Thank you for Subscribing to CIO Applications Weekly Brief

Best Practices to Mitigate API Security Risks
Threat modeling is a systematic approach to identifying and evaluating risks. Threat models can help take preventative measures.
By
CIO Applications | Thursday, August 13, 2020

Threat modeling is a systematic approach to identifying and evaluating risks. Threat models can help take preventative measures. However, they should also be considered a continuous cycle for evaluating, mitigating, and preventing application vulnerabilities in an automated yet controlled fashion.
Fremont, CA: The utilization of APIs has increased with the rise of microservices and the rush to build more applications faster. APIs are used to transfer data and connect services. But with an increasing number of smaller application pieces trying to communicate with each other, APIs are becoming more challenging to secure.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
The most critical API security risks include user- and function-level authorization, excessive data exposure, Broken object level, security misconfiguration, lack of resource, and insufficient logging and monitoring.
Let us look at some best practices to mitigate API security risks:
Encrypt Data
This is one of the most vital practices enterprises need to develop. All data, particularly personally identifiable data, must be encrypted utilizing a method such as Transport Layer Security (TLS). Developers also need to require signatures to confirm that only authorized users are able to decrypt and modify data.
Threat modeling is a methodical approach to identifying and evaluating risks. Threat models can help take preventative measures. However, they should also be considered a continuous cycle for evaluating, mitigating, and preventing application vulnerabilities in an automated yet controlled fashion.
Utilize OAuth
One of the most important features of API security is access control for authentication and authorization. OAuth is a powerful tool for controlling API access. It is a token-based authorization framework that enables information to be accessed by third-party services without exposing user credentials.
Tokens are Useful
Another API security best practice would be using tokens. Developers can use tokens assigned to identities as a comparably simple and effective way to establish trusted identities and control access to services.
See also: Top Enterprise Security Startups
More in News

