Akamai App & API Protector flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

BOLA

Broken Object Level Authorization: an API authorizes a caller's token but not the specific object ID requested, letting an authenticated user access another user's records.

Positive security model

A control strategy that permits only explicitly known-good methods, paths, parameters, and schema-conformant payloads, rejecting everything outside the declared contract.

Negative security model

A control strategy that blocks traffic matching known-bad signatures or attack patterns; effective against known CVEs and generic payloads but blind to logic abuse.

Shadow API

An undocumented or forgotten API endpoint that receives traffic but lacks security review or ownership, discoverable only by comparing observed traffic to declared specifications.

JWT algorithm confusion

An attack where a verifier that fails to pin the expected signing algorithm accepts a token signed with a weaker or 'none' algorithm, bypassing signature validation.

Mass assignment

A vulnerability where an API binds client-supplied fields directly to internal object properties, letting callers set privileged attributes like role or account balance.

Excessive data exposure

An API returns full object representations and relies on the client to filter sensitive fields, exposing data the caller was never meant to receive.

Per-token rate limiting

Rate limits keyed to an authenticated token or session rather than source IP, defeating evasion by distributed clients that rotate IP addresses.

Verified bot validation

Confirming a crawler's claimed identity cryptographically, typically via reverse DNS plus published IP ranges, rather than trusting a spoofable User-Agent string.

Proof-of-work challenge

A mitigation that requires the client to compute a costly puzzle before proceeding, imposing real cost on automation while staying transparent to browsers.

Credential stuffing signature

Many accounts attempted from few IPs, or one account from many IPs, at low per-IP rates; detection requires cross-request aggregation rather than per-request signatures.

Browser fingerprinting

Identifying clients by consistent attributes such as TLS fingerprint, header order, and environment properties, used to link distributed requests to a single automation tool.

Tarpit response

A bot mitigation action that deliberately slows responses to automated clients, wasting attacker resources while limiting disruption to legitimate users.

Sanctioned automation

Authorized non-human traffic such as partner integrations or RPA agents that should be allowed by policy based on authenticated identity rather than challenged.

Low-and-slow bot traffic

Distributed automation that keeps per-source request rates below rate thresholds, evading simple rate limits and requiring behavioral anomaly scoring to detect.

WAF inline mode

Deployment as a reverse proxy in the request path, the only placement that permits full inspection and active blocking of malicious requests.

Out-of-band WAF

A monitoring-only deployment that inspects mirrored traffic and alerts on attacks without the ability to block, used for baselining and tuning.

Virtual patching

Deploying WAF signatures that block exploitation of a known vulnerability before the origin application is patched, shrinking the exposure window.

Paranoia level

A strictness setting in rule sets where higher levels enable more rules and catch more attacks at the cost of more false positives.

Anomaly scoring

A WAF model that sums severity points from matched rules and blocks only when the total crosses a threshold, reducing false positives versus per-rule blocking.

Narrowly scoped exception

A tuning action that disables a specific rule for one path or parameter rather than globally, preserving coverage elsewhere while removing a false positive.

WAAP convergence

Combining WAF, API protection, bot management, and DDoS defense in one control plane so telemetry is shared and detections can be correlated.

OpenAPI schema enforcement

Validating incoming method, path, query, and body against the published API specification and rejecting undeclared parameters or malformed content types.

Rule tuning lifecycle

The sequence of monitor, baseline false positives, tune or add scoped exceptions, then enforce, ensuring blocking does not harm legitimate traffic.

Volumetric DDoS

An L3/L4 attack that saturates bandwidth or packet-processing capacity using floods or reflection/amplification, mitigated by upstream scrubbing capacity.

SYN flood

A state-exhaustion attack sending many half-open TCP handshakes; mitigated with SYN cookies or a SYN proxy that validates clients at the network edge.

Reflection amplification

An attack that spoofs the victim's source IP and sends requests to open services, whose larger responses are directed at the victim to multiply traffic volume.

Anycast scrubbing

Routing attack traffic via BGP anycast to distributed scrubbing centers that filter malicious packets and forward clean traffic to the origin.

Always-on mitigation

DDoS protection that is continuously active, eliminating detection delay and ramp-up windows that on-demand, trigger-based mitigation can suffer.

Slowloris attack

An application-layer attack holding many connections open with partial requests to exhaust server connection or thread pools; countered with timeouts and edge buffering.

Origin hiding

Concealing the origin server's address and restricting it to accept traffic only from scrubbing or proxy ranges, preventing direct-to-origin attacks.

HTTP flood

An L7 attack sending high volumes of seemingly valid requests to exhaust application resources, distinguished from legitimate spikes by per-client fairness analysis.