liveBook · Manning

Zombie api

As explained in Secure APIs

A zombie API is a deprecated or forgotten API that is no longer maintained but remains exposed and accessible.

A zombie API is a deprecated API or API version that nobody retired. It remains exposed on the internet even though it is no longer maintained. section 3.5 section 3.7

Zombie APIs are a form of API sprawl. Because they receive little or no maintenance, they tend to be less protected; when hackers discover them, data breaches can result. section 3.5

Reduce zombie API exposure by:

  • Maintaining an API catalog so teams can discover published APIs and identify versions that should be retired. section 3.7
  • Applying security checks throughout the software development lifecycle, including before release and when tests fail. section 3.7

How Secure APIs covers it

How deep it goes
Defines zombie APIs, distinguishes them from shadow and ghost APIs, and outlines cataloging, observation, and lifecycle controls.
Examples
Uses figures showing API-sprawl breach risk and traffic inspection for undocumented attack-surface discovery.
What you can do after
Diagnose undocumented attack surfaces with API observability tools and track exposed versions through API catalogs.
How it connects
Connects zombie APIs with API sprawl, API catalogs, API observability, shadow APIs, ghost APIs, and software development lifecycle security.
Cover of Secure APIs
liveBookmanning.com
Read Secure APIs on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.