What do Google, Facebook, Paypal, IRS, T-mobile, and USPS have in common? Answer -- hackers used their APIs to access sensitive customer information. Although these API attacks were exposed, most API-based attacks go undetected these days. This deck will discuss today’s evolving API threat landscape and explore what you can do to both detect and block cyberattacks from authenticated users and hackers who have reverse engineered your API with an integrated solution from WSO2 and PingIntelligence.

1. PROTECTING API
INFRASTRUCTURES
Baber Amin
CTO West, Ping Identity
Copyright ©2019 Ping Identity Corporation. All rights reserved.1
An AI-Powered Solution from Ping
Identity & WSO2

2. IT’S A NEW
DIGITAL ERA
… And your most
valuable assets are now
accessed via APIs!
Copyright ©2019 Ping Identity Corporation. All rights reserved.2

3. “Discover Your APIs Before Attackers
Discover them”
"By 2022 API breaches will become the top
attack vector that results in data loss”
LACK OF VISIBILITY - A BIG PROBLEM
”API Security: What You Need to Do to
Protect Your APIs”,
Gartner, August 2019Copyright ©2019 Ping Identity Corporation. All rights reserved.3

4. Copyright ©2019 Ping Identity Corporation. All rights reserved.
• 45% not confident in ability to detect malicious API access
• 51% not confident in security team’s awareness of all APIs
2018
Growth in Number of APIs
Growth in Number of Attacks
API Security Survey:
Average Time to Detect First Breach
2018 Verizon DBIR
Reactive -> Proactive
RECENT API ATTACKS – MOST ARE UNDETECTED
4

5. 5
• DDoS Protection
• Transport Security
• Rule based Sec.
• OWASP Top 10
• Fraud Detection
• Browser Validation
• Rate Limiting
• Encryption/Signing
Brute Force
Data ExtractionStolen Tokens
Acct. Takeover API DDoS
API TAKE OVER Partner Breach
Partner Abuse
CDNA
DC
WAF Bot
Detection
API
GW
Data Theft
APIs/Data
ATTACK GO THROUGH EXISTING DEFENSES EVERYTIME
Copyright © 2019, Ping Identity Corporation. All rights reserved.
“Organizations are using Web Application Firewalls
(WAF), NextGen WAFs, Bot Detection systems, and
“secured” CDNs … and are still being breached!”
Copyright ©2019 Ping Identity Corporation. All rights reserved.

6. Copyright ©2019 Ping Identity Corporation. All rights reserved.6
• Hacker uses valid account to access app
and API – and is an authenticated user
• Hacker reverse-engineers API logic
• Uses discovered vulnerabilities to access
other accounts
• Takes over accounts and steal data,
photos, private information
• Continues for months
Uses a valid account
Account #1
Account #2
Account #3
Account #4
Account #5
harvest
API TAKE OVER ATTACK – LOOKING LIKE A NORMAL USER

7. App
& UI
User API
Data
Service
Hacker
Tools
API
Data
Service
• Client-side rules and GUI skipped
• Unexpected and untested-for API
abuse scenarios – vulnerabilities
• “Sniffer” on API traffic exchange
• Freedom to poke around and find bugs
and exploits
• Finds way to get to account data
without credentials
Skip
That
Copyright ©2019 Ping Identity Corporation. All rights reserved.7
HACKERS USE YOUR API OUTSIDE OF YOUR APP

8. DATA EXFILTRATION SCENARIO
8 Copyright ©2019 Ping Identity Corporation. All rights reserved.

9. 9 Copyright ©2019 Ping Identity Corporation. All rights reserved.

10. Security Beyond Access Control
Security Beyond WAF
▪ Extending Foundational API security
to protect against cyberattacks on APIs
▪ Security needs beyond existing security:
• Knowing about all APIs
• Identify Pre and Post login attacks
• Login/Identity attack detection
• API-specific DoS/DDoS attacks protection
• Detecting Cyberattacks on data, apps, systems
▪ Need full API activity reporting at scale
API SECURITY TODAY
Access Control and WAF
Tokens, Authentication/Authorization/Attack Signatures
Rate Limiting
Client throttling, quotas
Network Privacy
SSL/TLS
THE MISSING PIECES
Data, Application, System Attacks
APTs, Data Exfiltration, Deletion…etc.
API DoS/DDoS Targeted Attacks
Compromised API Services Access
Login/OAuth/Authentication Attacks
Credential Stuffing, Fuzzing, Stolen Cookies and Tokens
ADDRESSING API SECURITY GAPS WITH AI
Confidential - Do not distribute. Copyright © 2019, Ping Identity Corporation. All rights reserved.10

11. PERSISTING API SECURITY ISSUES
▪ Unexpected and untested
”outside-the-app” scenarios
▪ Bugs and vulnerabilities
▪ Deficit of available expertise
▪ No real-time security focus
▪ Downstream vulnerabilities
▪ Users: phish, password reuse
▪ Clients that can’t keep secrets
▪ Bearer tokens
Foundational API
security blind spots
External
Vulnerabilities
HOW TO MITIGATE THESE
PERSISTENT VULNERABILITIES?
Copyright ©2019 Ping Identity Corporation. All rights reserved.11

