Shadow API
Shadow APIs are Application Programming Interfaces (APIs) that exist within an organization but are not adequately documented, managed, or authorized by the central IT or security teams. Individual developers or teams often create them without following the organization's standard API governance processes.
Here's a breakdown of the key characteristics and risks:
Undocumented and Unknown: The most defining characteristic of shadow APIs is that they lack proper documentation and are often unknown to the organization's central authorities. This makes it challenging to track their existence, purpose, and security posture.
Lack of Governance: Shadow APIs typically bypass the organization's standard API governance processes. This means they may not adhere to security policies, coding standards, or best practices.
Unauthorized Access: Due to the lack of proper authorization and authentication mechanisms, shadow APIs may be vulnerable to unauthorized access. This can allow attackers to access sensitive data or perform unauthorized actions.
Security Vulnerabilities: Shadow APIs may contain security vulnerabilities due to the absence of security testing or code reviews. Attackers can exploit these vulnerabilities to compromise the API and its underlying systems.
Data Leakage: Shadow APIs may handle sensitive data without proper data protection measures, increasing the risk of data leakage.
Compliance Issues: Shadow APIs may not comply with relevant regulations and standards, leading to compliance issues for the organization.
Version Control Problems: Shadow APIs may not be properly versioned, making it difficult to maintain and update them securely.
Orphaned and Unmaintained: Shadow APIs may become orphaned and unmaintained, increasing the risk of security vulnerabilities and service disruptions.
Shadow APIs pose a significant security risk because they operate outside the organization's control, making them difficult to secure and manage. They increase the attack surface and create blind spots for security teams.
ThreatNG's capabilities are well-suited to detect, assess, and manage the risks associated with Shadow APIs:
External Discovery: ThreatNG's strength lies in its ability to perform external, unauthenticated discovery. This is crucial for identifying Shadow APIs, which, by definition, are often undocumented and unknown to central IT. ThreatNG can discover APIs that developers have deployed without authorization or proper registration.
External Assessment: ThreatNG's assessment features provide valuable insights into the security posture of discovered APIs, including Shadow APIs:
Web Application Hijack Susceptibility: ThreatNG can assess the web applications related to APIs, identifying vulnerabilities that could be exploited to gain access to Shadow APIs.
Example: ThreatNG finds an XSS vulnerability in a legacy web application that a Shadow API uses for authentication, highlighting a potential attack vector.
Subdomain Takeover Susceptibility: If Shadow APIs are deployed on subdomains (which is common), ThreatNG can assess the risk of subdomain takeovers, which could allow attackers to intercept API traffic or host malicious APIs.
Example: ThreatNG detects a dangling CNAME record for a subdomain where a Shadow API is hosted, indicating a high risk of takeover.
Cyber Risk Exposure: ThreatNG analyzes various factors, including certificates, subdomain headers, vulnerabilities, and exposed ports, to provide a comprehensive view of the cyber risk associated with discovered APIs, including Shadow APIs.
Code Secret Exposure: ThreatNG's ability to discover exposed secrets in code repositories is critical. Shadow APIs are often developed quickly, and developers might inadvertently expose API keys or credentials in code.
Example: ThreatNG identifies an exposed API key for a Shadow API in a public GitHub repository, enabling unauthorized access.
Reporting: ThreatNG delivers reports that provide clear information on discovered APIs and their associated risks. These reports help security teams understand the extent of Shadow API proliferation and prioritize remediation efforts.
Example: ThreatNG generates a report listing all discovered APIs, highlighting those that are undocumented (likely Shadow APIs) and their associated vulnerabilities.
Continuous Monitoring: ThreatNG's continuous monitoring of the external attack surface ensures that any new or changed Shadow APIs are quickly detected. This is essential because Shadow APIs can appear or change without notice.
Investigation Modules: ThreatNG's investigation modules provide detailed information to help security teams analyze and assess the risks posed by Shadow APIs:
Domain Intelligence: This module provides insights into the organization's domain infrastructure, DNS records, and subdomains, enabling a deeper understanding of the context surrounding Shadow API deployments.
Example: ThreatNG's Domain Intelligence module reveals that a Shadow API is hosted on a server with other known vulnerabilities, increasing the overall risk.
Sensitive Code Exposure: This module discovers exposed code repositories and sensitive information, directly addressing the risk of exposed credentials for Shadow APIs.
Example: ThreatNG identifies a configuration file in a code repository that contains credentials for a Shadow API, allowing security teams to revoke those credentials.
Search Engine Exploitation: This module helps identify information exposed via search engines, which can sometimes reveal the existence or documentation of Shadow APIs.
Example: ThreatNG discovers a publicly accessible directory containing documentation for an internal API that is not officially recognized, indicating a Shadow API.
Cloud and SaaS Exposure: This module identifies cloud services and SaaS implementations that may be relevant if Shadow APIs interact with or utilize these services.
Example: ThreatNG detects a Shadow API that uses an unsanctioned cloud storage service, raising concerns about data governance and security.
Intelligence Repositories: ThreatNG's intelligence repositories contain data on vulnerabilities, compromised credentials, and other threats, enhancing its ability to assess the risks associated with Shadow APIs.
Example: ThreatNG's vulnerability database helps identify known vulnerabilities in the technologies used by Shadow APIs.
ThreatNG Working with Complementary Solutions
While the document doesn't explicitly detail integrations, ThreatNG's capabilities can complement other security tools in managing Shadow APIs:
SIEM (Security Information and Event Management): ThreatNG's findings on Shadow APIs can be fed into a SIEM to provide a comprehensive view of security events and risks.
API Gateways: If Shadow APIs can be brought under management, ThreatNG's vulnerability assessments can inform the configuration of API gateways to enforce security policies.
Vulnerability Management Systems: ThreatNG's vulnerability data related to Shadow APIs can be integrated into vulnerability management systems to facilitate effective remediation tracking.
ThreatNG is a valuable solution for discovering, assessing, and mitigating the risks associated with Shadow APIs. Its external discovery, assessment, and continuous monitoring capabilities are particularly well-suited to address the challenges posed by these unmanaged APIs.
