What is the best way to ensure the API is protected against privilege escalation?

What is the best way to ensure the API is protected against privilege escalation?

• A. Implement resource and field-level access control
• B. Require MFA for all users
• C. Encrypt all data at rest
• D. Disable admin accounts

Answer: (A)

Access control and authorization checks at the API level are what prevent privilege escalation. Implementing resource- and field-level access control ensures every API call is evaluated against what the caller is allowed to do with each specific resource and which fields they’re allowed to see or modify. This means even if a user has a valid session, the system will block actions or data access that go beyond their assigned permissions, closing gaps that could be exploited by manipulating identifiers or requests. By enforcing least privilege across resources and data, the API prevents higher-privilege operations from being performed by unauthorized users. MFA strengthens authentication, not authorization, so it doesn’t by itself stop someone who already has access from performing elevated actions. Encrypting data at rest protects data if storage is breached, but doesn’t prevent improper use of the API once a user is authenticated. Disabling admin accounts is not a practical, general solution and doesn’t address the underlying need for proper authorization checks within the API.

Access control and authorization checks at the API level are what prevent privilege escalation. Implementing resource- and field-level access control ensures every API call is evaluated against what the caller is allowed to do with each specific resource and which fields they’re allowed to see or modify. This means even if a user has a valid session, the system will block actions or data access that go beyond their assigned permissions, closing gaps that could be exploited by manipulating identifiers or requests. By enforcing least privilege across resources and data, the API prevents higher-privilege operations from being performed by unauthorized users.

MFA strengthens authentication, not authorization, so it doesn’t by itself stop someone who already has access from performing elevated actions. Encrypting data at rest protects data if storage is breached, but doesn’t prevent improper use of the API once a user is authenticated. Disabling admin accounts is not a practical, general solution and doesn’t address the underlying need for proper authorization checks within the API.