• Search for:
    1Aug, 2023
    The Future Internet I Want for Me, Myself and AI

    Artificial Intelligence has the potential to bring immense opportunities, but it also poses challenges.

    Artificial intelligence (AI) is dominating the R&D agenda of the leading Internet industry. The Silicon Valley and other startup hubs are buzzing about artificial intelligence and the issue has come at the top of policymakers’ agenda including the G20, the ITU, and the OECD, where leaders gathered this week in Paris.

    AI isn’t new, but its recent acceleration can be explained by its convergence with big data and IoT, and the endless applications and services it allows. In the market, this translates into investments across all industries as stakeholders try to understand the potential of AI for their own businesses. For instance, at the beginning of the year, Ford motors announced a plan to invest $1 billion over the next five years in Argo AI, an artificial intelligence startup that is focused on developing autonomous vehicle technology. It’s an indication that AI is a hot topic beyond the traditional ICT sector.

    How our community feels about AI

    There is a growing expectation on the part of many stakeholders that AI and machine learning will fundamentally reshape the future of the Internet and society around it.

    This is one of the trends we’ve observed in our own project about the Internet’s Future, where AI, together with five other areas, have been identified as key “Drivers” of change in the coming 5 to 10 years. There is a sense that “we may be experiencing a new [technology] Renaissance.” Indeed, in 10 years’ time AI technologies may dominate all aspects of our day to day lives from driving to banking or even working.

    Yet, the uncertainties raised by our community about this technology in the context of the Internet are extensive. These include the potential loss of human agency and decision-making, lack of transparency in how algorithms make decisions, discrimination, the pace of technological change outstripping governance and policy, and ethical considerations.

    A number of participants raised concerns related to the impact on industry and employment – and therefore society – noting the consequences of automation-led change across industries and business practices, and the possible increase in inequalities and societal disruption.

    Will AI replace human labour?

    The discussions at the OECD this week revolved around a specific issue: Will AI replace human labour?

    What do humans do at work? They perceive their environment, learn, use language to communicate, plan and navigate tasks – all of them abilities that can be imitated to varying degrees by machines.

    Looking back at the history of AI, the concept was born when a group of visionary researchers, including Marvin Minsky and John McCarthy, gathered in the summer of 1956 at Dartmouth College to kick off the project to create computers programmed to act as humans. The risk – or opportunity – was embedded, although perhaps not consciously, in the group’s objectives: replicating human intelligence.

    So, is it realistic that we could all be replaced by robots and algorithms?

    It depends who you ask and how you analyse the challenge. So far the estimated impact on job displacement has had a broad range: from 9-47%. From the OECD to the University of Oxford, the measuring techniques are quite different. The numbers are alarming and should be taken seriously, but they also do not tell the whole story.

    Shaping a future we can look forward to

    Fears are natural, but should be put into perspective. Lets think about how AI could improve human performance and lives.

    Deep learning has made tremendous progress in reasoning to the benefit of humans. See the example of the Go Game guru, Lee Sedol, who was defeated by “Alpha Go.” He explained that beyond personal disappointment, he also experienced a positive feedback loop. He learned from AI Go patterns and techniques and raised his own performance level. AI performing at the level, or higher, than humans is not necessarily a threat – it can augment intelligence and support our own development.

    AI can have also have a positive effect on humanity, notably by drawing inferences from enormous sets of data. For example, in the pharmaceutical field, the combination of AI and big data expands the industry’s ability to solve new scales of problems, which in turn enables the acceleration of research and can bring major breakthroughs in drug discoveries and disease diagnoses.

    Energy efficient homes, personal assistants that make our lives easier, etc. There are many other reasons and fields where hope – and even excitement – is possible.

    But what we do know is that Artificial Intelligence is already a topic that has triggered hopes and concerns. Going forward it is important that we broaden and demystify the debate in order to balance the headlines with insights and facts. To this end, ISOC recently published a Policy Paper on Artificial Intelligence and Machine Learning, introducing the fundamentals of the technology at hand and some of the key challenges it presents.

    As one of our guiding principles from this paper clearly states: “The public’s ability to understand AI-enabled services, and how they work, is key to ensuring trust in the technology.”

