Welcome!

@DevOpsSummit Authors: Yeshim Deniz, Elizabeth White, Zakia Bouachraoui, Pat Romanski, Liz McMillan

Related Topics: @DevOpsSummit, Microservices Expo, Containers Expo Blog, FinTech Journal, @ThingsExpo

@DevOpsSummit: Blog Feed Post

API Security in REST vs SOAP By @PaulSBruce | @DevOpsSummit #DevOps #Microservices

Web application and API security is paramount to digital exchanges in the connected world

API Security in REST vs SOAP

By Paul Bruce

Web application and API security is paramount to digital exchanges in the connected world: the balance transfer you just made from your bank's mobile app, those notes your doctor just entered in during your check-up, the password you just sent over SMS;  they all need to be secure, and they all use APIs to transfer over the internet. And your API better be secure.

Securing Your API - What To Do

There are standards for making sure the information is safe in transit (SSL) and when stored (PCI, SOC, ISO), but where are the standards around the surface area that APIs represent? We want to expose our data, but not the wrong data and never to the wrong people. APIs are now part of our front-line defense layer and we need to treat it with the same concern and specificity as we do any other security risk.

Two types of APIs dominate the landscape: SOAP and REST web services. SOAP, while implemented widely in the enterprise, is ceding ground to the modern REST pattern for web services. Both expose data over HTTP requests and responses, but use vastly different formats and semantics to do so, and therefore have different security considerations you should pay attention to.

Over the years, SOAP has added extensions to deal with transactional messaging specific security considerations. SOAP has been around long enough and has been adopted by large enterprises such that it benefits from OASIS and W3C recommendations. Mainly, XML-Encryption, XML-Signature, and SAML tokens help to tighten up the security story over the data being received by and sent from a SOAP service.

REST on the other hand does not implement any specific security patterns, mainly because the pattern focuses on how to deliver and consume data, not how to build in safety into the way you exchange data. Proper amounts of security in code, deployment, and transmission should be determined by those implementing REST architecture patterns, not presumed as something that comes out-of-box.

This doesn't stop agencies like the NSA from doing just that, coming up with their own security practices over building and consuming data from RESTful services. And so should you, but you're not alone in this.

The New Standard of API Security

We at SmartBear have been in the API space for a decade, learning from our customers and community, teaching and training people to be successful with their APIs, and we know why security is often overlooked or under-prioritized. The problem is time. It takes time to be a security expert, and it takes confidence to stand up and say that something you're about to ship is unsafe. But we must.

API security testing has been a part of the SmartBear quality strategy for years, implemented as security tests within SoapUI, and now part of the Ready! API platform covers both SOAP security and REST security. But what are some differences between testing the security of a REST service and a traditional SOAP web service?

It comes down to semantics and format, since the transfer protocol (HTTP) is the same between the two models. A few specific examples of things that traditional security auditing doesn't cover:

  • SOAP expects a request payload (XML envelope), so let's try to exploit that trait with massive improperly formatted data, or even a massive amount of data in one request
  • SOAP infers that an XPath parser is on the back-end, so let's try to use some bad XPath to inject known exploits for common XPath libraries
  • REST relies heavily on the HTTP method to route and process endpoint requests, but what happens if we use the wrong HTTP method on a URI? Does the server expose error details, does it take longer to handle the exception, does it allow the operation when it shouldn't?
  • REST is often combined with JSON formatted messages, which just like XML, maintain a specific document/object structure. What happens if that format is broken?
  • REST, when using JSON, expects properly typed data, so what happens if you use incorrect data (like a string where a number should be)? Does it have proper server-side data validation, and what kind of error details are exposed when improper details are presented to the service?
  • REST and OAuth are kind of natural pals, but what if there are weak semantics in OAuth?

Are these specific exploits in any standard (like OWASP)? Is it fair to expect compliance bodies to keep up with the world of APIs? Do we have the luxury of not keeping up with security compliance over APIs?

The answer to all of these questions is "no." In reality, you are ultimately responsible for providing safe APIs. But don't be too worried, we've been thinking about this problem for a while. SmartBear's Secure Pro tool in the Ready! API Platform provides specific REST and SOAP security tests out-of-box. That means you can run detailed security checks right along in your existing continuous delivery process without expert knowledge in the security space.

In the end, we want you to ship accurate, safe, and scalable APIs. SoapUI NG Pro is the API industry's #1 open source based functional testing tool, and in the same Ready! API platform you can find professional security testing for REST and SOAP web services with Secure Pro. Try it yourself to see how safe your APIs are today!

Read the original blog entry...

More Stories By SmartBear Blog

As the leader in software quality tools for the connected world, SmartBear supports more than two million software professionals and over 25,000 organizations in 90 countries that use its products to build and deliver the world’s greatest applications. With today’s applications deploying on mobile, Web, desktop, Internet of Things (IoT) or even embedded computing platforms, the connected nature of these applications through public and private APIs presents a unique set of challenges for developers, testers and operations teams. SmartBear's software quality tools assist with code review, functional and load testing, API readiness as well as performance monitoring of these modern applications.

@DevOpsSummit Stories
Today most companies are adopting or evaluating container technology - Docker in particular - to speed up application deployment, drive down cost, ease management and make application delivery more flexible overall. As with most new architectures, this dream takes significant work to become a reality. Even when you do get your application componentized enough and packaged properly, there are still challenges for DevOps teams to making the shift to continuous delivery and achieving that reduction in cost and increase in speed. Sometimes in order to reduce complexity teams compromise features or change requirements
GCP Marketplace is based on a multi-cloud and hybrid-first philosophy, focused on giving Google Cloud partners and enterprise customers flexibility without lock-in. It also helps customers innovate by easily adopting new technologies from ISV partners, such as commercial Kubernetes applications, and allows companies to oversee the full lifecycle of a solution, from discovery through management.
Skeuomorphism usually means retaining existing design cues in something new that doesn’t actually need them. However, the concept of skeuomorphism can be thought of as relating more broadly to applying existing patterns to new technologies that, in fact, cry out for new approaches. In his session at DevOps Summit, Gordon Haff, Senior Cloud Strategy Marketing and Evangelism Manager at Red Hat, discussed why containers should be paired with new architectural practices such as microservices rather than mimicking legacy server virtualization workflows and architectures.
Using serverless computing has a number of obvious benefits over traditional application infrastructure - you pay only for what you use, scale up or down immediately to match supply with demand, and avoid operating any server infrastructure at all. However, implementing maintainable and scalable applications using serverless computing services like AWS Lambda poses a number of challenges. The absence of long-lived, user-managed servers means that states cannot be maintained by the service. Longer function invocation times (referred to as cold starts) become very important to track, because they impact the response time of the service and will impose additional cost. Additionally, the transition to smaller individual components (much like breaking a monolithic application into microservices) results in a simpler deployment model, but makes the system as a whole increasingly complex.
In 2014, Amazon announced a new form of compute called Lambda. We didn't know it at the time, but this represented a fundamental shift in what we expect from cloud computing. Now, all of the major cloud computing vendors want to take part in this disruptive technology. In his session at 20th Cloud Expo, John Jelinek IV, a web developer at Linux Academy, will discuss why major players like AWS, Microsoft Azure, IBM Bluemix, and Google Cloud Platform are all trying to sidestep VMs and containers with heavy investments in serverless computing, when most of the industry has its eyes on Docker and containers.