The Logging And Monitoring Challenge (with Anuprita Patankar)

Summary

The script depicts an API security 'chef' discussing critical yet overlooked logging and monitoring practices, likening them to ingredients and seasoning that enhance API security. They examine various metrics to spot anomalies and patterns indicative of attacks. Logs provide traceability serving accountability. Though threats evolve, best practices help APIs stay resilient. Proper authentication and authorization mechanisms restrict access, enabling zero trust. Just as ingredients combine into recipes, multiple security strategies intertwine for robust protection.

Takeaways

• 😃 Logging and monitoring plays an important role in API security and performance
• 😮 Logging too much or too little data are common mistakes organizations make
• 😊 Knowing what data to log helps meet compliance and audit requirements
• 🤔 Monitoring helps discover forgotten or unused APIs that may be vulnerable
• 🙂 Proper authentication and authorization helps control access to sensitive data
• 🌟 Following zero trust model restricts third party access to internal systems
• 🧂 Interlinking different security concepts creates robust protection
• 😊 Vigilant logging and monitoring boosts cyber resilience
• 🔒 Secure code and vigilant strategies serve up secure digital experiences
• 📝 Regularly reviewing security issues ensures APIs stay protected

Q & A

What analogy does the speaker use to describe the process of selecting metrics to measure for API management?

The speaker compares selecting the right metrics to measure to a chef choosing the best ingredients when putting together a recipe.

What are some examples of metrics the speaker suggests tracking for API management?

Examples include failed authentication attempts, rate of successful logins, API response times, HTTP status codes, invalid input rates, error responses, data exfiltration attempts, rate limiting violations, API key usage patterns, access control violations, and API endpoint activity.

Why does the speaker emphasize the importance of logging details like time, date, and source of API calls?

Detailed logging creates a "digital breadcrumb trail" to trace unexpected behaviors or issues back to their source for troubleshooting and accountability.

How can collected metrics be used to improve API security?

Metrics can be used to create alerts for suspicious activity, establish baselines for normal behavior to identify anomalies, fine-tune service delivery, watch for traffic spikes that may indicate attacks, and more.

What does the speaker compare meticulously detailed logs to in terms of presentation?

The speaker compares detailed logs to food presentation, saying they should be "garnished with all the necessary details" to enable traceability and accountability.

Why does the speaker say that API security is like an endless buffet?

The threats landscape and best practices are continually evolving, so organizations must stay current on new developments to keep their APIs secure.

What expertise does the guest speaker, Anita, have regarding API security?

Anita is introduced as a subject matter expert in product and API security.

What does Anita identify as one of the most common mistakes organizations make regarding logging?

Logging too much or too little data. Organizations need to know what specific information to log to meet compliance needs without capturing excess sensitive data.

Why does Anita emphasize the importance of monitoring forgotten or deprecated APIs?

These abandoned endpoints often lack up-to-date security controls, making them vulnerable to attacks if left unmonitored.

What authentication approach does Anita recommend to control API access?

Anita recommends OAuth and JSON Web Tokens to implement role-based access control over API endpoints.

Outlines

00:00

🧑‍🍳 Explaining the importance of logging and monitoring for API security

The first paragraph explains how logging and monitoring are critical for API security, using a metaphor of a chef selecting ingredients. It states key metrics to measure like failed logins, response times, HTTP codes, input errors etc. Additional monitoring includes data exfiltration attempts, rate limiting violations, API key usage patterns and endpoint activity.

05:01

🌶️ Spicing up security with comprehensive logging practices

The second paragraph continues the cooking analogy, explaining logging of API call details like time, location, source etc. It then covers using logs proactively to set alerts for suspicious activity, establish normal behavior, meet service standards, and identify potential attacks. It emphasizes that logs enable accountability, traceability and evolving security.

Keywords

💡logging

Logging refers to capturing important data about API activity, requests, errors etc. Proper logging enables monitoring, auditing and investigation of issues. The script emphasizes logging key metrics like failed logins, response times etc. to understand API performance and security.

💡monitoring

Monitoring means tracking API activity and metrics over time to detect anomalies, incidents or degradation. The script discusses using logs and metrics to set up monitoring for things like spikes in traffic, failed authentications etc.

💡authentication

Authentication verifies the identity of API users and enables access control. The script recommends robust authentication using protocols like OAuth and JSON Web Tokens to restrict access to sensitive data and implement zero trust security.

💡authorization

Authorization determines what permissions and access an authenticated user has. Combined with authentication, it allows granular access control to API resources based on policies.

💡API security

API security refers to the practices and controls for protecting APIs from threats and unauthorized access. The script provides tips on API security like logging, monitoring, authentication, TLS, etc.

💡compliance

Compliance means adhering to policies, regulations and standards. Appropriate logging meets compliance needs for auditing. The script mentions logging to fulfill compliance requirements.

💡forensics

Forensics refers to gathering digital evidence and investigating a security incident or breach. Robust API logs provide crucial forensics data to analyze attacks and trace issues.

💡TLS

TLS (Transport Layer Security) is an encryption protocol to secure communications and data in transit. Though not explicitly mentioned, the script recommends TLS to prevent data exfiltration.

💡outlier detection

Outlier detection means identifying anomalies deviating from normal behavior. The script discusses using monitoring and metrics to detect outliers like spikes in traffic that indicate attacks.

💡access control

Access control governs which users can access which resources, based on identity, roles, etc. The scripts talks about using OAuth and JWT tokens to implement access control policies.

