APIs allow external access to key service functions such as login, account registration, search, reservations, and payments. These functions are designed for normal service operations, but repeated automated requests can also be used in unintended ways.

Attack requests do not always look unusual. Attackers can use normal API functions and valid request formats while automating the volume, speed, and targets of their requests.

This means API security needs to consider not only individual requests, but also how requests are repeated and the behavior patterns they create.

How Normal API Requests Can Become Part of an Attack

Take a login API as an example. A user entering account credentials and requesting authentication is part of the normal login process. However, automated tools can repeatedly submit credentials to a login endpoint, which may lead to attacks such as credential stuffing.

Search and query functions can also be automated. Bots can repeatedly send the same or similar requests to collect information from websites or applications, which can be used for scraping.

The key point is that each request may follow a format accepted by the API. A single request may be difficult to distinguish from normal user activity, but repeated or automated behavior can result in malicious traffic that affects the service.

Are Application-Level Controls Enough?

As APIs connect more services and data, the number of points that attackers can exploit also grows. APIs exposed to the internet face automated traffic and attack attempts, while attackers continue to change their request patterns and methods to bypass existing security rules.

API protection therefore requires not only application-level security controls, but also a separate security layer that can identify and block incoming malicious requests.

Building a Security Layer in AWS

In AWS environments, AWS WAF can serve as this security layer. The key is to select rules based on the resources being protected and the relevant attack types, and to maintain and update those rules as attack methods change. 

For example, API attacks and malicious bot activity are not the same type of threat, so different rules may be needed to address each, as shown below.

[Cloudbric Managed Rules for AWS WAF – API Protection]

Addresses known API attacks, including risks covered by the OWASP API Security Top 10, and provides validation and protection for XML, JSON, and YAML data.

[Cloudbric Managed Rules for AWS WAF – Bot Protection]

Targets malicious bots that affect websites and web applications through repetitive behavior. It detects behavioral patterns associated with scrapers, scanners, and crawlers to help protect against bot-based threats.

Cloudbric Managed Rules, which includes the two rule sets above, can be applied without building and managing all AWS WAF rules in-house, reducing the operational workload associated with rule management. 

Learn more about Cloudbric Managed Rules at the Link.