Loose AWS API keys: what's your real risk?

97% of enterprise leaders consider a well-executed API strategy critical in driving their organization's growth and protecting revenue streams, yet according to a recent study, 84% of security professionals reported API security incidents over the past year.

In March, a GitHub breach exposed nearly 13 million API secrets that users had left in the repository over time, severely impacting customer trust and causing reputational damage. Since that time, GitHub has launched its own in-app DLP to help developers deal with the problem. However, this issue is not a GitHub problem. Secrets sprawl is an issue across all the SaaS locations employees work. Let's explore.

Understanding API Keys

What are API keys?

An (application programming interface (API) key is a unique alphanumeric string used to identify or authenticate an application or user that is making API requests. Think of an API key as a bossy robot connecting two software interfaces. The API, itself, governs the relationship between the software on either end of the hall, dictating how they interact and make / receive requests. The key's role is essentially API access.

How API keys are used in AWS

Simply put, AWS API keys give you access to your organization's cloud environment. According to AWS documentation, API keys are used in the following ways by their platform:

• Access control:
  API keys are provided to clients for authentication purposes, otherwise known as access keys. By controlling who gets a key, they can govern who can and cannot access a given API, as well as what actions they can perform once they access it. Essentially, it acts as an access key.
• Usage tracking:
  AWS uses API keys as a unique identifier for client accounts, helping them track and monitor how much a client is using an API. This allows them to adjust usage limits for API calls as needed.
• Integration with other security mechanisms:
  While API keys provide basic authentication, they can also be used to connect with additional security measures for more robust access control.

Risks of Exposed API Keys

Unauthorized Access to Valuable Resources

While malicious actors can gain access in any number of ways,  getting into your cloud environment via API is the equivalent of finding a wide-open door and walking in unchecked. Whoever holds that key will have direct access to what are likely your most valuable digital assets. And with API access, user-level security controls like multi-factor authentication become all but irrelevant. It's safe to say that exposure of your AWS API keys is a serious problem.

Data Breaches and Information Leakage

In February, healthcare provider American Vision Partners experienced a security breach that compromised the sensitive information of 2.35 million eye care patients' names, Social Security numbers, medical records, and insurance information. As a result, these victims remain at risk of experiencing identity theft, insurance fraud, and any number of other life-altering problems. Lawsuits and regulatory penalties appear to be ongoing, leaving the company's reputation and client relationships severely damaged.

Manipulation of System Configurations

Once inside your systems, attackers can change your security settings to remove the layers of security you have in place to guard against attacks. This can then allow them to take actions like connecting to external locations they may plan to use for data exfiltration and even establish persistence. (Persistence is when a malicious actor deploys secret malware that will reestablish connection with attackers anytime your security team finds and disables it.) Whatever their end goals, a bad actor with access to your critical systems is a severe threat that can result in even more kinds of attacks.

Full Control Over Virtual Servers

If attackers gain control even a single virtual server, they can do a lot of damage in a hurry. In a straight-forward attack, they might exfiltrate valuable intellectual property or other sensitive data directly from the server. However, they can also use that virtual server as a command center to launch ransomware attacks on other servers  or undertake any number of suspicious activities.

Common API Security Vulnerabilities

Insecure Key Storage and Accidental Exposure

API keys are often stored in insecure places. Likely, this is not a policy failure but the result of collaboration and sharing between employees in messaging apps like Slack and Teams–or emails and documents. People don't think of those locations as storage, but that's exactly what they become.

Keys are also commonly shared in project and ticketing applications like Jira or ZenDesk as part of support tickets. Users may try to be helpful by providing API keys because they think it will be useful to their IT teams to speed up a request. Since these apps are "private" and have credentialed / invite-only access control, the risk feels lower to employees. However, gaining access to software has proven fairly simple over the years. All it takes is a set of compromised user credentials, a brute force attack, or any other fairly standard tactic.

Poor Identity Management Practices

Speaking of compromised credentials, poor identity management hygiene or permissive access can result in threat actors gaining access to your API keys. For example, a departing employee may not have restricted access in their last few weeks of employment (elevated risk) might maintain a high level of user access up to the last day, giving them time to potentially misuse administrative privileges to steal or sell valuable secrets like API keys. Most employees couldn't imagine potential attacks like this, because most people are unlikely to become insider threats. However, strict identity management practices are needed to prevent such malicious attacks.

Lack of Encryption

Encryption is one of the easiest ways to protect sensitive files. If your API keys always and only live in encrypted locations, your risk is vastly reduced. However, when employees mistakenly overshare unencrypted secrets, this security control is largely nullified. But when well meaning employees are simply trying to work and be productive, they're bound to make mistakes–not because they don't care, but because they're human.

Impact of API Key Exposure

Financial Loss

Breaches are expensive–$4.88M per breach on average, to be exact. This includes the cost of breach notification, outsourced remediation support, lost productivity, legal costs, compliance fines, loss of client accounts, and more. API key breaches in particular stand to cause even more damage, because they give attackers immediate access to high-value assets. Unauthorized activity in a tech startup's production environment, for example, could be catastrophic.

