The best way to secure a public API might be to make it unreachable

It’s a completely counterintuitive concept, but that’s the thesis of API Gateway Security: A Zero Trust Approach, an article we just refreshed on the NetFoundry blog. Read the article here: https://netfoundry.io/devops/api-gateway-security/ It’s written by Tod Burtchell, Associate Director Service Planning & Development in Management & Operations Platform (long title, dude!), whom I had the pleasure of meeting at a planning meeting last week. Most API security spend goes into inspecting inbound traffic (WAFs, rate limiting, an API gateway parked out front), and all of it inspects traffic that has already arrived at your infrastructure. The exploit is already inside the door even before the door can do anything. The general gist of the article leans on NetFoundry CEO Galeal Zino’s earlier article, Squaring the Circle: How to Make Public APIs Private, where he describes APIs as “snowflakes”. They’re snowflakes in the sense that they’re always changing, and each change quietly opens a…