APIsecure - April 6 & 7, 2022 APIsecure is the world’s first conference dedicated to API threat management; bringing together breakers, defenders, and solutions in API security. Securing Large API Ecosystems Michal Trojanowski, Product Marketing Engineer at Curity AB

1. Securing Large API Ecosystems
Michał Trojanowski
Product Marketing Engineer @ Curity
@mz_trojan

2. • Different types of large APIs
• Common security problems of large API ecosystems
•Proposed solutions
Agenda

3. API Gateway
Breadth-grown API
Depth-grown APIs

4. API Security maturity
API Keys and
Basic Authentication
Token-Based
Authentication
Token-Based
Authorization
API-Key: abcdef

5. Breadth-grown APIs
Client
Undocumented endpoints
API Gateway

6. Breadth-grown APIs
scope: read
Require scope “write”
Client
Undocumented endpoints
API Gateway
scope: read

7. Read past transactions
Read future transactions
Create transactions
Modify transactions
Update transactions

8. Read and manage transactions

9. Depth-grown APIs
Client
API Gateway
external service
!

10. Change the optics
Access Token
What is the caller
authorized to do?
Who is calling?

11. Claims-based authorization
API Gateway
sub: user@example.com
client_id: mobile-app
sub: user@example.com
client_id: background-app

12. Token Sharing
Exchanging
Tokens
Embedding
Tokens

13. Entitlement Management Systems

14. Key Takeaways
• Merely implementing OAuth and using access tokens might not be
a sufficient security measure for large APIs.
• Remember that access tokens are not related to sessions.
• Limit the capabilities of a token:
• use claims-based authorization
• implement proper token sharing techniques

15. Thank You!
curity.io
developer.curity.io
@curityio
info@curity.io