best practices for detecting and mitigating against insecure APIs in cloud environments:

Use a _: Embed this as part of your development

process

secure development life cycle

Authentication and authorization:

Enforce who can access the API.

Input validation:

Check and validate what strings and/or data can be inserted

into the API.

Application layer attacks:

Detect and mitigate attacks such as injection attacks,

cross-site scripting, and so on.

code reviews

Conduct _ for all your APIs.

data in transit

Encrypt _ by default for all APIs.

Sign, cryptographic key

_ each message through the API using a _ to avoid data tampering or changes to data integrity.

web application firewall (WAF)

Use a _ to protect against well-known application-layer attacks.

Use _services to protect the API service from denial-of-service attacks.

distributed denial of service (DDoS) protection

Use an _ to protect the service against SOAP or REST API-based attacks.

XML gateway

rate limit

Enforce a _ on the API to decrease the chance of automated attacks.

HTTP methods

Limit the type of _ to the minimum required (for example, GET

without POST or DELETE).

Audit

_ the use of exposed APIs and the backend systems to detect anomalous

behavior (such as brute force attacks or data exfiltration).

schema validation

Perform _ at the server side to make sure only well-known field sizes, characters, or regular expressions can pass through the API.