API Gateway vs WAF vs API Security Platform

Application programming interfaces (APIs) have revolutionized the face of cloud computing, making it easier than ever for different cloud technologies to communicate with one another — thereby bringing enormous value to users by connecting different cloud-based solutions.

However, APIs are increasingly being targeted by malevolent actors to find creative backdoors into high-value targets. APIs — by design — rely upon organizations provisioning internet-exposed endpoints which return user data and services in response to targeted queries. Without robust API security in place, this provides an attractive target for hackers who can attempt to exploit the API to gain direct unauthorized data or even use the data it returns to attempt to reverse engineer the main application. Increasingly, this is exactly what defensive teams are witnessing in the field.

API-targeting exploits can include everything from attacks that target websites (such as brute force methodologies intended to suppress API availability to legitimate users) to attempts to flood endpoints with queries to illicitly obtain user information and DDoS-style query-flooding.

In this blog post, we’re going to explain the differences between three different security tools that can protect various parts of a company’s online footprint: WAFs, API gateways, and API security platforms. Increasingly, all three of these components are considered essential components of the API-protection stack, working at different levels of the TCP/IP model in order to protect APIs from malicious targeting.

We’ll explain exactly what independent value each of these solutions brings, how they work together, and why defense-focused organizations should be deploying all three to better manage their security.

What Does an API Gateway Do?

API gateways are designed to handle authentication and authorization of requests to access an API. API gateways work at the network level but, more specifically, they handle incoming traffic requests specifically seeking the API.

In a typical network architecture, API gateways are placed immediately before API endpoints — serving as access control points. Core API gateway functionalities include:

• Origin IP-based rules such as allowlists and blocklists. These can work in conjunction with third-party lists of IPs associated with both established and emerging threat actors. More broadly, these can be used to implement firewall-type rules designed to block access from specific geolocations.
• Rate-limiting designed to distinguish between normal API usage and that originating by unauthorized bots. Typically, these apply some sort of GET-based rate limit that can be sensibly used to distinguish between humans and legitimate applications and those making illicit use of the API, such as attempting to use it to scrape or harvest user data.
• These gateways can also be used for routing and traffic management — in other words, to load-balance incoming API requests to different endpoints. This purpose clearly isn’t security-related. Although it does improve API performance for those accessing it.

Do APIs Need WAF Protection?

Website application firewalls (WAFs) form an additional layer of the API protection stack. WAFs protect web assets — including APIs — from malicious traffic originating from outside of the local network.

As API technology continues to be deployed, some APIs are reserved exclusively for internal use (so-called “east-west” usage within a data center or another type of local network). The majority, however, are exposed to the internet (“north-south”).

Relative to API gateways, WAFs are intended to provide more advanced security controls than simple rule-based logic. Instead, WAFs are essential security firewalls for any organization operating public-facing online infrastructure — which, these days, is most companies.

Companies that provision API endpoints that can only be accessed from within a LAN may feel confident in only using an API gateway to protect access to the endpoint. However, for the majority of organizations, a WAF will be an essential add-on to the gateway.

WAFs can deliver the following additional features that gateways generally don’t include:

Known attack detection

• This WAF module is designed to recognize common attract strategies and shut down access to components of the web-facing service should unauthorized attempts be detected.

Malformed/abnormal request detection

• Within the context of API security, this WAF functionality could be leveraged to automatically distinguish between legitimately-parsed API requests and those intended to serve illicit purposes, such as user data scraping or network surveilling.

Virtual patching

• Virtual patching can be delivered to intelligently deliver security patches to the firewall protecting the API endpoint(s).

Anti-bot automation

• Anti-bot automation has the ability to distinguish legitimate user-agents from bots or botnet components.

In simpler language: the API gateway provides basic access point control to the API endpoint ensuring that those accessing it are likely to be legitimate and/or accredited users. WAFs, by contrast, are security oriented, adding a vital additional layer of protection.

Where Do API Security Platforms Fit Into The Picture?

In order for every security tool to be useful, it needs to have some kind of interface to allow human operators to observe activity based on preconfigured triggers (this function is commonly called monitoring). It also needs to provide some means for human operators to enable changes to the configuration of the tools it contains.

This is where API security platforms — like Noname Security — come into the picture. API security platforms tie up all the monitoring and remediation functions of utilities intended to secure APIs.

Common functionalities of API security platforms include:

• Discovering the full API estate
• Analyzing for API security vulnerabilities and misconfigurations
• Detection of runtime API security anomalies
• Remediation tools with the ability to fix detected system anomalies
• Ability to integrate with the SLDC for APIs to prevent new vulnerabilities from being pushed into production
• Full integration with other elements of the application security stack, such as WAFs and API gateways

In the API security stack, the API security platform can be thought of as the orchestrator that enables the security team to ensure that all components of the API-protecting infrastructure are working in harmony.

What Does Best-In-Class API Security Look Like?

In a simple threat landscape, APIs would need basic security measures such as access control lists designed to ensure that only legitimate actors have access to the endpoints.

Unfortunately, that kind of threat landscape no longer exists. As APIs continue to rise in importance in the interconnected world of cloud computing, APIs become increasingly attractive as targets for malicious actors. Therefore, multifaceted security measures designed to protect against both internal and external hostile actors are necessary.

Best-in-class API security leverages a number of protective mechanisms to ensure that APIs remain as diligently protected as the users attempting to target them. This includes API gateways that provide basic access control. WAFs that deliver holistic API security protection against both API endpoints and other web-exposed services. And finally, an API security platform that ties all the functionalities together and is specially designed to protect against these new attack patterns.

 

Download Now: API Security 101 White Paper

*** This is a Security Bloggers Network syndicated blog from Noname API Security Blog authored by Matt Tesauro. Read the original post at: https://nonamesecurity.com/blog/api-gateway-vs-waf-vs-api-security-platform