12. MITIGATE THESE PERSISTING RISKS BY LEVERAGING AI
TO IDENTIFY GOOD AND BAD TRAFFIC
MODEL
• Learn from API
traffic
• Build model for
legit apps
DETECT
• Inspect runtime traffic
• Look for deviations
from model
BLOCK
• Block compromised
tokens, cookies, …
• Notify / Alert
Copyright ©2019 Ping Identity Corporation. All rights reserved.12

13. 13
IDENTIFYING GOOD AND BAD TRAFFIC
Copyright © 2019, Ping Identity Corporation. All rights reserved.
Authentication
System
API
Disruption
• System “misfiring” and flooding API fabric
due to system misconfiguration or bugBad System
• Partner use of API for unintended purposes
e.g. Cambridge Analytica on FacebookAPI Misuse
• Extraction of customer data against company policy
• Disgruntled employee abuses
Insider Abuse
• Compromise accounts via APIs
• Extraction, injection and other attacksHacker Attack
Copyright ©2019 Ping Identity Corporation. All rights reserved.

14. FRIENDLY FIRE SCENARIO
14 Copyright ©2019 Ping Identity Corporation. All rights reserved.

15. 15 Copyright ©2019 Ping Identity Corporation. All rights reserved.

16. DISCOVERY & VISIBILITY SCENARIO
16 Copyright ©2019 Ping Identity Corporation. All rights reserved.

17. Copyright ©2019 Ping Identity Corporation. All rights reserved.17

18. Sideband Deployment
APIs
Users and
Applications
PingIntelligence
For APIs
PingIntelligence
For APIs
AI-Powered Cyberattacks
Detection
Automated Advanced, Attack Blocking
API Deception / Honeypot
Deep API Traffic Inspection and
Reporting
Deploy via “drop-in”
pre-configured policy
COMPREHENSIVE API SECURITY WITH
Ping Identity AND WSO2
18 Copyright © 2019, Ping Identity Corporation. All rights reserved.

19. Scalable Multi-Cloud API Platform AI-powered Threat Protection for APIs
Data & Application Attacks
Advanced Persistent Threats, Data exfiltration, Deletion
DoS & DDoS Attacks
DDoS API attack, Login service DDoS attack, Botnet attacking API
Login Attacks
Stolen tokens or cookies, Credential stuffing, fuzzing,
Message Security
JSON/XML threat protection, SQL injection, XSS, Schema validation, Encryption
& signature, Redaction, AV scanning
Access Control
Authentication, Authorization, Token Translation
Rate Limiting
Client throttling, Provider throttling, Quotas
Network Privacy
SSL/TLS
PingIntelligence
for APIs
COMPREHENSIVE AI-POWERED SECURITY
Copyright © 2019, Ping Identity Corporation. All rights reserved.19 19

20. ATTACKS AND BLOCKING FACTORS
Detect these:
• Authentication systems attacks
• Data and application attacks
• API DoS/DDoS attacks
• API misuse
• Systems misfiring
• Insider threats
Block by:
• User identity
• Token
• API Key
• Cookie
• IP
Copyright © 2019, Ping Identity Corporation. All rights reserved.2020

21. 21 Copyright ©2019 Ping Identity Corporation. All rights reserved.
VISIBILITY AND SCALING FOR LARGE ENTERPRISE
SINGLE PANE OF GLASS
• Continuous API Auto discovery
• Single or multi-datacenter deployment
• Support mix of API implementations
• API activity across any datacenter
• Centralized AI processing and visibility
• Common models across all sites
• Components can be distributed
• Common Dashboard views
• Centralized or distributed reporting
PingIntelligence
for APIs
API
Gateway
Clusters

22. CONCLUSION – WSO2 AND PING
▪ Faster detection of API breaches
▪ Augments foundational API security
▪ Help sort out good and bad traffic
▪ Identify “abnormal” without static rules
▪ Single pane of glass for all clusters and
datacenter – deep visibility and reporting
Copyright ©2019 Ping Identity Corporation. All rights reserved.22
PingIntelligence for APIs ®
API Discovery Attack Blocking Deep Reporting
APIs APIs APIs

23. Copyright ©2019 Ping Identity Corporation. All rights reserved.
2
3
Award Winning API Cybersecurity

24. YOU CAN’T PROTECT
WHAT YOU CAN’T SEE.
Gain Deeper Insights into API Activity to Reveal
Hidden Traffic and Vulnerabilities.
Take a closer look. Get rewarded.
Learn more & sign up at
www.pingidentity.com/RevealHiddenAPITraffic
Win an Arlo camera!

25. Q&A
Copyright ©2019 Ping Identity Corporation. All rights reserved.25