API Security
VIRTIS provides full protection for APIs: web services and microservices, mobile/native APIs, and more
Endpoint Security Is Vital
Cloud-native and other service-based architectures have many advantages, and many organizations are adopting them. As a result, new restful web services and other API-based services are continually appearing.
At the same time, existing APIs are also growing. DevOps and other modern practices enable the rapid creation and delivery of new features, which often expand the size and complexity of existing APIs. Unfortunately, as APIs evolve, so do their potential attack surfaces. Developers are often preoccupied with rigorous delivery schedules, so it is easy for newly-created vulnerabilities to go unnoticed. Meanwhile, hackers focus on finding opportunities for abuse that the developers hadn’t anticipated.
In this environment, robust API protection is vital.
Traditional Solutions Are Inadequate
Traditional approaches to web security cannot fully protect APIs. For example, headless browser detection plays a large role in identifying hostile bots within website traffic—but for incoming API traffic, there is no browser environment to detect.
Also, many security products (for example, those offered by cloud providers) are designed to defend against volumetric DDoS and other straightforward forms of web attack. These products cannot prevent many forms of API abuse, which can be much more subtle.
Even solutions which do offer some API protection usually lack full implementation of vital features such as schema ingestion. Instead, they require their users to manually create and maintain extensive rulesets; this process is difficult, time-intensive, and error-prone. Similarly, fast-moving CI/CD practices are often hindered by WAF solutions that cannot dynamically adapt to new traffic structures. These solutions require manual retuning each time an API grows or changes.
VIRTIS: Robust Security for API's
Providing you complete protection for microservice/API endpoints.
- A client-side SDK ensures mobile/native application traffic is TLS encrypted and continuously authenticated. All communications include an HMAC signature (a cryptographic identity mechanism on the client side) to harden communications between the application and the endpoint, ensuring that only requests from legitimate users are accepted
- Reverse-engineering prevention stops API attacks in their earliest stages
- Dynamic and adaptive traffic recognition allows VIRTIS to reshape its security posture in response to changes in traffic structure. As an API evolves, VIRTIS creates new rulesets automatically, and administrators can accept, reject, or modify them as needed
- Cloud-native platform includes a full API for programmatic control of VIRTIS itself, enabling IaC and other forms of automation
Deep Experience in Endpoint Protection
VIRTIS’ API defenses extend far beyond common threats such as DDoS and code injection. The platform recognizes and defeats even subtle application-layer attacks, such as data scraping, gift-card and coupon abuse, inventory denial attacks, and more.
Comprehensive Web Security Platform
Along with API security, VIRTIS provides complete protection for sites and web applications as part of its all-in-one solution.
Compliant and Certified Protection
VIRTIS’ clouds are fully compliant with GDPR, SOC 1/SSAE 16/ISAE 3402, FISMA Moderate, PCI DSS, ISO 27001, FIPS 140-2, HIPAA, CSA (Cloud Security Alliance), and other standards and certifications.
VIRTIS is ISO 27001 Certified, AICPA SOC 2 Certified, and is a PCI DSS Certified Level 1 and Level 2 Service Provider.
