Apidays London 2024 - Securing APIs, Beyond the Basics with Advanced Security Practices, Karanvir Attwal.pptx

Securing APIs: Beyond the Basics with Advanced Security Practices
Karanvir Attwal, Senior Solutions Engineer - Akamai

apidays London 2024 - APIs for Smarter Platforms and Business Processes
September 18 & 19, 2024

1. Securing APIs Karanvir Attwal API Security Specialist Beyond the basics with Advanced Security Practices

2. Existing application security solutions not built for evolution of API attacks 31 % of web traffic is APIs 1 Akamai State of the Internet Report 2 Akamai threat researchers have identified that 31% of all traffic protected by Akamai is API traffic More APIs deployed every day More API traffic More API attacks Why API Security is Needed Today 3 0% of all web attacks targeted APIs in 2023

3. Broad product capabilities: Flexible deployment, integrations, runtime protection, API testing, etc. API Attacks Are Not An If, But When In the last 12 months, 24 of 70 major data breaches stemmed from API vulnerabilities, impacting 15 different industries.

4. Order Coffee Order a Car Check the Weather Check in for a flight Use Maps Log in to Social Media APIs are Everywhere Open Internet, Employees, Suppliers, Partners, IoT Massive Attack Surface 31% of all traffic protected by Akamai is API traffic

5. API and Web Services Protect the client app from compromise Desktops Business Partners Multicloud Application and Data Services API and Web Security Threat Prot Bot Prot Privacy PCI DSS IoT Devices Internet Defend the applications from unavailability Protect the applications from OWASP, bot, and API attacks Defend APIs from attacks within the perimeter Defend applications against abuse and sensitive data exposure Today’s App and API Landscape

6. API and Web Services API and Web Security Threat Prot Bot Prot Privacy PCI DSS AAP protects the “front door” of the application and APIs API Security provides deep visibility and intelligence to what’s occurring inside the application environment Today’s App and API Landscape NEW

7. APIs are different They require a different approach Unlike web apps, when you expose an API to the internet, i t is open for direct calls and subsequent abuse

8. ‹#› How many APIs do you have?

9. ‹#› What type of data is being transmitted?

10. API asset inventory, change  detection, network mapping, reconnaissance. Discovery Configuration control, vulnerability management, remediation prioritization. Posture Management Detection and prevention of attackers and suspicious behavior in real time. Runtime Protection Secure APIs in dev to stop vulnerabilities before production. Testing Complete API Security at any stage of your API Lifecycle The API Security Pillars

11. Understand your API ecosystem like never before The API Security Pillars API inventory Network mapping Change detection Reconnaissance Discovery Posture Management Runtime Protection Testing

12. Protect what you know The API Security Pillars Proactive monitoring Configuration control Severity classification Remediation Discovery Posture Management Runtime Protection Testing

13. Protect what you know The API Security Pillars Real-time detection Behavior analysis Detect data exposure Prevention integrations Discovery Posture Management Runtime Protection Testing Detection and prevention of attackers and suspicious behavior in real time .

14. Protect what you know The API Security Pillars CI/CD Integration Shift left Reduce risk exposure Vulnerability labs Discovery Posture Management Runtime Protection Testing Secure APIs in dev to stop vulnerabilities before production.

15. Ecosystem Development Platforms Network and Cloud Workflow Integrations API Gateway

16. Deploy Noname globally at scale in any combination of SaaS, hybrid, or on-premises (including a hardened virtual appliance for public-sector organizations) Enable local control with global visibility with Remote Engines Easily comply with multiple regulatory requirements, regional policies, and technical directives Flexible Deployment Options Noname secures your APIs wherever and however you need Noname Hosted Hybrid Customer Hosted

17. Summary Know what you have! Build a complete inventory and API catalogue to ensure full control over your API estate Analyze traffic from all types of environments and enjoy more flexibility Test APIs and find vulnerabilities during the development cycle to avoid introducing risk into production environments Leverage out of the box integrations with the existing security stack to accelerate remediation activities Flexibility around deploying the solution to meet your Data Sovereignty and Governance needs.

18. Thank you!