API Security & Performance for Gaming

[Music] [Music] come to the stage dan you you've this is a slight change against the program we swapped around um edge gap and cloudflare so you're gonna be talking about api security in performance is that correct perfect where have you come from today uh i'm busy in london okay fair enough although i mean you've got a fair you've got it you've got you've got i thought yeah so stick well this is the final session of the day of the day i'll face it of the first half of the day and um yes take it away fantastic thank you very much um hello everybody uh it's actually yeah also my first talk after a long wait of like presenting from home so very

excited to be face to face um so i i'm daniel multani i'm the product manager for the web application firewall at klaufler for who doesn't know cloudflare we are a security and performance company um think about uh basically a huge or one of the biggest proxies in the world where we basically can speed up application but also secure them through the use of a number of security tools so today i'm going to talk about securing apis so apis of course are the backbone of a web application or mobile application and they're becoming uh ubiquitous i would say in in the world and uh in general on the internet um so let me first quickly go over why apis are special and why we need to secure them in a new in a new way so traditional web application or html uh

type of uh of pages they work by rendering the the uh the page on on a web app which sits on a server right so clients just retrieve the page which is rendered uh on the client side and they show data to the end user um when it comes to api then apis are basically providing data to the client so the the call there is to retrieve data to the web app to uh sorry well the app uh returns the data and interacts with the database this new framework allows a direct access to the database so expose data and there is of course a risk of exposing sensitive data or exposing the working of the application and the reason why this is becoming very crucial is of course traffic volume when it comes to apis which includes of course gaming uh and and all the space the traffic volumes volume is huge it's

becoming larger than the web traffic also uh is often automated uh by by design right so they if you have a mobile app with a game there or any mobile app the traffic does look like an automated traffic and sometimes this becomes difficult to distinguish from from bots or automated malicious traffic um of course also the applications are changing fast there's a high engineering velocity so this makes difficult to protect or to define a security solution that is going to protect your application for forever for long and of course there is there are requirements when it comes to latency and false positives so performance is of course key so we need something that protects um communication by sometimes is fast for for maintaining the gaming experience for example so uh i just wanted to show you one slide on data so cloudflare proxies about 20

a little bit less than 20 percent of the proxied internet traffic so we see a lot of data um and if i looked at the data in the last 10 months uh 54 are apis so a little bit more than one out of two requests http requests are apis and a lot of this of course is driven by uh gaming and gambling but also financial services so they're very very sensitive type of of connections um on the right hand side there is the growth uh traffic uh growth over 10 months and api is the yellow bar is a little bit more than 20 over 10 months that's the the growth that api experienced which is far higher than the other data type like web which is about 10 percent so this again speaks a lot about the importance of securing this type of traffic so there is of course a lot that goes into monitoring protecting apis there is

detection there is giving visibility uh analyzing all the type of type of traffic but today i'm gonna just focus on a very pragmatic approach on how you can secure your application and mitigate potential attacks so when i talk to customers i often show this model this framework let's say how to think about the products you're deploying um thing and the way i urge them to think about is about like an incremental noise removal strategy like a funnel like this one so you have four steps and in these four steps you deploy different products that aim at protecting you from different type of attacks or possible hacks or vulnerabilities the first one is about protecting from volumetric attacks like ddos the second one is about knowing your attack surface area so if you have an

api exposed to your customers to the world then you need to know exactly what endpoints are out there um whether you need to close down some of the endpoints what type of traffic those endpoints get and and things like that the third one is about validating requests so this is about like making sure that the requests you receive or your application received comply with your business logic and there is no malicious payload or any attempt to exploit a vulnerability and finally is about controlling the load that you're putting on your application so making sure that there is no excessive load that you cannot handle let's start from the each one so i'm going i'm going to go over each one and give you an example of things you can deploy uh to protect your uh your your application so the first one is about volumetric protection as i mentioned so ddos is uh is still a problem right and it's

