Edgio, a leading content delivery network (CDN) provider, has introduced a new machine learning solution for API security and holistic web application protection. This addition to their range of application security services aims to enhance organizations’ ability to discover and safeguard application programming interfaces (APIs).
Richard Yew, head of network and data center strategy at Edgio, explains that the machine learning algorithms incorporated into the Edgio Security service simplify the process of identifying rogue and zombie APIs. These can often go unnoticed by cybersecurity teams but pose a significant risk to organizations.
The Edgio service supports OpenAPI, a specification language for HTTP APIs, which enables consistent enforcement of encryption and the application of controls like API rate limiting. Currently, Edgio focuses on providing support for REST APIs but plans to expand its support to other formats, such as GraphQL, based on customer demand.
Moreover, Edgio employs a security model centered around API schema validation to ensure that only requests with the appropriate specifications are granted access. This methodology prevents malformed or unexpected data from causing errors or being exploited by cybercriminals, such as in a SQL injection attack. It also filters out malicious API calls to prevent application overload.
Unlike conventional approaches that aim to secure APIs in isolation, Edgio takes a holistic web application and API protection (WAAP) approach. By incorporating this comprehensive strategy into their CDN, Edgio offers organizations managed security services, which relieve them of the burden of safeguarding their applications.
The Edgio CDN boasts over 300 points-of-presence (PoPs), strategically deployed to minimize the distance between applications and their users. This proximity ensures consistent performance levels and aligns with the prevailing industry trend of deploying web applications on external networks for added isolation from cyber threats.
While it remains unclear whether application security is primarily managed by cybersecurity teams or DevOps engineers adopting DevSecOps workflows, Edgio’s platform caters to both. DevSecOps teams can utilize the platform to test and validate API schema changes in production, minimizing the risk of blocking legitimate traffic and reducing mean-time-to-resolution (MTTR). Rule changes can be deployed across the entire network within 60 seconds to counter emerging threats effectively.
As organizations increasingly adopt modern microservices-based cloud-native applications, each with its own unique API, centralized API management becomes imperative. Achieving this requires close collaboration between development teams and cybersecurity professionals who share the collective responsibility for application security. However, the existing cultural divide between these teams remains a significant challenge.
Regardless of the approach taken, organizations must address this issue promptly, as cybercriminals are increasingly targeting vulnerable APIs to extract data that can be held for ransom or sold for profit. Currently, most organizations inadvertently facilitate such attacks by failing to adequately secure their APIs.
In conclusion, with the exponential growth of APIs and the associated risks, Edgio’s introduction of a machine learning solution for API security and holistic web application protection is a significant step forward. By simplifying the process of identifying and securing APIs, Edgio aims to empower organizations to protect their web applications effectively and mitigate the mounting cybersecurity threats they face.
