{"id":7902,"date":"2020-01-29T13:08:50","date_gmt":"2020-01-29T13:08:50","guid":{"rendered":"https:\/\/staging-site.42crunch.com\/?p=7902"},"modified":"2022-11-18T12:22:03","modified_gmt":"2022-11-18T12:22:03","slug":"why-api-firewall","status":"publish","type":"post","link":"https:\/\/staging2022.42crunch.com\/why-api-firewall\/","title":{"rendered":"42Crunch API Firewall and API Management: why you need both!"},"content":{"rendered":"

Every day, new breaches<\/a> show us that we still have a long way to go with API security. In order to protect APIs, enterprises need to take a holistic<\/span> approach, which includes the following:<\/p>\n

    \n
  1. Securing the infrastructure: OS configuration, network configuration as well as containers.<\/li>\n
  2. Properly configuring application servers: enforce TLS 1.2\/1.3, remove weak cipher suites, eventually enforce mutual SSL, use security headers, use secure cookies, use latest versions of frameworks\/libraries, etc.)<\/li>\n
  3. Defend against attacks by validating data: this includes JSON\/XML validation, data\/exception leakage detection, mass assignment protection, token leakage\/forgery and in general OAuth\/OpenID connect attacks protection.<\/li>\n
  4. Ensure API payloads (messages) are encrypted and\/or signed depending on data and operations sensitivity.<\/li>\n
  5. Enforce authentication<\/li>\n
  6. Enforce authorization (the #1 issue on the OWASP Top 10 API Security list<\/a> is an Authorization problem!)<\/li>\n
  7. Optionally implement non-repudiation for critical transactions<\/li>\n
  8. Audit everything happening, at the system level and at the transaction level. This is critical for security forensics.<\/li>\n<\/ol>\n

    This list might seem long, but a locked-down Kubernetes-based architecture is no help if the application deployed on top of it lets you become an administrator with a single API call.<\/p>\n

    No one vendor is going to provide support for the entire spectrum: as an enterprise, you will need to compose several solutions to address all potential vulnerabilities. Items 3 through 6 above cover two fundamental aspects: API threat protection and API access control, as depicted in the diagram below.<\/p>\n

    \"\"<\/p>\n

    The 42Crunch platform focuses on the Threat protection aspects, while API Management and Identity Management focus on the authentication and authorization aspects.<\/p>\n

    Our solution complements API Management<\/strong> on multiple fronts:<\/p>\n