gonna be always a problem for the internet so you have to make sure that you don't compromise performance while um using a network that can sustain large attacks so key things are about avoiding a single point of failure having a global coverage in an uh a pretty enough pretty big network to sustain those attacks but also customize um threshold and protection um and also another very short term or practical strategy uh or tactic is about blocking personal traffic you don't expect data from think about anonymizers like vpns tower nodes proxies why don't block straight away traffic coming from those points if you don't know you know is not going to be a source of good traffic or another thing could be ranges of ip or specific countries so an example of this i can't move on can i oh thank you so um at cafe the way

we solve the problem of ddos attack is to we have a huge network 250 data centers or almost 280 i think in basically spread around the world so we get very close to customers or to end users like less than 50 milliseconds to 95 of the internet so this means that we're very close and we can reduce latency and and guarantee performance right um think about this as a huge uh proxy network so uh your application will sit behind this huge network and then we deploy in every data center we deploy the full stack of cloudflow products like security tools and so those security solutions will run on every request very close to the user right and you don't have to worry about that um about whether that works or not and because the the network is is so is so big and we have a big capacity then we can withstand very huge ddos attack so you'll be

uh you'll solve that problem basically out of the box um but let's double click on what we offer in each one of this server what are the the other tools you can deploy so second uh part of this framework is about protecting your attack surface area so this is about managing uh basically your endpoints having visibility of how many apis are out there and whether um uh you mean to expose those apis so one tool uh that you can use is of course discovery so api discovery is becoming pretty common and popular in the industry and what discovery does is to identify your active endpoints so it looks at your traffic listen to the traffic and basically provides you with a list of end points and the relative volume of traffic for each endpoint um and this gives you confidence that what basically your most uh hit with points um

endpoints are the one uh you uh you you want to be exposed so a typical example of a problem that customers have is older version of apis so perhaps you're running version three of your api and then all of a sudden uh version two is still being hit right and and you don't have visibility on that you didn't know about that um and perhaps you're not you stop maintaining version two um and that becomes and creates a vulnerability right because you're gonna maintain only version three but if version two is still being used that could expose data uh and and business logic that you don't want to um so discovery allows you to get visibility on this part another big big topic is authentication authorization so you want to make sure that your apis are protected you are authenticating and authorizing the right people a couple of options

that we typically see customers adopting are mtls and oauth 2.0 another advice is keep all simple but uniform across your apis another tools you can deploy is account a cover so look for um credentials that have been uh used somewhere else perhaps have been leaked and and are being used to break into your application so there are tools again that you can deploy to make sure that every credential is being used is not part of a um username and password that have been stolen somewhere else on the internet and finally one thing i wanted to mention is that it's not just your application and to be mindful of it's also all the tools that you are using internal tooling if you want also microservices think about the east-west type of traffic so you need to make sure that you're also closing down those tooling because this could be a source of vulnerabilities and

attacks to your company so zero trust of course a possible solution you can deploy let me pick mtls and just quickly tell you how this could help so mutual tls allows you to issue a certificate for your mobile app or a new version of the app or even every instance of the app you embed it in the in the um software bundle that gets installed in an app and then every request you're sending to the this case through our network for example or to your origin then the mutual tls handshake will be performed right so the the mobile device will make sure that the server is the correct one and the server conversely will also make sure that the app is the is the correct one so you can there are like free tools out there that you can use um of course like building a public infrastructure is costly and time consuming so for example this is

something we offer for free to all of our customers so you can simply create a new certificate embed in your application and from day one day one you can secure your traffic uh and gets encrypted and you make sure that the apps are the one that you expect um another area is request validation right so after you have mitigated ddos attacks after you have mitigated or you know that who makes request is is a valid device then those device is going to send requests and you want to validate that every request don't carry any potential attack or perhaps exploiting bugs or just not let's say malformed requests right so there are a couple of options here there is a negative security model and positive security model so these are the two models security talk about um we could go we could go into the details but i guess the high takeaway is like you can deploy

