Why APIs Require Zero Trust Security

Judith Kahrer

2022-12-07 · 3 min read

api-security zero-trust

Key Takeaways

APIs now number over 20 million, and their growth makes perimeter security insufficient — access control must shift to scrutinizing each service/device individually via zero trust architecture (ZTA).
ZTA centers on identity: no device or service is inherently trusted, so authentication (ideally token-based via OAuth/OpenID Connect) becomes critical.
Key design principles: use JWT tokens for backend calls and opaque tokens/HTTP-only cookies for browser apps (authentication); centralize trust via an authorization server with scopes/claims (authorization); handle GDPR/privacy in the authorization server or API Gateway (compliance).
ZTA applies to anyone working with APIs but is especially critical for healthcare, finance, government, and transportation/logistics sectors handling sensitive data.

On this page

In today's connected world, hardly any industries function solely offline. Large amounts of data flow between services and devices, be it industrial machines, medical equipment, or vehicles, which don't necessarily live inside the same network. Since this exchange is handled mainly through API calls, it is clear that perimeter security is no longer enough to control network access.

Access control must be shifted from the perimeter. This effort should be concentrated on ensuring that each service and device, whether internal or external, is protected and its access is carefully scrutinized. This is where zero trust architecture (ZTA) finds a great use case.

Why API Security Matters

As established earlier, APIs are critical for modern solutions in most industries. The number of APIs in use today well exceeds 20 million. But the greater the number of APIs, the more difficult it becomes to manage and protect them. And since data transfer happens mainly through API calls, it is essential to ensure that no malicious agent can access them. That is why it is critical to implement security solutions that protect APIs and any endpoints that might be exposed.

Identity First

A zero trust approach helps shift away from perimeter security by focusing on tightly controlling access based on identity. When no device or service is trusted (hence the name), access is granted based on whether the entity trying to access the system can be verified. This makes authentication a critical aspect of a successful ZTA implementation.

To ensure robust authentication, organizations should employ a token-based approach using OAuth. This strategy allows the system to handle various use cases, spanning from users accessing resources to services communicating with other services. Using tokens provides a scalable and highly flexible solution that is also very applicable to API security.

How to Implement Zero Trust for APIs

Zero trust security practices are applicable to APIs and covered by the main ZTA principle that "all data sources and computing services are considered resources". Therefore, it is essential to ensure API access is regulated and monitored for both external and internal APIs. This process should be ongoing to spot irregular behaviors.

Here are some other design principles that can help you implement zero-trust APIs:

For authentication: Use OpenID Connect and design a token-based architecture for transporting authentication information. Consequently, use JWT access tokens to validate calls within the backend cluster, and secure Internet credentials by utilizing opaque tokens or HTTP-only cookies for browser-based apps.
For authorization: Use an authorization server and centralize trust to decrease the risk of malicious parties calling your APIs. Leverage scopes and claims to perform authorization checks.
For meeting API compliance and regulatory standards: Manage privacy and GDPR in the authorization server or use dynamic user routing in the API Gateway.

By following these guidelines, you can better protect your data and the system as a whole. Learn more about how to implement zero-trust APIs in this webinar.

Who Needs Zero Trust APIs?

Implementing zero trust for APIs is essential for anyone working with APIs. It especially applies to scenarios that presuppose working across the cloud or on-premise with different users or systems accessing the network or various services.

ZTA is typically a bigger priority for organizations dealing with large volumes of critical data. For example, segments like healthcare, financial organizations, and government agencies that deal with personal information. Transportation, logistics, and operations are also among those who must consider strengthening their API security.

Modernization and digital transformation accelerate the use of APIs across many other industries. With this broad adoption of APIs, adoption of ZTA will only be a matter of time, and the effort put into its implementation will be well worth it.

Related resources

Article

Testing Zero Trust APIs

Frequently Asked Questions

Can zero trust principles be applied incrementally, or do they require an all-or-nothing approach?

Zero trust can generally be adopted incrementally, starting with the most sensitive APIs or services and expanding coverage over time, rather than requiring a complete architectural overhaul all at once.

What are common pitfalls or mistakes organizations make when implementing zero trust for APIs?

Common challenges include underestimating the complexity of managing scopes and claims at scale, failing to monitor for irregular behavior on an ongoing basis, and treating zero trust as a one-time project rather than a continuous practice.

Does implementing zero trust for APIs impact performance or latency?

Token validation and authorization checks introduce some additional processing overhead compared to simpler perimeter-based access controls, though this is generally a worthwhile tradeoff for the security benefits and can be optimized with proper caching and infrastructure design.

What's the difference between zero trust and traditional perimeter-based security in terms of cost or resource investment?

Zero trust generally requires more upfront investment in identity infrastructure (authorization servers, token management systems) and ongoing monitoring, compared to perimeter security's reliance on firewalls and network boundaries. However, it can reduce the cost and impact of breaches by limiting lateral movement within a compromised system.