    Resource : https://www.internetsociety.org/blog/2017/06/the-future-internet-i-want-for-me-myself-and-ai/

    14Jul, 2023
    API Penetration Testing Checklist

    API security is an undervalued but crucial aspect of information security. Cyber attacks often target APIs and web applications. To remain secure, organisations must test their systems to find and eliminate any weaknesses.

    Organisations can achieve this with API penetration tests. An ethical hacker (or ‘penetration tester’) will examine your applications using the same techniques that a cyber criminal would use. This gives you a real-world insight into the way someone might compromise your systems.

    Web application and API tests look specifically at security vulnerabilities introduced during the development or implementation of software or websites. There is no single checklist of how exactly the test should be conducted, but there are general guidelines.

    Benefits of API penetration testing

    The primary purpose of an API penetration test is to protect your organisation from data breaches. This is crucial given the increased risk of cyber attacks in recent years. According to a UK government report, 39% of surveyed organisations said they suffered a security breach in the past year.

    By conducting an API penetration test, you will gain a real-world overview of one of the biggest security threats that organisations face. The tester will use their experience to provide guidance on specific risks and advise you on how to address them.

    But penetration tests aren’t only about closing security vulnerabilities. Mitigating the risk of security incidents has several other benefits.

    For instance, you protect brand loyalty and corporate image by reducing the likelihood of a costly and potentially embarrassing incident.

    Penetration testing also helps you demonstrate to clients and potential partners that you take cyber security seriously. This gives you a competitive advantage and could help you land higher-value contracts.

    Most notably, penetration testing is a requirement for several laws and regulations. Article 32 of the GDPR mandates organisations to regularly conduct tests and evaluations.

    This is to assess the effectiveness of the technical and organisational measures employed to protect personal data.

    Likewise, if your organisation is subject to the PCI DSS (Payment Card Industry Data Security Standard), you must conduct external penetration tests at least once per year and after any significant changes are made to your systems.

    API penetration testing checklist

    IT Governance has its own proprietary checklist when conducting API and web application penetration tests.

    The system is modelled on the OSSTMM (Open Source Security Testing Methodology Manual) and the OWASP (Open Web Application Security Project) methodologies.

    A high-level overview of our process is outlined below, with a brief description of what is assessed during each section.

    1. Authentication

    The penetration tester ensures that appropriate mechanisms are in place to confirm a user’s identity. They then review how the authentication process works, using that information to circumvent the authentication mechanism.

    2. Authorisation

    The tester verifies that access to resources is provided only to those permitted to use them.

    Once roles and privileges are understood, the tester tries to bypass the authorization schema. They search for path-traversal vulnerabilities and ways to increase the privileges given to the tester’s user role.

    3. Session management

    The tester ensures that effective session management configurations are implemented. This broadly covers anything from how user authentication is performed to what happens when logging out.

    4. Input validation and sanitisation

    The tester checks that the application appropriately validates and sanitises all input from the user or the environment before using it.

    This includes checking common input validation vulnerabilities such as cross-site scripting and SQL injection, as well as other checks such as file uploads, antivirus detection and file download weaknesses.

    5. Server configuration

    The tester analyses the deployed configuration of the server that hosts the web application. They then verify that the application server has gone through an appropriate hardening process.

    6. Encryption

    The tester assesses encryption security around the transmission of communication. This includes checking for common weaknesses in SSL/TLS configurations and verifying that all sensitive data is being securely transferred.

    7. Information leakage

    The tester reviews the application configuration to ensure that information is not being leaked.

    This is assessed by reviewing configurations and examining how the application communicates to discover any information disclosure that could cause a security risk.

    8. Application workflow

    The tester determines whether the application processes and workflows can be bypassed.

    Tests are conducted to ensure that application workflows cannot be bypassed by either tampering with the parameters or forcefully browsing. This ensures the integrity of the data.

    9. Application logic

    The tester analyses how the application uses, stores, and maintains data. They do this by checking the underlying technology and any mitigating controls that may affect the risk to the application.

