Product sheets
ExtendedAPI Protection
Enhance UBIKA WAAP Gateway and UBIKA WAAP Cloud with an effective API security strategy.
What is an API?
An application programming interface (API) is a way for one piece of software to interact with another piece of software. Most modern web applications rely on APIs to function. As a result, if a program or application has an API, external clients can request services from it, such as data enrichment and modification, introducing an additional risk to the API service infrastructure as outside parties gain access.
API security is the process of protecting APIs from attack. Just as applications, networks and servers can come under attack, APIs can fall victim to a number of different threats.
What are the risks of attacks against APIs?
In 2019, one study estimated that 83% of all web traffic was generated by APIs. This trend is confirmed by the fact that APIs have become the easiest way to expose the functionality and data of an information system.
By their very nature, APIs facilitate the transfer of large quantities of data, far more easily than is possible with web applications.
APIs therefore bring risks such as :
- Exploitation of vulnerabilities (OWASP Top 10): There is also a lack of input validation and output coding, which could, for example, lead to injection attacks
- Authentication-based attacks: Authentication, which involves validating the user’s identity, is another critical point when using an API. Not all users should be able to access information belonging to a high privilege level
- Authorization errors
- DoS and DDoS attacks: malicious bots are on the increase, making it essential to apply a limit to the number of calls a client can make to an API in a given period of time.
It is therefore advisable to put in place a proactive plan to deal effectively with these attacks, and protect your APIs with a number of advanced features such as :
- Whitelisting protection with an OpenAPI3 scheme
- Securing WebSockets traffic
- API encryption: advanced XML and JSON API filtering, JSON Web token to integrate industry standards for API authentication (OAuth, OpenID Connect).
Today, depending on the API and the type of sensitive data being transferred, API security requires more advanced capabilities to prevent data breaches. UBIKA responds to this need for protection with its API protection offering.
