How to Identify and Mitigate API Security Risks to Defend Critical Infrastructure