In today’s inter-connected world, the statistics are against you for a secure API. It is not a matter of if but when one simple breach can make front page news, tarnish your organization’s reputation, and cause problems not only for your organization but for external consumers of your API as well. With such loaded consequences, testing and validating access to your application or device for security vulnerabilities needs to become an industry standard. In this session, you'll learn: Shift left your security testing efforts and establish a continuous security testing process Perform API security penetration testing Extend existing functional tests with security scenarios Correlate security vulnerabilities to business requirements

2. Bulletproofing your APIs
Nathan Jakubiak, Parasoft
jakubiak@parasoft.com
Presentation slides: http://sched.co/BiDc

3. API security is like…

7. The Traditional Approach to Security
Security Problems
Dev Stream
Dev Stream
Dev Stream
Dev Stream
SecurityQA/Integration
It’s too close
to the
release date!
I don’t
understand
the problem
We are no longer
working on that
code
That’s not a
‘real’
problem
These problems
need fixing
I’ll have to retest the
whole application
Expensive and
complex/specialized
testing

9. Automated Security Tests
Continuous Integration
Static Analysis
Unit Testing
Functional Tests

10. Start with API Functional Tests
• Identify subset of tests and prepare for security
• Run with functional testing tool
• Capture traffic and pass to pen test tool
• Pen test tool performs checks and reports
results
Functional Tests
Security Tests

11. Reporting & Analytics
Automated
Penetration Tests
(Parasoft SOAtest)
Application
Under Test
Service
Virtualization
(Parasoft
Virtualize)
BurpSuite

13. Review errors in context of use case

14. Benefits of leveraging functional tests
• Save time by reuse
• Scenario is properly set up
• Errors get reported in context of use case
• Repeatable test for verification
• Association with requirements

15. How to prepare for security
• Select a subset of your API functional tests
– Maximize attack surface with fewest number of tests
– Avoid pen testing same API over and over
– Remove parameterization
– Skip setup/teardown tests
– Be careful with APIs that add items to the DB
– Remove assertions

16. Ensure a stable test environment
• Maintain separate functional and security tests
• Use separate test runs
– Use separate environment, or run security tests last
– Use variables in your tests to easily switch between
environments (if needed)
– Use service virtualization to isolate environments

17. Summary
• Move automated security testing into the continuous testing process
• Leverage API functional tests for security testing

19. Questions?
jakubiak@parasoft.com
Presentation slides: http://sched.co/BiDc
Recorded webinar: https://vimeo.com/parasoft/review/214069660/76182c2c57