APIs truly make the digital world go round. They are the backbone of digital transformation for both digital native and traditional businesses. But this also makes them a prime target for security threats. From API sprawl to Shadow APIs, the challenges are many. And strategies like Open authentication, Zero Trust models, rate limiting, etc. too are discussed widely. But what’s the blueprint of a CISOs strategy to secure APIs?

The scale at which Paytm operates and the massive number of transactions processed daily, API sprawl and Shadow APIs can pose significant risks. How does Amit Malhotra, CISO, Paytm Group address this challenge, especially when managing third-party integrations and microservices architectures?

Malhotra says, “APIs interact and can communicate sensitive information too- can be financial transactions, personal info too. It’s imperative as a security officer to protect these APIs. We should have an integrated approach of managing both API security and application security together- where we take help from DevSecOps. If you perform all security testing properly, I believe the vulnerabilities that can be exploited through API exploitation cannot happen.”

“API sprawl means you have a certain explosion and are not able to manage properly. API sprawl happens due to hybrid computing and microservices operating and continuous deployment. We may not be able to control but manage with API governance strategy. You can have an API gateway that can give central control. Have a single source of truth for API discovery hosted within your organization. You can have proper documentation and seek better visibility into the data transacting with the APIs. You must implement API security at scale,” adds Malhotra.

Security and privacy by design

As both the CISO and DPO, Pushkal Mishra, CISO & DPO, Dr Lal Path Labs has to align security with data privacy. How does Mishra then leverage API gateways? “API security strategy is one element. Security is a way to ensure there are loopholes of APIs contained. Privacy ensures that the party on the other side sees only what’s required. Security is instrumental in driving privacy strategy.”

“APIs have different stakeholders- consumer, developer, admin, vendors. How would you stitch it without a common platform to interact with? You need to have a way to discover shadow APIs beyond WAF. API gateway is probably the way to create a holistic experience. API gateways are instrumental in delivering valuation specific to APIs,” says Mishra.

“Compliance is one more trigger to ensure I take care of my APIs well. APIs might have sensitive information. Security elements become more pronounced with privacy. Data minimization and non security elements come together with API strategy,” he adds.

Securing APIs that are part of complex, interconnected systems involving multiple stakeholders is also a challenge. “Stick to the basics, shift left as much as possible and ensure developers building APIs have a clear line of sight,” says Sriram Lakshmanan, Dy CISO, Genpact.