Web Application and API Protection Capabilities Checklist

AKAMAI CLOUD SECURITY SOLUTIONS: CHECKLIST
Web Application and API Protection

Capabilities Checklist
Deploying a web application and API security solution while planning, implementing, or optimizing your
information security strategy will provide your organization with the ability to understand your unique risks,
target security gaps, and detect threats. You need a web application and API protection (WAAP) solution
that provides continuous visibility with comprehensive insights, and the full capability to identify and stop
the most sophisticated attacks.
This checklist can be used to assess vendor capabilities or as a list of requirements needed to implement
an effective WAAP solution.
CATEGORY 1: PLATFORM REQUIREMENTS

Organizations come in all shapes and sizes with varying degrees of requirements. Your web
application security solution should be flexible, scalable, and easy to administer.
Scalability to match traffic demands and Network layer [L3/4] distributed denial-
provide continuous protection without of-service (DDoS) mitigation with a zero-
loss of performance second service-level agreement
Architecture that can overcome the Visibility into who is attacking, the frequency
challenges of geographically of attacks, and the severity of attacks with
dispersed applications crowd-sourced attack intelligence across
the platform
Audit log capabilities to ensure

proper usage Reverse proxy with web traffic via ports
80 and 443
Protection of on-premises, private, or

public cloud (including multi-cloud or Network privacy protections with
hybrid-cloud) site origins SSL/TLS encryption
1
Web Application and API Protection Capabilities Checklist
CATEGORY 2: ADAPTIVE WEB APPLICATION AND

DDoS PROTECTION
Your web application security must go beyond traditional signature-based detection to more
advanced forms of adaptive web application and DDoS protection for the most accurate and
reliable security outcomes.
Detection beyond signature-based Fully managed WAF rules to eliminate

attacks with anomaly and risk- the need for continuous configuration
based scoring and updates
Machine learning, data mining, and Client reputation scoring and

heuristics-driven detection capabilities intelligence for both individual
to identify rapidly evolving threats and shared IP addresses
Automatic web application firewall Custom rules to quickly protect

(WAF) rule updates with continuous against specific traffic patterns
real-time threat intelligence from (virtual patching)
security researchers
Request rate limits to protect against

Ability to test new or updated WAF automated or excessive bot traffic
rules against live traffic before
deploying to production
Protection from direct-to-origin
targeted attacks
Protection (at a minimum) against SQL
injection, XSS, file inclusion, command
IP/Geography controls via multiple
injection, SSRF, SSI, and XXE
network lists to block or allow
traffic from specific IP, subnet, or
Fully customizable predefined rules to geographic areas
meet specific customer requirements
Protection from automated clients,

Protection from application layer [L7] such as vulnerability scanning and
volumetric DoS attacks designed to web attack tools
overwhelm web servers with recursive
application activity
2
CATEGORY 3: API VISIBILITY, PROTECTION, AND CONTROL

API protections have become a critical part of web application security. You need a WAAP
solution with robust API discovery, protection, and control capabilities to mitigate API
vulnerabilities and reduce your surface area of risk.
Automatic discovery and profiling Rate controls (throttling) for API endpoints
of unknown and/or changing APIs based on API key
(including API endpoints,
characteristics, and definitions)
API network lists (allowlists/blocklists)
based on IP/Geography
Automatic inspection of XML
and JSON requests to detect
API lifecycle management
API-based attacks
with versioning
Custom API inspection rules to meet

Secure authentication and authorization
specific user requirements
via JSON Web Token (JWT) validation
Ability to predefine acceptable XML

Definition of allowed API requests
and JSON object formats that restrict
by key (quota for each key defined
the size, type, and depth of API requests
independently) for full control over
consumption
Protection of API back-end infrastructures
from low and slow attacks designed
API onboarding using standard
to exhaust resources (e.g., Slow Post,
API definitions (Swagger/OAS
Slow Get)
and RAML)
Real-time alerts, reporting, and

dashboards at the API level
3
CATEGORY 4: FLEXIBLE MANAGEMENT

You need simple and automated workflows to maximize your investment and improve
operational efficiencies. Whether protecting new or changing applications, adopting new WAF
rules, or extending protections to APIs, the process must be seamless and intuitive.
Open APIs and the CLI to integrate Real-time dashboards, reporting, and
security configuration tasks into heuristics-driven alerting capabilities
CI/CD processes
Centralized user interface (UI) to access

Integration with on-premises and cloud- detailed attack telemetry and analyze
based security information and event security events
management (SIEM) applications
Flexibility to manage WAAP via

Full staging environment and the ability high-touch controls and/or fully
to implement change control automated protections
Self-tuning security protections that Fully managed security services to offload

automatically adapt to your traffic or augment your security management,
monitoring, and threat mitigation
The Akamai Intelligent Edge Platform gleans insight from millions of web application attacks,
billions of bot requests, and trillions of API requests every single day. This level of insight,
coupled with advanced machine learning and threat research, allows us to constantly improve,
catch new threats, and develop innovative capabilities.
Akamai’s web application and API security solutions will secure your organization against the
most advanced forms of web application, DDoS, and API-based attacks. Contact us today to
learn more about our WAAP solutions and to schedule a demonstration.
Akamai secures and delivers digital experiences for the world’s largest companies. Akamai’s intelligent edge platform surrounds
everything, from the enterprise to the cloud, so customers and their businesses can be fast, smart, and secure. Top brands globally rely
on Akamai to help them realize competitive advantage through agile solutions that extend the power of their multicloud architectures.
Akamai keeps decisions, apps, and experiences closer to users than anyone — and attacks and threats far away. Akamai’s portfolio of
edge security, web and mobile performance, enterprise access, and video delivery solutions is supported by unmatched customer
service, analytics, and 24/7/365 monitoring. To learn why the world’s top brands trust Akamai, visit akamai.com, blogs.akamai.com, or
@Akamai on Twitter. You can find our global contact information at akamai.com/locations. Published 11/20.

Web Application and API Protection Capabilities Checklist

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Web Application and API Protection Capabilities Checklist

Uploaded by

Copyright:

Available Formats

AKAMAI CLOUD SECURITY SOLUTIONS: CHECKLIST