both one the negative security model is what we call the waff web application firewall positive security model is more about defining what you expect in terms of api how the requests are they going to look like you know what good looks like and then you only allow that right so if you have a schema like a swagger or an open api then you can use this file to create this positive security model so you're gonna only accept requests that comply with the schema you've created sometimes you have the schema for free because that comes out through your development process and so you could if you have that you can already like use it in a solution like cloudflare where you can create immediately this positive security model so you make sure to filter only good requests this is an example how it works so a few customers have talked about for example you have an

endpoint like a gift card balance endpoint you pass on the body the card number with a pin and you want to know of course what's your balance and they they are seeing that some are taxes of course the json payload um but they've seen some bots and some attacks they send uh the payload which is not formatted as expected so for example in the bottom side you'll see the body doesn't include like fields you you need so with schema validation you can exactly filter out the request at the bottom so the requests that don't have for example the card number and the pin field in their in their body last one is about controlling load of requests and making sure you're not overloading your application and your your server so here rate limiting is usually the product that everybody deploys however the traditionally limiting tends to count requests coming from the

individual from a single ip so the way with limiting works is like i want to meet or to make sure that the user individual user thenx doesn't exceed a number of requests per mill for example you only allowed 10 requests per minute okay the problem we're seeing is that the ip which was the way to distinguish individual users is becoming meaningless nowadays and especially with apis so a way to to mitigate attacks or to count requests in the in the api world is to count on a session id a user id or a query parameter for example in this case you are counting things regardless of the ip of origin so if someone is authenticated as a session id then you account 10 requests that are coming only from this specific session id this is very effective because of course you're bypassing the issues with ips that ips are rotated bots my share or have different ips so

there's an effective way to really focus on the sessions and making sure that each session is performing a number of requests that you're allowing quota management is another aspect of this is this is more like long term you're saying in a month my customer can only make perform 10 000 requests and that's also another way to really keep that volume of request in check and finally logging and monitoring is also a very useful tool when it comes to security and this is something of course you you it would be better to have in place this is an example of how um weight limiting works a common use case is for example for gaming are like bots that uh try to abuse loyalty or credit points right they just go out and try to probe endpoints um and and look for credits that they can use so this is an example of a possible endpoint to check

um credit loyalty points so in this case you're passing an account in the query and you have a session uh in in in the cookie so what we are seeing is that sometimes bots are sharing different ips they have the same session id but the requests come from different ips and so what you can do here is count request on that session id and then you limit the number of requests or if you want of this botnet can perform to break into that specific endpoint and of course you could also count on the account so any part of the request could be used to mitigate this this level of request okay i think i'm the end last slide so just a couple of final words so apis if you're using apis then please please consider security um this is uh is growing the number of attacks we're seeing to apis is growing uh the sophistication as well is growing and

the majority of the internet traffic is becoming apis so consider tools that are specifically designed for this type of traffic and to avoid attacks there there is no let's say one size fits all what we recommend is to use like a multi-layered approach so different tools uh deployed a different level of granularity to prevent different type of attacks and finally whatever you deploy of course depends on what you need on on the specific application the infrastructure you're using and things like that so if you want to know more we are as i think both g11 so you can come and we can have a chat and we can tell you more awesome thank you so much ah does anybody have a quick question any final any questions in there i think it's quite a it's it's very technical i know it's but it's interesting this this track not just you i i stress you're you're actually a

little nicer so it's it's quite hard to absorbing information again it's uh it's a new experience for us we've all been at home um what's the one you said there's a few things that if i'm a you know smaller developer medium what is the one absolute thing you should take away and use from your service what is the absolute thing everyone's doing you talking about apis is that the thing that we should be aware of at the moment i think the one thing you need to take away is like if you have a a small app you're developing something make sure you are adopting a solution that that uh secure that solution so for example of course for cloudflare we have different plans even like a free plan yeah so it's something you can just join you get in and you get out of the box you get a lot of protection um and so you can kind of like focus on developing your application without having to think about or worry about security okay brilliant well thank you so much and do check out cloudflare's they're both upstairs

[Music] [Music] you