API security & gateways
APIs expose business logic directly, so they fail differently from web pages. The OWASP API Security Top 10 (2023 edition) lists the main risks: broken object level authorization, broken authentication, broken object property level authorization, unrestricted resource consumption, broken function level authorization, unrestricted access to sensitive business flows, server-side request forgery, security misconfiguration, improper inventory management and unsafe consumption of APIs.
What we do
- API assessments against the OWASP API Security Top 10 (2023)
- Object and function level authorization testing
- API inventory to find shadow and old versions
- Gateway policy design: authentication, rate limits, quotas
- Amazon API Gateway, Azure API Management, Apigee and Kong configuration review
- Schema validation and error-handling review
- Logging and monitoring of API traffic
- Findings with reproduction steps, fix guidance and retest
An API gateway is the front door that enforces authentication, rate limits and routing. We work with Amazon API Gateway (REST, HTTP and WebSocket APIs), Azure API Management (gateway, management plane and developer portal), Google Cloud Apigee (a proxy layer for security, quotas and analytics) and Kong Gateway (open source, plugin based). A gateway does not fix authorization bugs inside the API, so testing and design come first.
Experience with these platforms, not a partnership. Connects to our application security testing and cloud work.
Platforms and practices
- OWASP API Security Top 10 (2023)
- Amazon API Gateway
- Azure API Management
- Google Cloud Apigee
- Kong Gateway
- API inventory and discovery
- API authorization testing
- Rate limiting and quota design
References
- OWASP API Security Top 10 (2023)
- AWS: What is Amazon API Gateway
- Microsoft Learn: Azure API Management overview
- Google Cloud: What is Apigee
- Kong: Kong Gateway
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.