I don't think the transmission is going through.
Wait! Are you there?
If you can hear me, please listen carefully! Our future depends on you securing your APIs!
There is a cyberwar coming and your APIs are the target!
I'm sending you a list of 10 vulnerabilities that you need to secure first.
It's important that you do this now because they've already
found a vulnerability and we don't know how much time you have left.
I'm Brenton House and you are watching API Cybersecurity 101.
APIs are everywhere and API Security has never been more important than it is right now.
API abuses have risen in the past few years and it is difficult
to go even a week without reading about another API that has been attacked.
By securing your APIs using API Security solutions and API Management best practices, you can
mitigate attacks and protect your organization, your customers,
your data, and your reputation.
If you saw the previous episodes of API Cybersecurity 101
then you know that a properly configured API Gateway is the core to your API Security strategy.
So I have a question for you today. How secure is your API Management strategy?
There is a reason that Software AG is a leader of leaders in the API Management space.
Take a look at the show notes below to learn more about how Software AG can partner with you
to securely manage your APIs and Integrations!
Well, today we are talking about the OWASP Top Ten list for API Security,
one of the most popular lists of API Security vulnerabilities.
Well, today we are talking about the OWASP Top Ten list for API Security,
one of the most popular lists of API Security vulnerabilities.
If you are just getting into this series or are new to APIs,
let me quickly explain what an API is.
API is an acronym that stands for Application Programming Interface.
Basically, it is non-human systems (or
applications) that talk to each other in an agreed-upon way!
Most often, when people are talking about APIs, they are referring to Web APIs,
which includes things like REST, GraphQL, gRPC, SOAP, and others.
Why is everyone talking about APIs now?
The introduction of smartphones and other "smart" devices has caused an
exponential growth in and adoption of APIs as pretty much every single mobile application,
smart device, and website uses APIs.
So what is API Security?
The simple answer is that it is about applying and managing security for your APIs
but as I often say, there is nothing simple about API Security.
This then leads us to OWASP. So what is OWASP?
You may or may not have heard of OWASP before but it is the "Open Web Application Security Project".
They are an international non-profit organization dedicated to web application security.
What they are most known for is their re-occurring Top 10 list of Web Vulnerabilities,
but they also have a Top 10 list covering API Security.
The list was created in 2019 but it is absolutely relevant and applicable today.
So let's jump into it.
The first on the list is Broken Object-Level Authorization.
An example of this would be if an attacker were to substitute the id in an API call
with a different one and is able to get access to data that they should not have access to.
Say I had this banking API with my account number at the end.
Now, what if I were to replace my account number with someone else's account number?
This example may seem far-fetched but you would be surprised.
There is a reason we have them in this list
and it's because there are APIs that are published with these vulnerabilities.
All your resources need to run authorization checks before providing access to a client.
An API Gateway provides the highly granular, level-of-access control
necessary to prevent these issues. You will then be able to control access
to resources and methods via scope-level policy definitions.
Next we have Broken User Authentication.
APIs that are not using secure authentication
are at risk of attackers compromising their system using this exploit.
There are numerous authentication
schemes that allow you to mitigate the risk to your APIs including but not limited to:
OAuth JWT
SAML Kerberos
OpenID Basic Auth
Client Certificates And more...
Excessive Data Exposure is next on the list.
Often an API will publish more data than what you see displayed through the user interface.
It is important to sanitize and filter the data that is
exposed through the API as this can be accessed and viewed using other methods.
Take advantage of your API Management system to apply
data transformation and data masking features to your APIs.
Next we have Lack of Resources & Rate Limiting
Without proper limits on access to resources, an attacker can easily overload your API system.
Using features like rate limiting, throttling, and other threat protection policies in your
API Gateway, you can block Denial of Service (DoS) attempts, limit large payloads, stop SQL
injection, monitor traffic, and stop other attacks that can affect your APIs and other resources.
Next, watch out for Broken Function-Level Authorization
Similar to Broken ObjectLevel Authorization,
API endpoints that are used for admin purposes need to use secure authorization policies.
An attacker may be able to guess an admin endpoint
and an API cannot rely on a client implementing proper authorization.
Securing admin endpoints and resources will shield your API resources from this exploit.
Next is a vulnerability due to Mass Assignment
In an effort to transform and bind data from clients,
sometimes a mass assignment vulnerability can creep in.
This happens when an API allows data from the client to save properties that the
user should not have permission to update.
A best practice for avoiding this is to only use whitelists and not blacklists.
Ensuring that your API Gateway is configured with policy enforcement
to specifically define the properties that can be updated
is just one way to protect your API and data from this security threat.
Security Misconfiguration is another vulnerability you need to watch out for.
Security misconfiguration is probably one of the most common issues leading to security exploits.
While human error is tough to protect against, an API Gateway can shift some
of that responsibility to shared and global security policy definitions
which can be applied to large collections of APIs - thus limiting this security issue.
Next is Injection.
API attacks can come in the form of malicious code that
a client might try to trick an API into executing.
APIs often have to interpret unknown data and a vulnerability can be exploited
if the API blindly executes that code.
It is important to never blindly trust the API client, even with internal consumers.
By defining data types in schemas and validating all requests through threat protection policies
defined by your API Gateway, you can prevent SQL injections and other injection attacks.
Next up is Improper Assets Management
Production APIs are not the only surface area you need to be protecting.
There are several types of APIs that you might be running that
could provide an attacker access to valuable data on your system.
Some of these you probably know very well:
Public APIs (or external APIs)
Internal APIs Partner APIs
Third-Party APIs Composite APIs
Some of the other types of APIs you might not be as familiar with include:
Beta APIs:
Non-production versions of APIs such as alpha, beta, testing, staging, and others*
Shadow APIs:
Those internal or public APIs that you created and use but try to keep off the radar
Zombie APIs:
APIs that work and are in use but have not been updated and are probably using outdated security
Frankenstein APIs:
Unofficial APIs that are hacked together to scrape systems that don't provide real APIs
All APIs need to be managed and secured to ensure that your data,
your customers, and your company are protected.
Last but not least, we have Insufficient Logging & Monitoring
Most breach studies show that the time to detect a breach is over 200 days and
is typically detected by external parties rather than by internal processes or through monitoring.
Without proper logging and monitoring, attacks on your APIs and data can go unnoticed.
Be sure you are implementing Traffic Monitoring policies via your API Gateway
can monitor run-time performance conditions, enforce limits for service invocations,
and send alerts when conditions are violated.
Also ensure that your logs are sanitized of sensitive information and are formatted in
a way that other logging and security tools can consume and process them, if necessary.
This has been a quick run-through of the OWASP Top Ten List for API Security
but each of these items is critical enough to deserve its own episode so
stay tuned for more details about content covering the vulnerabilities on this list.
You are watching API Cybersecurity 101, the show that equips technical
AND business users to level up their API Security
Feel free to add any comments or questions that you might have about API
Security in the comments section below.
I'm Brenton House and again,
thanks for watching! Check out the show notes below for links AND bonus content.
And as always, Subscribe to this channel to stay up-to-date
with the ever-changing world of APIs, Cybersecurity, and Digital Transformation!