Protecting Business Critical APIs with Proactive Visibility
APIs provide a critical connective tissue between software components and the organizations that rely on them to exchange data necessary to serve customers via both web and mobile apps. In the case or organizations that surface customer-specific or inventory data with financial or travel aggregators, those APIs must be publicly exposed.
But increased public exposure means APIs are now an attack vector threat actors seek to exploit. Financial organizations, for example, rely on APIs to enforce authentication, yet attackers can access those API keys if the network is exposed at any point of transmission.
Proactive Visibility into API Discovery and Attack Attempts
Signal Sciences customer Finn AI uses natural language processing (NLP) to provide conversational AI technology to their customers: banks and financial institutions leverage Finn AI’s technology so their customers can manage personal finances with simple conversations, either through voice or text-based interactions.
Without a client-side frontend, the attack surface Finn AI must monitor is relatively small.
But Finn AI’s Engineering team needed proactive visibility into API discovery and attack attempts to deliver malicious payloads against them. They also wanted the ability to stop unusual activity against those same APIs that enable customers to use their natural language processing technology. They sought API protection with a next-gen WAF and RASP offering that would install easily and scale effectively while being light on resources, along with protection against OWASP Top 10 and zero-day exploit attempts.
“Signal Sciences provides us with the ability to peer behind the curtain, allowing us to see what’s happening at the application layer,” says Robin Monks, Finn AI Director of Engineering. “When our customers deployed penetration clients to test Finn AI for compliance validation, they weren’t able to get any of their penetration tests past Signal Sciences while it was enabled.”
During SOC 2 compliance penetration testing, Monk says, the Finn AI team could detect that testers were using endpoint scanners, with additional information relative to those attempts available in the data Signal Sciences surfaced.
Building Security Resilience and Solidifying Security Posture
Aside from their core goal of securing their APIs, Finn AI realized other benefits with an automated application layer security offering like Signal Sciences:
“When we talk to financial institutions and they tell us they use hardware firewalls we recommend Signal Sciences,” Monk says. “They need that level of protection and we are very confident in the operational efficacy of Signal Sciences.”
Read the Finn AI case study to learn more about proactive API security.
Originally published at https://labs.signalsciences.com.
