This article describes the modules, deployment components, and deployment options of the Cequence Platform. The intended readers are administrators and architects who evaluate or plan a deployment.
The Cequence Platform is a comprehensive solution that protects APIs from a wide range of threats, including data loss, fraud, and business disruption. The platform provides continuous, real-time protection across all phases of the API lifecycle, from discovery and inventory to risk assessment and mitigation.
The Cequence Platform includes the following modules.
- API Discovery: API Discovery enables you to quickly discover and understand your external API attack surface, including public-facing API hosts, the environments that those hosts are in, and vulnerabilities related to weak TLS certificates on those hosts. Deploying API Discovery requires no software installation or configuration changes in your environment. API Discovery is offered as a SaaS service that probes your root-level domain (for example, exampledomain.com) from the outside. Sign up at the API Discovery sign-up site. Discovering the public API attack surface is often the first step in an organization's API security program, because this step shows the overall sprawl of APIs across the organization.
- Detection: This module provides comprehensive internal, external, and third-party API discovery and inventory, which enables you to understand and address API risks both before and after deployment. This module also provides API security posture management, which enables you to identify and track API vulnerabilities, assess their severity, and implement timely remediation measures that eliminate coding errors that could lead to data breaches or business disruptions. You can integrate the Cequence Platform with content delivery networks (CDNs), API gateways, load balancers, and other public-facing deployments to discover external-facing APIs. You can also integrate the Cequence Platform with microservices ingress gateways, extended Berkeley Packet Filter (eBPF), traffic mirroring, and other internal-facing deployments to discover internal APIs. Finally, to discover third-party APIs that your internal applications consume, you can integrate the Cequence Platform with outbound connectivity through firewalls and web proxies, and through eBPF sensing.
The API Discovery and Detection modules together provide comprehensive API discovery in your environment. Read more about the two-phase discovery process.
- Mitigation: This module detects active malicious or unwanted API usage by analyzing API usage patterns. The module detects malicious infrastructure that accesses your public-facing applications, malicious use of credentials or tokens (for example, in a credential stuffing attack), malicious tools such as automated toolkits and botnets, and malicious behavioral patterns. In this module, you define policies that block, rate-limit, insert a header, or take other actions on bad traffic, which defends against targeted attacks, business logic abuse, and fraud.
Deployment
The Cequence Platform follows a hub-and-spoke deployment model that centralizes API management and security controls in a central hub, while spokes handle distributed API traffic. This architecture addresses the challenges of securing a large number of APIs spread across multiple locations.
Deployment components
The Cequence Platform runs at the hub, where the platform performs continuous, multi-dimensional analysis of all API transactions using a fast and efficient single-pass architecture.
The spokes are the data-plane components that you deploy anywhere in the path of API transactions, all the way from the CDN to a sidecar in the application pod. These components come in the following types.
- Cequence Defender: Defender is a reverse proxy that you deploy directly in the path of an organization's API traffic. This active deployment approach requires all API requests to pass through Defender, so Defender enforces API policies, filters malicious traffic, and provides real-time threat detection and mitigation. While active deployment offers the most comprehensive API protection, active deployment can introduce some latency into API requests. Cequence has optimized Defender to add minimal latency in most inline deployments, typically no more than eight to 10 milliseconds for each request and response transaction. Defender is typically used to integrate with other inline components, such as API gateway proxies, CDNs, load balancers, and web proxies.
- Cequence Sensor: Cequence Sensor is passive and you deploy Cequence Sensor out-of-band, which means that Cequence Sensor does not interfere with API traffic. Cequence Sensor monitors API traffic and collects data that you can use to identify and mitigate threats. Passive deployment is less effective at threat protection than active deployment, but passive deployment does not add any latency to API requests. Cequence Sensor is typically used to integrate with passive technologies, such as traffic mirroring and TAP/SPAN ports.
- Cequence Bridge: Cequence Bridge aggregates traffic from multiple sources and sends that traffic to the Cequence Platform. Cequence Bridge is included by default within Cequence Sensor and Cequence Defender. When you deploy Cequence Sensor or Cequence Defender, you do not also need to deploy Cequence Bridge. Cequence Bridge is particularly useful when you integrate with API gateway plugins, such as the MuleSoft policy plugin or the Apigee Shared Flow. These integrations cannot perform sensitive data masking themselves. Cequence Bridge masks this data before Cequence Bridge sends the data to the Cequence Platform.
- Cequence eBPF Sensor: Cequence eBPF Sensor is a specialized sensor that uses extended Berkeley Packet Filter (eBPF) technology to integrate with applications. Cequence eBPF Sensor also includes Cequence Bridge functionality by default.
- Third-party native integrations: Cequence can natively integrate with a wide range of CDNs, load balancers, ingress controllers, and API gateways as a side-band callout mechanism, which provides an alternative to Sensor-based deployment.
The best deployment option for you depends on the specific needs and requirements of your organization. When you need the most comprehensive protection for your APIs, the Defender-based active deployment is the best option. When latency is a concern, passive deployments such as Sensor and third-party native integrations may be a better choice.
Deployment options
Cequence offers a variety of deployment options for its API security solutions to accommodate different organizational requirements and infrastructure setups.
Cequence Platform
- SaaS (Software as a Service): In a SaaS deployment, Cequence hosts and manages the Cequence Platform, which eliminates the need for organizations to install and maintain hardware or software on their premises. This option is ideal for organizations that prefer a cloud-based solution with minimal upfront investment and ongoing maintenance responsibilities. SaaS deployment also provides scalability and flexibility, which enables organizations to adjust their service levels as their needs change.
- On-premises (self-install): For organizations that require greater control over their infrastructure and data, or that have specific regulatory compliance requirements, on-premises deployment is a suitable option. In this model, you install and manage the Cequence Platform within your own data center or cloud environment. This approach provides greater customization and control over the deployment and configuration of the security solution. However, this model requires you to allocate resources for hardware, software maintenance, and ongoing support. To get started, see Cequence Platform Virtual Appliance on AWS EC2.
- Hybrid: In a hybrid deployment, Cequence manages the Cequence Platform as SaaS, and the traffic sources, which are Cequence Defender or Cequence Sensor components, send traffic to the Cequence Platform from an environment that you manage. A hybrid deployment enables you to send traffic from multiple Defender or Sensor instances to the same Cequence Platform instance.
Defender
- SaaS (Software as a Service): In a SaaS deployment, Cequence hosts and manages Defender, which eliminates the need for organizations to install and maintain hardware or software on their premises. Defender instances are available as a public edge for API clients or as a hop or upstream in the path of API transactions.
- On-premises (self-install): This option is suitable for environments where the APIs are deeply rooted in customer environments and are not publicly facing. To get started, see Getting started with the Defender Virtual Appliance.
Sensor
- SaaS (Software as a Service): This option is not applicable for most customer deployments.
- On-premises (self-install): This option is suitable for environments where the APIs are deeply rooted in customer environments and integrate with customer TAPs, which provide a copy of the API transaction. To get started, see Getting started with the Sensor Virtual Appliance.
Third-party native integrations
Cequence can integrate with most third-party SaaS or on-premises API gateways, CDNs, and load balancers using a drop-in native integration.
Reference architecture
The following diagrams show the reference architectures for active and passive deployments.