API Security Fundamentals

Before diving into specific protocols like OAuth or JWT, it is essential to understand the foundational principles that govern secure systems. API security does not exist in a vacuum; it relies on the classic pillars of information security, often referred to as the CIA Triad.

The CIA Triad

Confidentiality: Ensuring that data is accessed only by authorized parties.

Example: A banking API ensures that User A cannot see User B's account balance.

Integrity: Ensuring that data is reliable and accurate, and has not been altered by unauthorized people.

Example: Ensuring that a transfer request of

100 i s n^{'} t c han g e d t o

1000 in transit.

Availability: Ensuring that data and services are available to those who need them when they need them.

Example: Implementing rate limiting to prevent a botnet from crashing your API.

Key Security Principles

1. Principle of Least Privilege

Every module, user, or interface should only have access to the information and resources that are necessary for its legitimate purpose.

API Context: If a mobile app only needs to read a user's profile, the API token issued to it should not have write permissions.

2. Defense in Depth

Security should be layered. Do not rely on a single control (like a firewall) to protect your API.

Layers:

Network: WAF (Web Application Firewall), DDoS protection.

Gateway: Rate limiting, IP whitelisting.

Application: Input validation, proper authentication logic.

Data: Encryption at rest.

3. Zero Trust Architecture

"Never trust, always verify." exist on the premise that threats may be both outside and inside the network.

API Context: Just because a request comes from an internal microservice doesn't mean it should be inherently trusted. It must still include a valid authentication token.

4. Security by Design

Security should be integrated into the API design phase, not added right before deployment.

Using secure defaults (e.g., denying access unless explicitly granted).

Validating all inputs against a strict schema (e.g., OpenAPI definitions).

Key Takeaways

CIA Triad: Confidentiality, Integrity, and Availability are the goals.

Least Privilege: Give the minimum necessary access.

Zero Trust: Authenticate every request, even internal ones.

Validation: Never trust client input; validate it against your schema.

Next Step: The most common confusion in security is between "Who you are" and "What you can do". Let's clear that up in Authentication vs Authorization.

API Security Fundamentals

The CIA Triad#

Key Security Principles#

1. Principle of Least Privilege#

2. Defense in Depth#

3. Zero Trust Architecture#

4. Security by Design#