INTERFACE by apidays 2023 APIs for a “Smart” economy. Embedding AI to deliver Smart APIs and turn into an exponential organization June 28 & 29, 2023 API Security: Approaching Protection At Code-Level Goodness Okpani, Chief Technology Officer at Ethnos IT Solutions ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

1. API Security
Approaching Protection at Code
Level

3. API
Usage
over
the
Years
According to
Gartner, 98% of
organizations use
or plan to use
APIs.
There are more
than 2.4 million
API-related
repositories on
Github as at now.

4. There are about 1097.9M API Requests from 2015 to 2021 compiled by numbers of Postman request
API
Usage
over
the
Years

5. Traditional Approaches to
protecting APIs
Developers
WAF
Services
Web Servers
Hacker
WAAP
API
Gateway
Developed API in
Production

6. Limitations of WAF, API
Gateways and WAAPs in API
Security
• Attack Surface Increase(Monolithic vs
Microservices)
• Business Logic Based Attacks
• Need to have traffic routed through them in
order to block (
• Need to register APIs to enable API-level
protections
• Does not address shadow or zombie APIs
WAF
WAAP
API
Gateway
Enterprise Network
Registered API
Unregistered API
Vulnerable
Unregistered
API
Web Servers/
Database

7. Bypassing WAF in API
Security
Client-side API
threat/vulnerabilities
• Business Logic Flaws
• Insecure Direct Object References
• Client-side attacks
• Encrypted Traffic
• Zero-day Exploits
• Client Authorization and Access
Control
Client-side
Code
Server
Side
Code
Protected by WAF Not protected by WAF

8. Protecting API at the
Source code level
Shifting-Left Approach
Shifting left empowers developers to build more
secure APIs in the first place rather than finding
security vulnerabilities after going into production
Train Design Code Check-in
Build Deploy
Test
Implementing Modern API SDLC

9. Discussion and Questions

10. Thank you