Drowning in APIs

### Overview In "Drowning in APIs: How to Improve Your API Security with Proper Inventory, Prioritization, and Automation," Doug Rogan, a senior security consultant in Optiv's threat management practice, addresses the challenges created by exponential API growth. Rogan outlines how user device diversification and the transition from monolithic architectures to microservices and cloud hosting have led to an explosion of endpoints. To manage this scale, he advocates for systematic inventory management, security champions, dependency mapping, and automated testing integrated into development and deployment workflows.

### Key Topics - **Drivers of API Proliferation**: Shifts in user behavior across multiple devices (PCs, phones, tablets) and architectural transitions from monolithic applications to cloud-hosted microservices have vastly expanded API footprints. - **Discovery and Inventory Management**: Establishing visibility over internal and external APIs through cloud provider tools, code repositories, and collaborative developer relationships. - **Security Champions and Developer Training**: Bridging the gap between security and development teams by designating security champions and providing targeted secure coding courses. - **Risk Profiling and Dependency Mapping**: Prioritizing testing and remediation based on data classification, business impact, and exposure, alongside building dependency trees to meet privacy compliance standards (e.g., GDPR, CCPA, PDPC). - **Testing Efficiency and Automation**: Consolidating granular API tests and using Postman test scripts and monitors to shift testing left into build pipelines.

### Technical Details - **External vs. Internal Discovery**: Organizations should use built-in cloud provider tools (such as Akamai's 24-hour discovery cycles that capture hostnames, methods, and parameters) for external endpoints. Internal discovery requires scanning, reviewing Git repositories, and collaborating with development teams to locate untested APIs or legacy servers. - **Defensive Controls vs. Deep Testing**: While cloud providers and API gateways offer Web Application Firewall (WAF) features capable of addressing items from the OWASP API Security Top 10 (such as OWASP 2019 API4: Lack of Resources & Rate Limiting via request throttling), Rogan cautions that WAFs cannot replace comprehensive penetration testing because experienced attackers can bypass protections. - **Downstream and Incubated Vulnerabilities**: Testing individual endpoints in isolation obscures end-to-end data flows. Rogan highlights examples where APIs return excessive data not needed by the front end, store unsalted MD5 password hashes in GET query parameters that can be cached and cracked, or accept cross-site scripting (XSS) payloads in JSON parameters that appear benign until rendered by upstream or consuming client interfaces. - **Automated Validation in Postman**: Teams can write test scripts in Postman Test Runner to check for authorization regressions—such as stripping the `Authorization` header to confirm an endpoint returns HTTP `403 Forbidden` rather than `200 OK`. Postman Monitors can then be scheduled alongside code deployments to run collections and dispatch alerts upon test failures.

### Takeaways - **Document and Profile Everything**: Maintaining an active, centralized API inventory linked to risk profiles allows organizations to prioritize testing depth and ensure compliance. - **Map Dependencies**: Build dependency trees to track PII movement and mitigate risks stemming from pinned versions and third-party vulnerabilities. - **Cultivate Security Champions**: Placing dedicated champions within development teams improves documentation quality, test scoping, and vulnerability remediation. - **Shift Testing Left**: Equip developers with automated test collections and CI/CD monitors to capture misconfigurations, broken authentication, and rate-limiting gaps before production release.