Highlights

Logging and monitoring plays an extremely important role in API management and secure SDLC

Logging too much or too little data are common mistakes organizations make

Knowing exactly what to log helps meet compliance and audit requirements and aids investigations

Using monitoring to discover forgotten or zombie APIs susceptible to attacks

Gaining customer trust through proper logging and monitoring is key to business success

Having proper authentication and authorization on sensitive APIs is an underutilized best practice

OpenID and JWT tokens can define access control to APIs based on zero trust model

Restricting third party access to internal systems through tokens improves security

Intertwining authentication, authorization and access control concepts strengthens security

Vigilant monitoring helps create cyber resilient APIs

Robust logging and monitoring strategies serve up secure digital experiences

Subscribe to see more API security issues explained

Keep code clean and APIs secure

Ingredients are secure code, spices are vigilance, final dish is resilient APIs

Stay hungry for security knowledge and up-to-date on best practices

Transcripts

welcome back to API kitchen where we

cook up secure API I'm confident stely

your Chef the cuisine in this unique

kitchen today we're diving into a

critical but often overlooked area of

API management logging and monitoring

think of it as the seasoning that brings

out the best in our API dishes so let's

get cooking step one sifting through

Matrix our recipe starts by selecting

the finest Matrix to measure picture a

chef choosing the best ingredients

that's what we do in our API kitchen we

look for failed authentication attempts

the rate of successful logins the

zestiness of our API response times the

mix of HTTP status codes the dash of

invalid input rates and the pinch of

error responses but we don't stop there

we also measure data exfiltration

attempts rate limiting violations API

key usage pattern Access Control

violation security token usage and API

endpoint activity step two cooking with

logs every Chef keeps a log book and so

do we but ours logs more than just

recipes we track the when with recipe

date and time stance and where of each

API call and The Who Behind every

request we're making a digital bread

crumb Trail to trace any unexpected

flavors back to their Source step three

see reing with security objectives now

let's sprinkle in some security

objectives we are not just collecting

Matrix for the sake of it we're using

them to whip up alert for suspicious

authentication activity to tear our way

to identifying normal user behavior and

anomalies that we seim down our service

delivery to a perfectly timed response

and roast out any potential attacks that

come with sudden spikes in traffic we

are basting our API guys with proactive

vigilance those HTTP status codes like

401 403 and

500 I tell you they are not just numbers

they are smoke signals warning us of

potential security fires step four

presentation is everything in the

kitchen presentation is everything and

in a digital kitchen it's no different

our logs are meticulously garnished with

all the necessary details ensuring that

we can serve up accountability and

traceability on a silver platter but

this is a meal That Never Ends the world

of API security is a buffet of evolving

threats and new recipes for protection

our mission is to stay hungry for

knowledge and fist on the latest

security best practices our guests will

be joining us today at the virtual

kitchen so let's go hear what they have

to say about fixing this security issue

is a product and API security subject

matter expert and she will be answering

and just discussing with me about very

strong issues around logging and

monitoring welcome Anita thank you

confidence I'm excited to be part of

this session thank you so much we we

cook secure API here you ready in the

API

kitchen great okay so my first question

is how significant do you believe loggin

and monitoring are in API management

based on your experience and I'd like

you to please describe some of the most

typical mistakes that businesses make

when it comes to API login and

monitoring mm yeah for sure so I believe

logging and monitoring plays an

extremely important uh role in API

management as well as in Secure sdlc uh

because it not only focuses on the

security aspect of it but also the with

with the performance and availability

aspect of the apis uh which are crucial

to gain customers trust and in the

success of most businesses and talking

about the most typical mistakes uh that

businesses make is number one logging

too much or too little so most

organizations are unaware of the

importance of logs and end up logging

everything including the sensitive data

and the pii or sometimes logged

information is too little that the log

are not useful in any way and knowing

exactly what to log helps in meeting

compliance and audit requirements as

well as help in forensic investigations

and um at the time of uh security

incidents it is similar as to having a

right amount of ingredients to to make a

perfect recipe and the second part is

that not using monitoring mechanism to

discover forgotten or zombie IPS so most

of the zombie IPS are always deprecated

or never documented IPS which are highly

susceptible to cyber attacks due to the

lack of security features configured on

it it should be an organization's atmost

priority to monitor these end points uh

for abnormal API usage and log any

suspicious activity which could be an

attack that's such a comprehensive

response and I absolutely loved how you

tied in properly to even just gaining

trust because that's the fundamental

element right just gaining trust and and

that's what helps business and that's

how security does enable the business

because when you gain trust uh your

customers feel better about your product

and then you get more customers or you

retain those you already have so thank

you so much for making that relationship

my last question is um what is one on

utilized API security best practice

something that you consider the salt of

the earth

a basic yet effective factor that can

greatly improve an organization security

posture yeah so the one API security bre

best practice uh that is still

underutilized in many organizations is

having a proper authentication and

authorization and uh on the apis that

involves sensitive data or endpoints

that require proper

authentication and for this uh

organizations can use oo open ID and jot

tokens which are also known as Json web

tokens uh to Define access control and

determine which users or devices or even

roles um can access specific endpoints

by following the zero trust security

model uh this also helps in restricting

third party access to internal systems

and though these all these concepts are

are different but they help to build a

proper security if they are intertwined

together just add a just like adding a

like many different uh ingredients and

spices together to make a perfect recipe

thank you so much for joining us today

at the virtual kitchen remember chefs in

the API kitchen our ingredients are

secure code our spices are Vigilant and

our final dish is cyber resilient apis

keep your API Pantry stoed with these

robust logging and monitoring strategies

and you'll be serving up secure digital

experiences with confidence and that's

how you secure an API in our kitchen in

the coming episodes we'll be discussing

even more API security issues and

working you through how to solve them

remember to subscribe to C TV and hit

that notification Bell so you won't miss

out on new episodes of API Kain showing

each

Thursday until then keep your kitchen

clean your code cleaner and your apis

secure