Forum Discussion

jerm1020_254086's avatar
jerm1020_254086
Icon for Nimbostratus rankNimbostratus
Aug 24, 2016

API architecture vulnerability

my web dev team is bringing up concerns about the openness of our API architecture from a Security perspective. I am struggling with the spend and effort associated with implementing an API Manager. The concern is that when we go live with our e commerce platform we will have 150 API’s that are open. To control those we will need to leverage iRules on the F5.

 

does anyone have a position on how high our risk exposure is and if using the F5 is a feasible approach to API protection at this state.

 

api
application delivery
ASM Advanced WAF
irule
iRules
security

4 Replies

Sort By
  • ekaleido's avatar
    ekaleido
    Icon for Cirrus rankCirrus
    Aug 24, 2016

    How do you want to limit access to these APIs? By IP? Usernames? More details and we can provide a better answer.

     

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Aug 24, 2016

    IP based protection is easier. You can just block access to https.

     

  • ekaleido's avatar
    ekaleido
    Icon for Cirrus rankCirrus
    Aug 24, 2016

    IP based can be done either by specifying a source in the VIP or by applying a relatively simple iRule that references an IP datagroup. Usernames wouldn't really protect you, the more I think about it, and there are lots of iRule examples for creating "IP whitelists."