Web app and API vulnerabilities, and how to secure them with Azure and Fortinet

In this guest blog post, Srija Reddy Allam, Cloud Security Architect at Fortinet, explains the utility and vulnerabilities of APIs in modern businesses and how to secure them with Fortinet solutions.

Applications and application programming interfaces (APIs) have become an essential part of modern business. Whether you use your phone, visit a website, or interact with an application, APIs are doing the work behind the scenes. Despite their importance, these applications and APIs are also extremely vulnerable, posing a potential threat to business operations. ForbesIn 2023, hackers accessed the health information of more than 41 million people from U.S. hospitals and doctors’ offices through API data transmitted to healthcare services.

In today’s rapidly evolving cybersecurity environment, modern enterprises often face numerous challenges when it comes to securing their APIs and web applications. Let’s look at a common scenario that illustrates these challenges.

Consider Acme Corp, a fictional e-commerce company. The company operates a popular online marketplace where customers can browse and purchase a variety of technology products. Acme relies heavily on web applications to provide a seamless shopping experience for its users, with APIs facilitating communication between the various components of the system. Now imagine that Acme Corp’s website experiences a surge in traffic during a highly anticipated flash sale event. Knowing of the increased activity, cybercriminals can launch coordinated attacks aimed at exploiting vulnerabilities in the API and web applications, potentially leading to data breaches, unauthorized access, or service outages, as well as zero-day exploits. As cyber threats evolve, attackers can leverage previously unknown vulnerabilities to bypass existing security measures and compromise the integrity of web properties.

Authentication and authorization mechanisms play a critical role in securing APIs and web applications. Without a strong identity verification process, companies are at risk of unauthorized access to their systems, potentially leading to data theft or manipulation.

Insufficient monitoring poses another challenge. Without real-time visibility into API traffic, shadow APIs, and web application activity, companies may struggle to quickly detect and respond to security incidents. This lack of monitoring can leave attackers exposed to cyber threats for extended periods of time by exploiting undetected vulnerabilities.

Finally, changes to web apps and APIs add another layer of complexity to Acme Corp’s security efforts. As the company introduces new features or updates its APIs to address vulnerabilities, it is important to ensure continuous learning about parameters and APIs and provide updated security without disrupting operations.

To address these challenges, enterprises are leveraging web application firewalls (WAFs) with API security measures as the first line of defense against cyber threats. FortiWeb WAF protects against common vulnerabilities such as injection attacks, cross-site scripting, zero-day threats, and API security, ensuring the integrity of web properties and mitigating the risk of data breaches or service disruptions.

As a Cloud Security Architect at Fortinet, I will explain the challenges, capabilities, and most widely adopted architectures for securing web applications and APIs.

Fortinet and Microsoft Azure solve these key challenges.

It is important to protect your applications with web application and API firewalls. Fortinet FortiWeb Subscriptions (Cloud/SaaS and VM offerings) from Microsoft Azure Marketplace come with a 14-day free trial and help address and mitigate the challenges mentioned above.

Key features of FortiWeb Cloud include:

1. Web Application Security

• Known signature databases: FortiWeb Cloud integrates a powerful database of known signatures from FortiGuard Labs to defend against established threats. This database is used to expertly identify malicious messages within HTTP requests to web servers. It also extends protection to protect sensitive information with features such as file protection, information leak prevention, and cookie security. It provides better exposure management through continuous monitoring, signatures, threat intelligence integration, and regular penetration testing.
• Anomaly Detection with Machine Learning (ML): To stop zero-day and sophisticated threats, FortiWeb Cloud uses ML-based anomaly detection. The system continuously learns to distinguish between malicious behavior and standard client behavior, providing proactive protection against new threats.
• Bot mitigation: To protect your website and APIs from automated attacks, the Bot Mitigation module provides comprehensive capabilities for identifying bots, including biometrics and suspicious traffic pattern analysis. ML-based bot identification capabilities enhance protection against malicious activity by detecting unusual user behavior, such as an unusual amount of HTTP requests or TCP connections.

2. API Security

• Schema-based security: FortiWeb Cloud provides versatility by adapting seamlessly to various API structures, including OpenAPI/Swagger framework, JSON or XML/SOAP formats. It provides schema-based validation to prevent vulnerabilities such as API-based security misconfiguration and SQL injection attacks.
• ML-based API search: The presence of undocumented (shadow) APIs poses a significant threat to applications. FortiWeb Cloud addresses this by providing ML-based API discovery and anomaly detection to ensure protection of undocumented API endpoints. It learns REST API data endpoints from user traffic to provide schema security and analyzes parameter patterns in API requests to enhance threat protection.
• API Gateway: FortiWeb Cloud’s API Gateway feature provides access management capabilities to efficiently manage API users. It facilitates API key generation and verification, implements rate limiting, and precisely controls user access.

3. Logging and Threat Analysis

• FortiWeb Cloud provides a comprehensive threat management system, providing a detailed threat list for all applications and in-depth attack information for troubleshooting and analysis. Traffic logs can be exported in real time to Azure Blob Storage for long-term storage, facilitating continuous monitoring, analysis, and alerting.
• Threat analytics, a unique benefit offered by FortiWeb Cloud, uses ML algorithms to identify attack patterns across your application environment. These patterns are aggregated into security incidents and assigned severity levels. For SOC teams, this feature helps provide a security posture by distinguishing between real threats and informational alerts and false positives in the SecOps lifecycle, allowing you to focus on the security issues that matter most.

Recommended Azure Architecture

The recommended architecture below ensures strong security for a variety of workloads and applications. Azure Deployment ScenariosIncludes virtual machines (VMs), serverless apps/app services, Azure API Management (APIM Service), and Azure Kubernetes Service (AKS). Leveraging FortiWeb Cloud provides front-line defense against web-based threats. FortiWeb seamlessly integrates with Azure Front Door (CDN) to reduce latency of application traffic and provide advanced security. Azure Load Balancer optimizes performance and health checks while FortiGate Instances are deployed as Azure Network Virtual Appliances and act as next-generation firewalls (NGFWs) to enforce security policies. Workloads from different virtual networks (VNETs) are strategically peered to dedicated security VNETs to streamline traffic through the NGFW, providing comprehensive protection. This architecture provides a versatile and scalable security solution that ensures application resiliency across a variety of Azure deployment models.

Figure 1. Fortinet’s recommended architecture to ensure robust security for workloads and applications.

FortiWeb Cloud emerges as a powerful solution by addressing Azure challenges such as scalability, seamless integration with Azure native services, blocking attacks before the cloud perimeter, security posture, and visibility. With globally distributed caching centers, FortiWeb Cloud helps reduce latency and extend the reach of your applications to users around the world. FortiWeb Cloud seamlessly integrates with key Azure services such as AKS, APIM, App Services, and Front Door to enhance security for your applications without making significant changes to your existing infrastructure. The DevSecOps lifecycle can benefit by integrating FortiWeb Cloud’s threat intelligence to reduce alert fatigue, and SOC teams can benefit by improving cloud posture and visibility. All of these capabilities are delivered as a hosted and managed Software as a Service (SaaS) and seamlessly integrate with Fortinet’s Security Fabric to provide a strong layer of protection for your Azure cloud infrastructure.