SOFTWARE SUPPLY CHAIN SECURITY ANALYSIS

Abstract

This article addresses the pressing issue of securing application programming interfaces (APIs) in cloud environments within the broader context of software supply chain protection. Given the widespread adoption of microservice architectures and open REST/GraphQL APIs, the need to defend APIs against attacks has become critically important. The paper presents a formalization of the software supply chain model, which serves as the basis for analyzing potential attack vectors at each stage of the chain — from the compromise of repositories, dependencies, and CI/CD servers to artifact storage and deployment environments. Special attention is given to two key security mechanisms: the Web Application Firewall (WAF) and the API Gateway. A comparative analysis is provided covering their functionality, request handling approaches, security levels, logging methods, and integration into cloud infrastructures. The study identifies that WAFs detect and block HTTP-level attacks — such as SQL injections, XSS, and CSRF — based on signatures or behavioral rules, while API Gateways act as intermediaries managing request routing, authentication, authorization, access policies, and API call control. The research findings demonstrate that WAFs and API Gateways are not interchangeable but should be used as complementary components. The article proposes a combined cloud-based API protection model in which the WAF provides perimeter control and the API Gateway enforces logical access control. Additionally, it presents methods for evaluating the effectiveness of these mechanisms, including empirical testing in sandboxed environments, comparative benchmarking under various configurations, and threat modeling. Finally, the paper outlines several unresolved challenges and directions for further research in API and CI/CD security within cloud environments.