Back to API Bites
In the realm of cybersecurity, the Zero Trust model has emerged as a potent strategy to counteract the ever-evolving landscape of threats. The model’s core principle is simple: “Never trust, always verify.” This concept is particularly relevant when applied to API security, where the stakes are high due to the sensitive nature of data being exchanged.
What is the Zero Trust Security Model?
For decades, enterprise security was built around the network perimeter as a clear boundary between what is safe and trusted and what is not. Firewalls and gateways patrolled that edge, operating on a simple assumption: if you were inside the perimeter, you were safe.
That assumption no longer holds. Cloud computing, remote work, and mobile access has dissolved the traditional network boundary. Data now flows across platforms, devices, and geographies that no single perimeter can contain. In this borderless environment, attackers exploit any weak link, whether it’s a compromised credential, an unmanaged endpoint, or a third-party integration.
The Zero Trust Security Model emerged as a direct response to this reality. It rejects the outdated notion of implicit trust based on location or network segment. Instead, Zero Trust enforces continuous verification and requires every user, device, and connection to prove its legitimacy before access is granted, regardless of where it originates.
Zero Trust Architecture and API Security
APIs are the backbone of modern application architecture. They allow different software applications to communicate and share data, making them a critical component of digital transformation strategies. APIs also present a significant security risk if not properly secured, however, as they can provide a potential entry point for malicious actors.
Every API exposed to partners, customers, or the public represents a potential attack surface. In traditional security models, these interfaces often sit behind trusted network zones, assumed to be safe. But as organizations move to the cloud and rely on third-party integrations, that trust boundary disappears. APIs now span hybrid environments, edge devices, and external vendors with each connection a possible entry point for exploitation.
Consider a few common scenarios:
- A SaaS platform integrates multiple external services to enhance functionality such as CRM data from Salesforce, analytics from Google, or communications from Slack. Each connection introduces dependencies and potential exposure if any service is compromised.
- A mobile banking app exposes internal APIs to deliver real-time account data and transactions. If a bad actor reverse-engineers the app, they can attack those APIs directly, bypassing traditional user interfaces.
- An e-commerce platform relies on APIs for payment processing, inventory management, logistics tracking, and more. A compromised third-party API could allow attackers to exfiltrate customer data or inject malicious payloads into legitimate transactions.
In this context, the Zero Trust model becomes essential. It mandates that every API call, whether from a trusted partner, internal microservice, or external app, must be authenticated, authorized, and continuously validated. Trust is not assumed based on origin or prior behavior; it must be earned on every request.
Discovering Rogue Internal and External APIs
It’s equally important to discover and manage rogue APIs. These are APIs that have been developed and deployed without proper oversight from the IT or security team. They can be a significant security risk as they often do not adhere to the organization’s security policies and can provide a backdoor for attackers.
The danger lies in what you don’t know exists. Whether a forgotten internal API spun up during a sprint, a legacy endpoint left exposed after a migration, or a partner integration that bypasses standard authentication, these rogue APIs often lack appropriate authentication, encryption, and logging. This risk extends across environments:
- Internal APIs may expose sensitive internal systems or development data, particularly in hybrid or containerized infrastructures where network segmentation is weak.
- External APIs, such as those used by partners, customers, or mobile apps, can unintentionally leak information or enable account takeover attacks if deployed without proper access controls.
To mitigate this, organizations must perform regular discovery and inventory of both internal and public-facing APIs. Automated discovery tools watch network traffic to identify API transactions and crawl external domains to discover API hosts. These discovery tools provide critical visibility by mapping every API, building a real-time API inventory, understanding their behavior, and flagging unknown or high-risk instances for investigation.
Once a rogue API is discovered, it should be evaluated to determine if it can be brought into compliance with the organization’s security policies; if it can’t, it should be decommissioned. In either case, the existence of rogue APIs should trigger a review of the organization’s API development and deployment practices to prevent similar occurrences in the future.
How to Implement Zero Trust Security for APIs
Authentication
Every API call should be authenticated to verify the identity of the caller. This is typically done using API keys or tokens. OAuth 2.0 and OpenID Connect (OIDC) are commonly used protocols for API authentication.
Authorization
Once the caller’s identity is verified, the next step is to check if they have the necessary permissions to perform the requested action. This is where Role-Based Access Control (RBAC) or Attribute-Based Access Control (ABAC) comes into play.
Validation
Even after authentication and authorization, every API request should be validated. This includes checking the request against schemas such as an Open API specification for the expected data format, validating the data against business rules, and scanning for any malicious content.
Encryption
Data should be encrypted both in transit and at rest. HTTPS should be used for all API calls, and sensitive data stored should be encrypted using strong encryption methods.
Regular Audits and Discovery of Rogue APIs
Regular audits of API activity can help detect any unusual or suspicious behavior. This includes logging all API calls and monitoring for any anomalies, which might include unexpected spikes in traffic, unusual patterns of access, or the use of deprecated API versions. By implementing regular audits and proactive discovery of rogue APIs, organizations can ensure they have a comprehensive view of their API landscape. This visibility is crucial for maintaining a secure API environment and implementing a Zero Trust model.
API Gateway
An API Gateway can act as a single-entry point for all API calls, providing a layer of security. It can handle authentication, rate limiting, and other security measures, providing a buffer between your API and the outside world. An API gateway serves as a compliment rather than a replacement for API security, ensuring there are layers of security enacted to protect your organization’s APIs.
Final thought – Discover. Comply. Protect.
The Zero Trust model offers a robust framework for securing APIs. Implementing Zero Trust requires a shift in mindset to implement the necessary changes but the benefits of a Zero Trust approach to API security are clear: improved security, greater control over data access, and a more robust defence against the ever-evolving landscape of cyber threats.
The modern approach to API security requires three fundamental capabilities. Firstly, to discover APIs that are in use, including both officially sanctioned and unofficial APIs created to solve a DevOps tactical problem. Secondly, to ensure compliance with organizational policy and relevant regulatory requirements. Finally, an effective API security toolset must protect the organization against API misuse and subsequent mishandling of sensitive data.
Get an Attacker’s View into Your Organization
Cequence offers both internal and external API discovery with its API Security product, part of the UAP platform. You can also easily obtain an attacker’s view of your external-facing APIs with a free API assessment. We’ll crawl your external domain and provide you with a report of your public-facing API hosts and edge, infrastructure, gateway, and hosting providers, all at no cost to you. It’s safe and non-disruptive, and you’ll walk away with a better understanding of your attack surface. Get your free API assessment today.
