How to get API discovery right

Application Programming Interfaces (APIs) are everywhere. Companies have increasingly turned to API development to quickly and efficiently create consistent, feature-rich applications. APIs have become the connective tissue of data exchange, but this raises important security questions.

One of the most significant of these questions is: What is the extent of my organization’s API usage? This isn’t as straightforward a query as it may first seem. Businesses are using hundreds and thousands of APIs — new APIs built to meet standards frameworks, third-party APIs, shadow APIs without adequate visibility and documentation, older deprecated APIs and more.

Businesses can’t effectively protect what they don’t know they have. Therefore, API discovery has an essential role to play in keeping sensitive data safe.

The state and importance of API discovery

Unfortunately, from a security perspective, it’s all too normal for organizations to not have visibility into their overall API usage. In fact, 37% of respondents to a Cequence Security and ESG survey confirm that keeping an accurate inventory of API usage is an issue affecting their use of API-based development.

Unknown and shadow APIs have become so prevalent that within minutes of using API discovery tools, customers performing API inventories often find 100 times more shadow APIs than they knew existed within their networks.

The same research found that 41% of security teams are worried about an evolving threat landscape. The attack types seen on the OWASP API Security Top 10 are being joined by issues such as content scraping, or attackers taking advantage of configuration errors to gain illicit access.

The combination of factors facing businesses today — widespread API use, low visibility, and a complex threat landscape — has led to a new era of data protection needs. Seizing the development advantages that have made API usage so popular depends on also getting the security question right.

While API discovery is absolutely essential from an overall security perspective, companies are hindered by taking a limited approach to discovering their APIs. There are two perspectives when it comes to API discovery: Inside-out and outside-in.

Inside-out means continually identifying and tracking the API inventory from within, assessing their risks and basing protection on these findings. Outside-in involves analyzing your public domain to determine a company’s API attack surface — effectively showing them what an attacker would see. These methodologies each have their limitations when companies exclusively use one or the other. This is why it’s best to combine them and get a truly comprehensive look at how data is moving through APIs.

Taking a modern API discovery approach

What does it look like when an organization gets serious about both inside-out and outside-in API discovery? The process can involve two separate tools, each responsible for a distinct part of detecting and defending an organization’s complete API footprint.

In practice, the roles of these two types of systems break down along these lines:

API discovery from the outside in

When it comes to API use, a company’s security team can’t learn everything from an internal view. Taking an exterior view of public facing APIs allows security personnel to detect issues that may otherwise go unnoticed, such as internal APIs inadvertently becoming public or issues with deprecated APIs.

An outside-in view provides a valuable perspective, revealing security and compliance issues that even standard vulnerability and penetration testing may miss. By finding every publicly visible endpoint, such a solution gives IT security teams the same view that a potential attacker would have, revealing the company’s true external attack surface.

The next step after finding a potential issue is to alert personnel so they can take action. By studying a ranked dashboard of threats, team members can prioritize the most pressing vulnerabilities facing the team.

API discovery from the inside out

Completing the story of a company’s API use requires an internal as well as external view. This allows businesses to discover, catalog and track all their APIs, whatever their origin. 

By looking at an easy-to-read dashboard, team members can see both internal and public API usage. This includes managed APIs, unmanaged APIs and any third-party APIs in use. Metrics displayed on the dashboard include usage stats for the various APIs found, such as geographic traffic information.

The discovered APIs can then be sorted by risk profile, segueing smoothly from discovery into protection and risk remediation. Once security teams know the extent of their companies’ API profiles, they can get started protecting them more effectively.

API discovery’s role in Unified API Protection

Discovery is one of the essential aspects of a modern, comprehensive approach to API protection. Such a unified method is different from the common “API security” offerings that may help organizations detect some threats targeting their APIs but don’t equip them to guard against those attacks.

API discovery is step one in the Unified API Protection lifecycle. Advanced API discovery is at its best when combined with real-time detection of threats and real-time responses to the most pressing risk factors. Organizations that know the full extent of their attack surfaces, see all ongoing traffic and have defenses ready are ideally prepared to deal with today’s API-driven development environment.

Jason Kent

For over the last 20 years, Jason has been ethically peering into Client Behaviour, Wireless Networks, Web Applications, APIs and Cloud Systems, helping organisations secure their assets and intellectual property from unauthorised access. As a consultant he's taken hundreds of organisations through difficult compliance mine fields, ensuring their safety. As a researcher he has found flaws in consumer IOT systems and assisted in hardening them against external attacks. At Cequence Security Jason does research, community outreach and supports efforts in identifying Automated Attacks against Web, Mobile, and API-based Applications to keep Cequence's customers safe.

Automated Testing Tools and Their Impact on Software Quality

Natalia Yanchii • 09th October 2024

Test automation refers to using specialized software tools and frameworks to automate the execution of test cases, thereby reducing the time and effort required for manual testing. This approach ensures that automation tests run quickly and consistently, allowing development teams to identify and resolve defects more effectively. Test automation provides greater accuracy by eliminating human...

Custom Software Development

Natalia Yanchii • 04th October 2024

There is a wide performance gap between industry-leading companies and other market players. What helps these top businesses outperform their competitors? McKinsey & Company researchers are confident that these are digital technologies and custom software solutions. Nearly 70% of the top performers develop their proprietary products to differentiate themselves from competitors and drive growth. As...

The Impact of Test Automation on Software Quality

Natalia Yanchii • 04th October 2024

Software systems have become highly complex now, with multiple interconnected components, diverse user interfaces, and business logic. To ensure quality, QA engineers thoroughly test these systems through either automated or manual testing. At Testlum, we met many software development teams who were pressured to deliver new features and updates at a faster pace. The manual...

Custom Software Development

Natalia Yanchii • 03rd October 2024

There is a wide performance gap between industry-leading companies and other market players. What helps these top businesses outperform their competitors? McKinsey & Company researchers are confident that these are digital technologies and custom software solutions. Nearly 70% of the top performers develop their proprietary products to differentiate themselves from competitors and drive growth. As...

The Impact of Test Automation on Software Quality

Natalia Yanchii • 03rd October 2024

Software systems have become highly complex now, with multiple interconnected components, diverse user interfaces, and business logic. To ensure quality, QA engineers thoroughly test these systems through either automated or manual testing.
The Digital Transformation Expo is coming to London on October 2-3. Register now!