Akamai has souped up its security portfolio with a raft of new features in a rather incoherent announcement that homes in on large scale threats to service providers, notably DDoS (Distributed Denial of Service) and web attacks such as SQL injection. As the world’s largest CDN vendor, Akamai is naturally well placed to defend against many of these threats that operate at long range across the internet, as well as to collect data on them.
More recently though Akamai has set out its stall more as an all-round cyber security player by paying closer attention to threats inside its customers’ networks, not just those perpetrated by insiders but also malware and viruses that have penetrated firewalls, intrusion detection systems or other perimeter defenses.
These come under the banner of Zero Trust Security (ZTS), with the aim being to detect, isolate and, where possible, eradicate threats wherever they arise, through a multilayered approach. ZTS really just means ubiquitous security, with one of Akamai’s goals here being to stop malware propagation after it has beaten initial defenses and penetrated deeply inside an enterprise network. This requires more granular access controls linked to specific applications, combined with techniques that make it harder for malware to propagate, or for an attacker to gain access to other corporate systems beyond the one targeted.
Under the same ZDS banner, Akamai has brought out tools to help prevent exfiltration of internal data, which has been the cause of various damaging breaches where confidential customer details have been. The impact of such breaches through phishing attacks on, and identity theft from, the consumers whose data was originally stolen can roll on for several years. Akamai has countered with new adaptive access control tools designed to match trust with risk as the latter varies, the key being able to assess when the level of threat has temporarily increased. Then controls can be enforced only when necessary so as to minimize impact on the user experience, although under ZDS the default is to deny access and only ease restrictions when it is clear there are no threats.
What struck us most though about the Akamai announcements was the focus on attacks against APIs, which have grown rapidly in frequency with proliferation of apps themselves, driven by mobile services. For dedicated streaming vendors, APIs have been a major focus from the outset as they provide the front door to their ecosystem of microservices, which tend to come under three categories.
First are the upfront and back office services, such as free trials, sign-up and billing. Second are content discovery services including recommendations and search, while thirdly comes playback, where rights are enforced and security comes in.
The extent to which service providers had come to rely on their API layer between customer facing apps and these microservices was hammered home in 2016 when Netflix decided to bite the bullet and totally rebuild its one from scratch. It had concluded the old API layer was no longer fulfilling the role it was designed for, which was to allow rapid innovation at the front end through app development while at the same time enabling agility through microservices and DevOps methods integrating development and operations at the back.
Before the app era, online services tended to be built out from the customer front end in large custom software development projects, which made maintenance harder and retarded further innovation both at the client and back end. For this reason, the amount of traffic associated with APIs has grown enormously. Akamai’s own analysis of traffic on its Intelligent Edge platform confirms this, with over 80% of it now either XML or JSON API, both generated by APIs.
The API era has though opened doors for hackers as well as for apps. It has not engendered new threats as such, but it has created new openings for existing ones, including DDoS and Man-in-the-Middle attacks.
APIs, as opposed to the apps they serve, are not directly visible to clients and this has lured some developers into assuming this means they are somewhat shielded from attack as well. As a result, they have focused security efforts on the client side, while forgetting APIs are still directly exposed to attack because HTTP based methods are still used by client apps to retrieve and manipulate resources in the network. This means typical web application vulnerabilities still apply to API requests, which is why APIs are exposed to the same sort of attacks. Furthermore, because by necessity APIs are open and well documented, attackers are given a helping hand on the way.
The techniques differ in detail of course, so that for example DDoS attacks can be invoked by making an excessive number of API calls to an application server. Then data can be stolen via conventional Man-in-the-Middle attacks by intercepting API transactions to reveal, or possibly alter, confidential information.
There have also been proven vulnerabilities in the authentication and authorization systems employed with APIs, even if these have sometimes just been exposed by security researchers rather than exploited by hackers. Authentication is supposed to confirm identity of users or client devices, while authorization is designed to confine their actions after they have been let in to permitted domains, or subject to given rules.
One of the most famous exposures came in 2016 when researchers found that the API through which users accessed a variety of features in the Nissan Leaf electric car could be hacked because it was not authenticating properly. The app was using the so-called VIN numbers uniquely identifying vehicles, inscribed somewhere on the chassis, rather than usernames and passwords.
Akamai has addressed API threats through both negative and positive security models, which are known to be much more effective combined than either on its own. In the negative security model, Akamai compares API parameters against blacklisted content to filter malformed or malicious requests directed at the API server. This model currently applies security rules to mitigate attacks such as SQL (Structured Query Language) injection, where rogue SQL requests are made against a database to tamper with data or even gain some access to it.
Then the positive model checks whether API parameters conform to expected values and here there is scope for machine learning to tune the system to recognize what is “normal”, allowing some room for outliers. Put simply, the negative model defines what is not allowed, avoiding false positives, while the positive model ordains what is allowed, reducing false negatives. According to Akamai, its enhanced API protection features add automation by default so that security staff are only presented with cases after preliminary analysis has ruled out many false positives.
Then back on the DDoS front, Akamai’s other significant advance comes under the title Automated Attack Groups, which is actually a defensive shield incorporating a more intelligent approach to detection of developing DDoS attacks by analyzing their traffic at the CDN level. The key is to identify such attacks early and update the list of automated attack groups almost instantly, aiming to eradicate the associated data packet storms before they reach their target. Admittedly we have heard such claims before and it remains to be seen how much more effective these automated attack groups prove than existing methods.