API Security Best Practices

Key Takeaways:

• Automate API Discovery: Dev teams constantly release and modify APIs, and security needs to keep up. Automate continuous API discovery to ensure full visibility over your API estate, including shadow and zombie APIs unmaintained by your dev team. 

• Implement API Security Testing: Regularly assess APIs for vulnerabilities and misconfigurations, including risks identified in the OWASP API Top 10. Validate API exposure via the external attack surface to assist in prioritization of risks.  

• Strong authN and authZ: Improperly configured authentication and authorization in APIs is the starting point for many API-related data breaches. Implement strong authentication for all API requests, and leverage OAuth2 guidance for authorization. Regularly test APIs for common auth related exploits such as Broken Object Level Authorization. 

• Data Protection by Default Encrypt all sensitive data at rest and in transit (TLS, AES-256), enforce digital signatures and HMAC for data integrity, and rotate encryption keys frequently to prevent compromise.