Shield right protects APIs after release by emphasizing operational defenses such as configuration, secrets management, rate limiting, versioning, logging, monitoring, and threat detection. It complements earlier security work by addressing risks that emerge in deployed systems. section 1.1
Apply the approach as a practical security loop:
- Identify attack vectors, including API input parameters. section 1.1
- Model the threats and consider their possible consequences. section 1.1
- Harden the API with measures that prevent or mitigate the attacks. section 1.1
Figure 1.2 To secure our APIs, first, we identify attack vectors, such as the API input parameters. Then, we model the possible threats. Finally, we harden our API by applying measures that prevent or mitigate those attacks.
A visual workflow connects attack-vector identification, threat modeling, and API hardening. section 1.1
