Module 45: API Security

CCSP Domain 4 — Cloud Application Security Section C 6–8 min read

The CCSP exam treats APIs as the primary attack surface of cloud applications. If you secure nothing else, secure your APIs.

APIs Are the New Perimeter

In cloud-native applications, APIs replace traditional network boundaries as the access control point. Every cloud service is accessed through APIs:

Management plane APIs control cloud resources (create VMs, modify security groups)
Data plane APIs handle application traffic (REST endpoints, GraphQL)
Inter-service APIs connect microservices internally

The exam expects you to understand that API security IS application security in cloud.

If a scenario describes an unauthenticated endpoint exposing customer data, the vulnerability is broken API authentication — not a network security issue.

API Authentication Patterns

The exam tests several authentication mechanisms for APIs:

API keys — simple but limited; identify the calling application, not the user
OAuth 2.0 access tokens — delegated authorization with scoped permissions
JWT (JSON Web Tokens) — self-contained tokens carrying claims; must be validated properly
Mutual TLS — both client and server present certificates; strong for service-to-service
API gateway authentication — centralized auth enforcement at the gateway layer

Exam trap: API keys alone are not sufficient for user-level authorization. They identify the application but do not authenticate the user. The exam will present scenarios where API key-only auth is insufficient.

API Threat Protection

Common API attacks the exam expects you to recognize:

Injection through API parameters — SQL, NoSQL, command injection via query params or request body
Broken Object Level Authorization (BOLA) — accessing other users resources by manipulating object IDs in API calls
Excessive data exposure — APIs returning more data than the client needs
Mass assignment — attackers modifying object properties they should not have access to
Rate limit bypass — overwhelming an API to cause denial of service or brute-force attacks

API Gateway Security

API gateways provide centralized security enforcement:

Authentication and authorization at the gateway reduces per-service implementation burden
Rate limiting and throttling protect backend services from abuse
Request validation ensures payloads conform to expected schemas
Logging and monitoring at the gateway provides comprehensive API audit trails
TLS termination at the gateway simplifies certificate management

The exam may ask about the BEST architectural approach for securing 50 microservice APIs. The answer is an API gateway with centralized security policies, not implementing security individually in each service.