Agile Transformation | Product Management
How to achieve Ultimate Agility? 
Paul Takken 03 May, 2016
Share 
In the podcast on platforms and products that we recently published, Kiran Madhunapantula, the COO of coMakeIT, emphasized the need for collaborative innovation. He reiterated that product and platform makers should realize that innovations can stem from outside their entity and should build platforms that can make it possible. Such collaborations extend the features of a product or a platform and can help it reach a wider consumer base. This is possible only by exposing APIs for others to use and extend them.
Though exposing APIs is necessary to build on existing innovations and further their usage, it makes the systems and services vulnerable to security threats. So, why are API Gateways used at all? And how should we implement them to make our products and platforms more secure?
Here are some reasons why we can’t discount API Gateways.
- Centralized Management: API Gateways act as a centralized point of management for all API traffic, making it easier for organizations to monitor, control, and secure access to their APIs.
- Scalability: API Gateways can handle large amounts of traffic, making them well-suited for organizations that need to scale their APIs to accommodate a growing number of users.
- Performance: API Gateways can improve the performance of APIs by caching frequently-used data and handling load balancing.
- Flexibility: API Gateways provide a level of flexibility, as they can be integrated with a variety of different systems and services.
- Compliance: Some industries have specific regulations, like HIPAA, PCI-DSS and GDPR, that organizations need to comply with. API gateways can help organizations in these industries to comply with these regulations by providing a secure way to handle sensitive data.
Beware.. implementing insecure API Gateways can be detrimental.
In 2017, an insecure API Gateway was the cause of a terrible security breach at an American Credit Bureau, Equifax. Hackers exploited a vulnerability in the company’s API Gateway, which was caused by a failure to properly patch the software. The vulnerability allowed the attackers to gain access to the sensitive personal information of 143 million customers, including Social Security numbers, birth dates, and addresses. The incident resulted in significant financial losses for Equifax, as well as damage to the company’s reputation. The company also faced multiple investigations and lawsuits as a result of the breach.
Are API Gateways the real culprit?
The sad story of Equifax should compel us to take security seriously. However, it needn’t stop us from using API Gateways to build bridges between various products or platforms for user convenience.
There are several examples of companies that could thwart security threats by building secure API Gateways. In fact, with appropriate care, API Gateways can provide an additional layer of security by implementing features such as authentication, authorization, and encryption. One solution to this problem is to use a Web Application Firewall (WAF) in front of the API Gateway to protect against common web-based attacks.
Also, API Gateways must never make all the connected systems vulnerable by being ‘a single point of failure’. It is important to design the API Gateway with redundancy and failover mechanisms, such as having multiple servers or connections, preferably in multiple geographic locations, so that if one fails, the others can take over to keep the service running.
As products and platforms scale up, API Gateways employed by them receive more requests. To effectively deal with traffic bursts and latency issues, it is important to balance loads across the resources and use horizontal scaling, where new servers are added to the system as needed, rather than relying on a single, highly powered server.
Hence, it is evident that implementing API Gateways need careful thought and deep knowledge of product and platform engineering.
How do we, at coMakeIT, build secure products and platforms for our customers?
- Secure Coding Practices: We ensure that any API Gateway is developed using secure coding practices, such as input validation, output encoding, and error handling.
- Authentication and Authorization: We implement authentication and authorization mechanisms to ensure that only authorized users and systems can access the API Gateway.
- Patch Management: We regularly patch the API Gateway software to protect against known vulnerabilities.
- Logging and Monitoring: We implement logging and monitoring to detect and respond to security threats in real time.
- Encryption: We use encryption to protect sensitive data in transit and at rest.
- Penetration testing: Our testing strategy includes regular penetration testing to identify potential vulnerabilities and weaknesses in the API Gateway.
- Compliance: We make sure that our deliverables comply with industry standards and regulations set by regulatory authorities.
- Security Training: We make sure that our developers receive regular security training to ensure they are aware of the latest security threats and best practices. As technologies change fast, they may carry new loopholes that need updated strategies to fill.
- Incident Response: Before the delivery, we make an appropriate incident response plan to help our customers respond quickly and effectively to any security breaches.
In a NutShell
API Gateways can perform a variety of functions such as authentication, rate-limiting, caching, logging, and monitoring. They also allow exposure of multiple microservices as a single API, which makes it easier for external parties to consume and communicate with the services.
However, API Gateways if not implemented with care can make your systems and services quite vulnerable to security attacks. Insecure API Gateways were found to be the reason for some of the previous security breaches that leaked huge amounts of confidential data endangering not just the company but many stakeholders and users too.
When choosing a product engineering partner, it is hence very important to choose someone with vast experience and knowledge of the latest security standards, someone who can uphold the integrity of your business and the dignity of your customers. coMakeIT carries with it more than a decade long experience of building secure software products and platforms for business from various domains and across the globe. For more information on building secure software products and platforms.
The author was a java Developer at coMakeIT before turning into a stay-at-home-mom. She slowed down to make art, tell stories, read books on fiction, philosophy, science, art-history, write about science, parenting, and observe technology trends. She loves to write and aspires to write simple and understandable articles someday like Yuval Noah Harari. We are very happy to have her back at coMakeIT and contribute to our relevant and thought provoking content.
