Download to read offline
Uploaded byNordic APIs
Combatting API Vulnerabilities with the 3 Pillars of API Security
The document discusses the increasing importance of API security, highlighting that current testing is inadequate, with only 4% focused on security despite APIs being a major attack vector. It emphasizes the three pillars of API security: governance, testing, and monitoring, alongside best practices for securing APIs. Key recommendations include developing comprehensive governance policies, ensuring thorough API documentation, and training developers to prioritize security.
More Related Content
Similar to Combatting API Vulnerabilities with the 3 Pillars of API Security
Combatting API Vulnerabilities with the 3 Pillars of API Security
- 1. Combatting API Vulnerabilitieswith the 3 Pillars of API Security Dan Barahona Co-founder, APIsec University dan@apisecuniversity.com
- 3. 4% of API testingis Security 2022 “API attacks will become the most frequent attack vector” 83% of all Internet traffic is API traffic API Explosion APIs Under Attack APIs Under-Secured Source: stateofapis.com Unit, Function, Performance, other Security
- 4.
- 8. The 3 Pillarsof API Security Governance Testing Monitoring Developing secure APIs Ensuring APIs are free of flaws Detecting threats in production
- 9. Awareness • Know yourAPIs • Know your data • Know your risks Governance Policy & Process • API Dev process • API documentation • Style guides
- 10. APIs Seriously Under-Tested Source:www.stateofapis.com
- 11. Logic • Object IDmanipulation • Cross-account access • API function abuse • Role-based access control • Authorization gaps Data • Access control • Excessive data exposure • Sensitive data exposure • Personal, health, bank data • File, directory exposure • Encryption at rest • Data exfiltration Security • Unsecured Endpoints • Authentication exploits • Incremental IDs • App DOS, rate limiting • Missing TLS, SSL issues • Injection, XSS • Fuzzing, input validation • Server-side request forgery • Server properties leaks Testing Categories
- 12. Control Validation • VerifyAPI controls • Uncover anomalies Threat Detection • Fraudulent traffic • Distributed attacks • Incident response Runtime Protection • Policy enforcement • Authentication • Traffic filtering Monitoring
- 13. API Security BestPractices – Top 10 1. Start with Governance 2. Know Your APIs Ecosystem 3. Get Sec & Dev talking 4. API Docs Non-Negotiable 5. Train API Devs/Owners 6. Centralize API Management 7. Don’t Trust Anything 8. Don’t rely on UIs for Security 9. Understand Monitoring Limits 10. Automate Pre-Prod Testing
- 15.