How does IP whitelisting help secure an API?

Question

I'm trying to get a better understanding of the extent that IP whitelisting helps to prevent attacks against an API.

At the moment I'm thinking of a B2B scenario where organisation A provides an API and organisation B consumes the API.

If the organisation A that is producing the API configures its API so that it will only accept IP addresses from organisation B, what additional security does it provide?

Note, this is inaction (OP: "in addition"?) to other security measures such as Shared secret + TLS or Mutual TLS.

I understand that it will have some effect on a denial of service attack and can (OP: finish this sentence?)

Answer 1

[how does] IP whitelisting help to prevent attacks against an API[?]

Simply by limiting the set of IP address that can submit requests to the API to a smaller number of presumably trusted addresses.

1. If you have 15 customers with one IP whitelisted to use your system, then that is far less of a threat than the 3 Billion addresses across the Internet.

2. If they are your customers, they are in a relationship with you, and presumably have less interest in attacking you because a) you know who they are, and b) if they break you they lose whatever service you're providing them.

It's still not a perfect control:

• Your customers may have dynamic IPs, and be poor candidates for whitelisting.
• Your customers may get compromised, and used as a platform for attacks by a malicious third party.
• Your customers may misconfigure their systems to forward traffic from any system on the Internet to yours, negating the whitelist (yes, I have seen this exact thing happen).
• A malicious attacker could sign up and get whitelisted solely for the purpose of enabling an attack against you.

But it does cut down on the casual attacks that every system on the Internet is constantly receiving.

Answer 2

Information leaks, an exposed API key that a contractor saves to a USB and takes to his new job, a git hub commit to a public repo etc.

Now if that information has leaked and a bad actor comes across it they only way they could make use of it is to first breach the client site with the IP that is allowed instead of directly acting on it.

Security is layers and adding an IP whitelist adds an additional challenge.