The Black Unicorn Report for 2021

What is API Security?
It is critical that we look at API security through a broader lens. For example, simply implementing a solution
to address the OWASP API Security Top 10 is the equivalent of a stick house. It’s a step in the right
direction, but ultimately leaves a false sense of security. I submit the following as a more accurate and
strategic definition of API security:
API security refers to protecting the integrity of your digital environment from API vulnerabilities,
API misconfigurations, and API cyber attacks.
It may seem like semantics, but in practice there is a significant difference between having an API security
strategy that focuses solely on a “shift-left” approach, or one that only reacts to attack patterns and an API
security strategy that proactively eliminates vulnerabilities and resolves misconfigurations before they can
be exploited.
Let’s explore a proactive and pragmatic approach to API security that can help eliminate risks associated
with APIs.
D.A.R.T - The Proactive API Security Strategy
D.A.R.T. is an acronym that stands for Discover, Analyze, Remediate, and Test. These are the 4 pillars of
an API security strategy designed to protect your entire digital environment. D.A.R.T. serves as both a way
to view the challenges associated with your APIs as well as a way to measure your existing API security
efforts.
The 4 pillars of D.A.R.T. have an interdependent relationship with each other, and your overall API security
posture will only be as strong as your weakest link. I’ll define each pillar of the D.A.R.T. API Security
Strategy:
Discover
Discover refers to the ability to find and inventory all APIs. Most enterprises don’t know how many APIs
they have. And many legacy and rogue APIs slip through the cracks and aren’t even routed through an API
gateway or WAF. In our experience, we’ve found that around 30% of APIs are unknown and unmanaged.
These blind spots pose a significant threat to the business.
Additionally, most organizations don’t have visibility into the data and metadata associated with their APIs.
Questions like “Which APIs send/receive sensitive information like credit card numbers or social security
numbers?” and “Which APIs are private and which are public?” are a lot harder to answer than you would
imagine.
Without a complete inventory of APIs and a catalogue of the associated data and metadata, you really
don’t know what you need to protect, and your environment is at risk. API discovery is the critical first step
of API security.
Analyze
Analyze refers to the ability to detect API vulnerabilities, misconfigurations, and attacks. As I mentioned
earlier, your ability to analyze APIs is directly related to how effective you are at discovering APIs. Without
a complete inventory or APIs and the associated data, it is impossible to analyze the access, usage, and
behavior of your APIs.
74