This document discusses API security testing with Postman and Qualys. It notes that APIs are widely used but often developed without security in mind. It highlights some of the top API security risks from the OWASP API Security Top 10, including broken object level authorization, broken user authentication, and broken function level authorization. The document promotes Qualys' web application scanning capabilities for APIs and its integration with tools like Postman to allow quick scanning of APIs using existing test collections. It concludes with a brief demo and emphasizes that API security is important.

1. API Security with Postman
and Qualys
Security Solution Architect, Application Security
Qualys, Inc.

2. 2
APIs Are
Everywhere Highly exposed
Greater likelihood of attack
Constantly being probed
Internet-facing APIs
Custom / domain-specific
For employees or contractors
Often built without security
considered
Internal APIs
Unknown risk posture
No access to source code
Often process critical data
Vendor APIs
Cloud provider not
responsible for security of
your apps and APIs
APIs in public clouds

3. 3
https://owasp.org/www-project-api-sec
urity/
OWASP API
Security Top 10
API1 Broken Object Level Authorization
API2 Broken User Authentication
API3 Excessive Data Exposure
API4 Lack of Resources & Rate Limiting
API5 Broken Function Level Authorization
API6 Mass Assignment
API7 Security Misconfiguration
API8 Injection
API9 Improper Assets Management
API10 Insufficient Logging & Monitoring

4. OWASP API
Security Top 10 -
Highlights
API1 Broken Object Level Authorization
API2 Broken User Authentication
API5 Broken Function Level Authorization

5. API1 Broken Object Level Authorization
API1 Broken
Object Level
Authorization
(BOLA)

6. API5 Broken Function Level Authorization
API5 Broken
Function Level
Authorization

7. API2 Broken
User
Authentication
API2 Broken User Authentication
SolarWinds CVE-2020-10148
Administration bypass
Lack of authentication
Request processed before authentication
is verified

8. API6 Mass Assignment

9. API6 Mass Assignment

10. Note on API8
Injection
Frequently, practitioners feel that XSS
attacks are not valid for APIs due to
JSON responses
If JSON is written into an application
with a UI, the attack may execute
Microservices - Be aware of all areas
the responses are used

11. Qualys Web
Application
Scanning

12. Qualys WAS Highlights
Unlimited scans
Unlimited users
Cloud based
Not a point solution
Massive scalability
Flexible licensing
Scheduled scans
Ad-hoc, targeted
scans
Multi-site scanning
Scanner pooling
API scanning
Out-of-Band
detections
Comprehensive API
Splunk TA
Integrations with:
- Qualys WAF
- CI/CD tools
- Burp Suite
- Bugcrowd
RBAC
Tagging
Detection history
Scheduled reports
Customizable reports
Retest findings
Ignore findings
Low TCO Scanning
Flexibility
Integrations
Features

13. Postman Support

14. API Security - Coming Soon

15. Demo

16. Wrap-up
Qualys can utilize existing Postman collections
Quickly scan APIs for vulnerabilities
API Security is important
The OWASP API Security Top 10 is an
excellent resource

17. Thank You!
earnold@qualys.com
Security Solution Architect, Application Security
Qualys, Inc.