BR +55 11 3069 3925 | USA +1 469 620 7643

  • BLOG
  • Português
  • BR +55 11 3069 3925 | USA +1 469 620 7643
  • Português
logo senhasegura
  • SOLUTIONS
  • PRODUCTS
  • SERVICES AND SUPPORT
  • PARTNERS
  • COMPANY
  • CONTACT
  • DEMO

Compliance

and Audit

Audit

PCI DSS

SOX

ISO 27001

HIPAA

NIST

GDPR

ISA 62443 |

Industry 4.0

Security and

Risk Management

Privilege Abuse

Third Party Access

Privileged Access Recording

Insider Threat

Data Theft Prevention

Hardcoded Passwords

Password Reset

Solutions

By Industry

Energy and Utilities

Financial

Government

Health Care

Legal

Telecoms

Retail

senhasegura

Testimonials

See Testimonials

360º Privilege Platform

Account and

Session

PAM Core

Domum

Remote Access

MySafe

GO Endpoint

Manager

GO Endpoint

Manager Windows

GO Endpoint

Manager Linux

DevOps Secret

Manager

DevOps Secret

Manager

Multi

Cloud

Cloud IAM

Cloud Entitlements

Certificate

Manager

Certificate

Manager

Privileged

Infrastructure

PAM Crypto Appliance

PAM Load Balancer

Delivery : On Cloud (SaaS) | On-premises | Hybrid

Services

and Support

Documentation

Solution Center

Suggestions

Training and Certification

Deployment and Consulting

PAMaturity

PAM 360º

Support Policy

senhasegura

Resources

Rich Materials

Customer Cases

Webinars Calendar

senhasegura Stickers

BLOG

CONTENT

Is your company really prepared for a cyber attack?

The Pillars of Information Security

7 signs that your company needs to improve the security of sensitive data

See more articles about cybersecurity

Technical

Information

How it works

Product Archicture

Integration

Security

High availability and contingency

Privileged Auditing (Configuration)

Privileged Change Audit

Features and

Functionalities

ITSM Integration

Behavior Analysis

Threat Analysis

Privileged Information Protection

Scan Discovery

Task Management

Session Management (PSM)

Application Identity (AAPM)

SSH Key Management

Affinity Partner

Program

About the Program

Become a Partner

MSSP Affinity Partner Program

Security Alliance Program

Academy | E-learning for Certification

Affinity

Portal

Portal dedicated only for Partners to find commercial, marketing supporting materials and certification program of senhasegura.

Access Partner Portal

Opportunity

Booking

For our Commercial Team to support your sale more effectively, request your opportunity booking here.

Opportunity Booking Request

Find a

Partner

We work together to offer a better solution for your company.

Check all senhasegura partners

About

Company

About us

Achievements

Why senhasegura

Press Release

Press Room

Events

Career

Presence in the World

Terms of Use

End User License Agreement (EULA)

Privacy and Cookie Policy

Information Security Policy

Certification at senhasegura

senhasegura

Testimonials

See Testimonials

Latest Reports

and Awards

KuppingerCole Leadership Compass Report for PAM 2023

Frost & Sullivan Customer Value Leadership Award 2022

Gartner PAM Magic Quadrant 2021 Report

KuppingerCole Leadership Compass: PAM 2021

GigaOm Radar Report 2021

Gartner PAM Magic Quadrant 2020

Gartner Critical Capabilities for PAM 2020

Information Services Group, Inc. (ISG)

KuppingerCole Leadership Compass: PAM 2020

Contact our team

Request a Demonstration

API Keys: Do You Know What Is?

by senhasegura Blog Team | Nov 4, 2019 | BLOG

Controlling access and ensuring the security of employee and customer data has been one of the biggest security challenges faced by organizations today, and this is intensified when sensitive information and assets are stored where access identifiers are not protected. 

Configuring and granting access in cloud environments, for example, has given even the most experienced system administrators a headache. Recently, Imperva, which provides Web Application Firewall (WAF) services – a system that stays between the application server and the internet, protecting against attacks such as SQL Injections, DDoS, and others – gave details on its blog about a security incident that has occurred through the theft of an AWS API key and lead to data being extracted from its customers. 

But before talking further on the subject, we need to know some definitions about API keys.

What are API Keys?

First, APIs are instructional codes for an application that allow other software to develop products by adapting the original features to the ways in which their services can be used. 

Facebook, Google, Twitter, and other services provide documentation so that their APIs can be used in various applications. As an example, we can mention that when an application offers authentication through a Google account, such application has used a Google API to implement this feature in its code. 

Both Google and other API providers use keys to identify and track requests and thus measure how well the application uses their services.

API keys are the access credentials that authorize the use of API-specific features and help prevent their misuse by identifying its permission and sharing necessary data, so the server can block abnormal requests made in association with that API Key.

