API Gateway vs WAF vs API Security Platform

APIs have transformed cloud computing, simplifying communications between different cloud technologies and providing immense benefits to enterprises by connecting various cloud-based solutions. However, APIs have also become a prime target for malicious actors seeking to exploit them as a gateway into valuable resources, such as sensitive data.

APIs rely on organizations to set up publicly accessible endpoints that can be used to retrieve user data and services through targeted requests. In the absence of strong API security measures, attackers can easily gain unauthorized access to data or even use the information obtained to reverse engineer the main application. 

Exposed or misconfigured APIs are prevalent, easy to compromise, and are not only unprotected but often unseen and unmanaged, including highly-vulnerable “shadow APIs.” Just one compromised API can result in millions of records being stolen, held for ransom, or published for the world to see.

API-targeting attacks can range from targeting websites (such as using brute force methods to disrupt API availability for legitimate users) to flooding endpoints with queries in an attempt to acquire sensitive user information or cause a DDoS-style overload.

In this blog post, we will discuss the distinctions between three types of security tools that can safeguard different aspects of a company’s online presence: 

• Web application firewalls (WAFs).
• API gateways.
• API security platforms. 

These three components each play distinct roles in protecting APIs from malicious targeting, as they operate at various layers of the TCP/IP model. Let’s delve into the unique advantages of each solution, how they complement each other, and why organizations should implement all three to effectively manage their security.

What Does an API Gateway Do?

API gateways are designed to handle authentication and authorization of requests to access an API. API gateways work at the network level but, more specifically, they handle incoming traffic requests specifically seeking the API.

In a typical network architecture, API gateways are placed immediately before API endpoints — serving as access control points. Core API gateway functionalities include:

• Origin IP-based rules such as allowlists and blocklists. These can work in conjunction with third-party lists of IPs associated with both established and emerging threat actors. More broadly, these can be used to implement firewall-type rules designed to block access from specific geolocations.
• Rate limiting designed to distinguish between normal API usage and that originating by unauthorized bots. Typically, these apply some sort of GET-based rate limit that can be sensibly used to distinguish between humans and legitimate applications and those making illicit use of the API, such as attempting to use it to scrape or harvest user data.
• These gateways can also be used for routing and traffic management — in other words, to load-balance incoming API requests to different endpoints. This purpose clearly isn’t security-related. Although it does improve API performance for those accessing it.

What Does a WAF Do?

form an additional layer of the API protection stack, by protecting web assets — including APIs — from malicious traffic originating from outside the local network. As enterprises continue deploying API technology, some APIs are reserved exclusively for internal use (so-called “east-west” usage within a data center or another type of local network). The majority, however, are exposed to the internet (“north-south”).

Relative to API gateways, WAFs are intended to provide more advanced security controls than simple rule-based logic. Instead, WAFs are essential firewalls for any organization operating public-facing online infrastructure — which, these days, is most companies. Companies that provision API endpoints that can only be accessed from within a LAN may feel confident in only using an API gateway to protect access to the endpoint. However, for the majority of organizations, a WAF will be an essential complement to the gateway.

WAFs can deliver the following additional features that API gateways generally don’t include:

• Known attack detection: This WAF module is designed to recognize common attract strategies and shut down access to components of the web-facing service should unauthorized attempts be detected.
• Malformed/abnormal request detection: Within the context of API security, this WAF functionality could be leveraged to automatically distinguish between legitimately-parsed API requests and those intended to serve illicit purposes, such as user data scraping or network surveilling.
• Virtual patching: can be delivered to intelligently deliver security patches to the firewall protecting the API endpoint(s).
• Anti-bot automation: has the ability to distinguish legitimate user-agents from bots or botnet components.

In simpler language: the API gateway provides basic access point control to the API endpoint, ensuring that those accessing it are likely to be legitimate and/or accredited users. WAFs, by contrast, are more security-oriented, adding an additional layer of protection.

Where Do API Security Platforms Fit Into The Picture?

WAFs and API gateways can provide baseline protection. But neither of these tools is designed to provide the degree of visibility, insight, and runtime protection to prevent API attacks. For example, broken object level authentication (BOLA) attacks look like “ordinary” API traffic to WAFs and gateways, enabling them to pass through undetected. 

Moreover, WAFs and API gateways cannot provide an aggregated or current inventory of the full API estate – nor can they provide contextual data that would help security teams identify signs of risk. And these tools can only observe API traffic that is routed through them – meaning they can’t catch unmanaged APIs.

For security tools to be effective, they must have an interface that allows human operators to monitor activity based on preset triggers. They must also have a way for operators to modify the tool’s configuration. This is where API security platforms, such as Noname Security, play a crucial role. These platforms combine the monitoring and remediation capabilities of API security tools.

Common functionalities of API security platforms include:

• Discovering the full API estate
• Analyzing for API security vulnerabilities and misconfigurations
• Detection of runtime API security anomalies
• Remediation tools with the ability to fix detected system anomalies
• Ability to integrate with the SDLC for APIs to prevent new vulnerabilities from being pushed into production
• Full integration with other elements of the application security stack, such as WAFs and API gateways

In the API security stack, the API security platform can be thought of as the orchestrator that enables the security team to ensure that all components of the API-protecting infrastructure are working in harmony.

What Does Best-In-Class API Security Look Like?

In a simple threat landscape, APIs would only need basic security measures such as access control lists designed to ensure that only legitimate actors have access to the endpoints. Unfortunately, that kind of threat landscape no longer exists. As APIs continue to rise in importance in the interconnected world of cloud computing, APIs become increasingly attractive as targets for malicious actors. Therefore, multifaceted security measures designed to protect against both internal and external hostile actors are necessary.

Best-in-class API security leverages a number of protective mechanisms to ensure that APIs remain as diligently protected as the users attempting to target them. This includes API gateways that provide basic access control. WAFs that deliver holistic API security protection against both API endpoints and other web-exposed services. And finally, an API security platform that ties all the functionalities together and is specially designed to protect against these new attack patterns.

How Can Organizations Get Started with API Security?

The existing tools that many organizations use to manage APIs and gain baseline protection – WAFs and API gateways – do provide a degree of risk reduction. But they can’t be relied on as sole sources of protection in today’s API threat landscape. Instead, organizations should look for a comprehensive API security platform covering four key components: discovery, posture management, runtime protection, and security testing. 

Check out our eBook, Rising to Meet the API Security Challenge, to learn more about API risks and the specific types of controls today’s enterprises need.