". People struggle to control the security of assets that are forgotten and intangible. Yet, it is these forgotten, uncontrollable APIs that often run sensitive data. If these sensitive APIs cannot be identified in time, it could lead to API data breaches or accidental exposures. Attackers could exploit such APIs to specifically target and attack business-sensitive data, subsequently extracting sensitive information. What's worse, they could further escalate their access within the API ecosystem, gaining permissions to servers and databases, leading to compromised integrity.
Even if companies have begun to address the issue of zombie APIs, a significant risk is easily overlooked—the zombie parameters. Unlike completely forgotten zombie APIs, these zombie parameters may still exist in currently active and maintained API interfaces. Common zombie parameters, such as debugging parameters and system attribute parameters set during the development and testing phases, are not exposed to users after the interface goes live but can still be exploited by attackers in the shadows. Attackers can leverage these zombie parameters to exploit vulnerabilities like batch allocation to gain unauthorized responses. Once these unknown API vulnerabilities are maliciously exploited, the massive sensitive data behind core business operations and platform user data become internal API calls before hackers without any security controls, losing all secrecy.
Directions
Step 1: Discover API assets
1. Log in to WAF Console, and in the left sidebar, select API Traffic Analysis.
2. On the API Traffic Analysis page, at the top left, select the domain you want to protect, and click to turn on the analysis.
3. After turning on the switch, you can view the corresponding API details on the related API details page.
Step 2: API Security Enhancement
1. On the Basic Security > API Security page, enhance the validity of APIs based on the relevant API.
2. On the CC Protection page, implement capacity protection measures based on the relevant API.
3. On the Access Control page, click Add rule and implement sensitive operation protection measures based on the relevant API.
4. On the BOT and Business Security page, implement abnormal behavior protection measures based on the relevant API.
Step 3: API Lifecycle Management
1. API Online Monitoring.
2. API Parameter Addition Detection, API Parameter Addition Detection.