It is important to mention that the keys identify the application calling the functions and not the user using them. Therefore, they cannot restrict users, but requests, environments, applications, and IPs. 

Although there is a possibility of restricting their use, API keys are assets that should be kept secure, as they have no expiration and can be used by anyone who knows them, which becomes a more serious problem when these keys are used to access environments in which critical data is stored. 

API Key Storage

Today, many organizations already know the benefits of using the cloud, store data and a lot of sensitive information in this environment, but they use standard or basic configurations that these services offer. In other contexts, they even perform security settings correctly, but when credentials such as accounts, keys, tokens, and other items used to access and handle these environments are not protected, the occurrence of an incident is almost certain. 

In the case of AWS – Amazon Cloud Computing Services Platform – access control and keys are integrated into its security. However, many service keys have already been exposed in public repositories or given to developers to expedite task execution, but this is not recommended. 

The incident that occurred with Imperva, according to its Chief Technology Officer Kunal Anand, was due to access from an internal instance where the AWS API Key was stored. The chief officer described the decisions that led to the leak:

API keys, in most scenarios, are not the kingdom-wide access keys, but they open the way to the crown jewels. Unfortunately, this valuable item is handled without proper care or relevance, being stored in places accessible to anyone, when instead it should be managed, tracked, protected, and moderately used. 

How to Protect API Keys

Protecting any asset in an organization is not a simple task. Some controls, however robust they can be, require additional measures to be effective. 

In order to ensure the minimum security of your API Keys, some measures are important:

  • Do not put keys in configuration files on the system as they can be found easily. 
  • Each integration must have its own key. 
  • Just like credentials and passwords, keys should be changed from time to time, because in case they are compromised, they will be valid for a short time. 
  • Eliminate keys that are no longer needed to shrink the attack surface. 
  • Label each key to know which ones work in each application. A key inventory is a good measure. 
  • API keys should not be emailed so there is no risk of being intercepted. 
  • Monitor the use of the API for immediate key change when a misuse or abnormal use occurs or is observed. 

These and other measures can be taken through a PAM solution, which aims to manage privileged access by using a set of technologies and practices to monitor and manage access to critical data. 

A PAM solution can assist in the creation and execution of an access workflow consisting of the request and approval to use the key, as well as requiring authentication for viewing and using the key, preventing an unauthorized user from exploiting it. 

As much as API providers make security settings available, organizations should not remain exempt from the responsibility of doing their job to ensure that access and use of assets are done correctly and authentically. In this context, a PAM solution becomes even more necessary when it is up to the organization, not the API provider, to rotate, grant, and revoke the use of keys. 

Protecting any kind of access credentials is the foundation for any strategy aimed at securing sensitive information and assets. If accounts, passwords, and keys are not preserved, later controls will not be as effective as they should. It is the implementation of security controls on credentials that will be responsible for reducing the chances of an incident. 

REFERENCES

ANAND, Kunal. Security Incident Update. Oct 10, 2019. Available at: https://www.imperva.com/blog/ceoblog/https://www.imperva.com/blog/ceoblog/. Accessed on: Oct 25, 2019.

← Machine Identity part 2 - Certificates So, what does Privileged Access Management mean? →

senhasegura wins CyberSecured 2022 award as best PAM solution in the USA

Written by Priscilla Silva SÃO PAULO, February 28 of 2023 - The 2022 edition of the CyberSecured awards, promoted by Security Today magazine, a brand of 1105 Media's Infrastructure Solutions Group, elected senhasegura as the winner in the Privileged Access Management...
Read More

senhasegura introduces the “Jiu-JitCISO” concept to show the power of Brazilian cybersecurity

Written by Priscilla Silva São Paulo, January 13, 2023 - "Like Jiu-Jitsu senhasegura is about self-defense. Every company must know how to protect itself and its clients". This is the aim based on the philosophy of the Japanese martial art, but made popular and...
Read More

CISA and FBI Release ESXiArgs Ransomware Recovery Script

The US Cyber Security and Infrastructure Agency (CISA) and the Federal Bureau of Investigation (FBI) released this week a recovery guide for the ESXiArgs ransomware, which has harmed thousands of companies globally. This was because malicious attackers were allegedly...
Read More

2023 KuppingerCole Leadership Compass: senhasegura is a PAM leader for the second year in a row

Written by Ina Schindler and Priscilla Silva São Paulo, January 30, 2023 - The Privileged Access Management (PAM) solution senhasegura achieves a top position in the "Leadership Compass 2023". The report is produced by the renowned IT analyst firm KuppingerCole to...
Read More

International Data Privacy Day: Why Is This Date Important?

On January 28, we celebrate the International Day for the Protection of Personal Data, or Data Privacy Day. This date leads us to reflect on the importance of laws that safeguard the correct processing of private information in the most diverse countries. Data Privacy...
Read More
Copyright 2023 senhasegura | All Rights Reserved | Powered by MT4 Group