Reputational Damage

Repairing one's reputation is also expensive. In fact, there are PR firms whose entire business is built on repairing public opinion post-breach. Reputational risk is far higher for B2B SaaS companies, though, because their clients are other organizations who have their own vetting processes, security teams, and compliance requirements that govern who they can and can't do business with. They require due diligence to prevent potential security risks from third party applications. Recently breached SaaS companies are typically not on the list of approved vendors.

Compliance Issues

Being found noncompliant can be extremely expensive, depending on the framework.  GDPR and HIPAA violations are quite pricey: $10 million - $20 million for GDPR and up to $1.5 million for HIPAA. That doesn't include the cost of remediating the issues that led to noncompliance, however. Whatever security controls failed before will need to be reconfigured, replaced, or managed more carefully going forward. That could mean additional headcount, outsourced support, and more.

Implement Strong Authentication Protocols

When attackers discover an active API key to your AWS instance, the potential for damage is immense. Strong authentication protocols across other areas of your environment could help limit that damage. As a matter of best practice, it's important to implement multi-factor authentication (MFA) everywhere and ensure that access controls are stringently configured–even though an API key attack stands to negate these controls within AWS. It's still vital to limit damage where you can.

Regular Rotation of API Keys

Continuous rotation of API keys is crucial. This practice limits the window of vulnerability if a key is compromised. By frequently changing keys, you minimize the potential damage an attacker could inflict with a stolen key. Consider automated key rotation to help maintain security without manual intervention.

Comprehensive Monitoring Solutions

Develop robust monitoring solutions that can detect unusual API access patterns. Given that 84% of security professionals reported API security incidents last year, real-time monitoring is not optional—it's essential. Track API usage, set up alerts for suspicious activities, and create comprehensive logging mechanisms.

Most importantly, set up continuous monitoring of data and data handling events with a robust cloud DLP solution like Nightfall AI. If you had Nightfall, your active API keys for AWS would already have been identified and remediated within SaaS apps and cloud workspaces.

Specific AWS Security Risks

In AWS environments, API keys provide direct access to cloud services and resources. Attackers can potentially:

• Gain full control over virtual servers.
• Manipulate system configurations in ways discussed above.
• Exfiltrate sensitive data like PII, financial information, intellectual property, and more.
• Create additional risks like using compromised servers as attack launch points.

Misconfigured Services

Misconfigured AWS services also represent a significant vulnerability. Ensure that every service is configured with the principle of least privilege, restricting access to only what is absolutely necessary for its function.

Understand Service Permissions

Deeply understand the permissions associated with each API key. API keys aren't just authentication or access tokens—they're powerful access mechanisms that can grant extensive control over your cloud environment.

Importance of Encryption

To reiterate, encryption is critical. Unencrypted sensitive data dramatically increases risk. While humans may accidentally share information, implementing robust encryption can mitigate potential damage from such human errors.

Best Practices for API Key Management

Store keys securely, but have a backup plan.

Avoid storing API keys in easily accessible locations like messaging apps, emails, or internal documents. These seemingly private spaces can be surprisingly vulnerable to attack, leading to potentially devastating API-related threats. Using tools like Nightfall AI can give you peace of mind about the security of your AWS systems and other cloud environments in the face of data handling mistakes due to human error. If you use Nightfall to do this, you'll also have exfiltration prevention as an additional layer of security.

Limit Key Permissions

Following the principles of least privilege, create your API keys with the most restricted permissions possible. Each key should have access only to the specific resources it absolutely requires. To do this in AWS, you can configure permissions directly within the AWS Key Management Service (KMS). By implementing strict API configurations across every SaaS / cloud environment, you can significantly limit your risk of compromise via third-party integrations.

Use Environment Variables

Leverage environment variables for storing API keys. This provides an additional layer of abstraction and security compared to hardcoding credentials.

Remember, in the world of cloud security, proactive management is always preferable to reactive damage control. Some tools, like Nightfall, allow you to take both a proactive and reactive approach– keeping data out of internal locations that put you at risk, while putting backstops in place to properly protect sensitive data elements when employees do make mistakes.

Prevent Secrets Sprawl and Reduce Insider Risk

One factor that can negate protections in-place to protect your internal systems is secrets sprawl, or internal oversharing of sensitive data in SaaS applications. Some organizations, like Disney, choose to simply end use of SaaS apps like Slack in response to threats. However, this doesn't really solve the problem. To keep up with productivity demand, employees need collaboration apps, and replacing one app with another just moves the risk elsewhere. The challenges are still the same.

Instead, using automated tools like Nightfall AI to help identify and remediate data handling policy violations allows organizations to enforce compliance, keeping sensitive data like API keys out of locations where hackers can find them. Nightfall allows you to create and enforce access policies, sharing policies, and more–without interrupting the flow of productivity.

What's more, Nightfall clients report vast improvement over time due to the platform's powerful self-remediation capabilities. By giving users a chance to remediate errors, themselves, Nightfall helps users understand what data security hygiene looks like. In turn, they use more secure practices when collaborating to ensure your AWS API remains a secure API.

Curious? Request a demo to learn more about Nightfall AI.