    10. Report

    The tester documents their findings. Their reports contain an executive summary, which provides a high-level, non-technical summary of any identified vulnerabilities, alongside a summary of the organisation’s business risks and an overall risk rating.

    It also contains a comprehensive review of testing details, such as the scope of the assessment, descriptions of the vulnerabilities identified and their impact, plus proofs of concept that support the findings.

    Finally, the report provides the tester’s commentary, where they discuss the issues identified and how the vulnerabilities could be linked within an attack chain. This is supplemented with remediation advice and supporting references.

    Resource : https://www.itgovernance.co.uk/blog/api-penetration-testing-checklist

    14Jul, 2023
    Red Team vs Blue Team: What’s the Difference?

    Red team cyber security assessments are a crucial way of giving organisations a practical understanding of their defence capabilities.

    In these exercises, the red team faces off against their counterparts, the blue team, in a battle to control a particular asset. That could be sensitive data, financial records, communication channels or the organisation’s infrastructure itself.

    Assessments can be adapted to suit particular requirements. However, the objective is always to learn how a cyber criminal might target your organisation in real life, and the steps that your security personnel would take to prevent attacks.

    But who exactly are the red and blue teams, and how can you conduct an assessment?

    What is a red team?

    Red teams are cyber security professionals who are experts in in the ways criminal hackers break through defences and steal sensitive data.

    Although these skills are often associated with criminal activity, they are also essential in cyber security. After all, you need to know how malicious hackers operate in order to anticipate their methods and block their attacks.

    Nonetheless, the read team acts as the adversaries in this assessment, and they will use their knowhow to try and capture sensitive information. Fortunately, there is no risk of a real-life data breach, as the ‘attackers’ are trusted personnel who agree not to abuse any data that they capture.

    This is a common practice in cyber security, with organisations often hiring ethical hackers or penetration testers to probe their systems in the same way that a criminal would.

    How a red team works

    The red team uses any number of techniques to look for and exploit weaknesses. This could mean finding technical vulnerabilities and flaws in the organisation’s processes, or duping employees with phishing attacks and other social engineering techniques.

    Typically, there are no limits on the actions that the red team can take. Anything that a cyber criminal might do is considered fair game.

    However, there might be times when an organisation asks the attackers not to perform certain actions. This could be, for instance, because it might disrupt regular business activities or because the organisation wants to focus on specific defence mechanisms.

    Red teaming usually begins with a detailed planning stage, in which the adversaries gain as much background information about the target as possible.

    They will start with the basics, such as the operating systems that the target uses, and the make and model of the networking equipment (such as computers, servers, firewalls and routers).

    In some cases, the red team might also look at physical controls, such as doors, locks, CCTV cameras and security, although most attacks are conducted entirely through digital means.

    With this information, the team will then look for vulnerabilities in those systems and create a map that outlines various paths to their destination. The techniques they use will vary greatly, but at some point, the attackers will usually attempt to steal user credentials.

    This gives them clear access to the organisation’s internal systems, where they can view anything that the employee whose account they’ve compromised can see. The attacker might also imitate that employee in an email or instant message in an attempt to grab more sensitive data.

    It’s therefore no surprise that red teams, like cyber criminals, target usernames and passwords ruthlessly, with an assortment of tactics ranging from brute-force attacks to phishing scams.

    What is a blue team?

    While the red team is on the attack in these exercises, the blue team is playing defence. The group is also comprised of cyber security professionals, and their goal is to identify the adversaries’ attempts to compromise the organisation and to protect its critical assets.

    The blue team’s tactics are guided by the organisation’s business objectives and security strategy. As such, they will have the same tools and knowledge that would be available in the event of a real-life attack.

    How a blue team works

    The blue team’s work begins long before the adversaries begin their attack. Their first job is to review the organisation’s security practices with a gap analysis and risk assessment in order to identify security weaknesses.

    With that information, they implement controls to close gaps and bolster the organisation’s systems. This might include, for instance, introducing stricter password policies, patching software or reminding employees about the threat of phishing.

    Networking monitoring tools are often also deployed, giving the blue team real-time information about people accessing the organisation’s systems. This is crucial to identify unusual or suspicious activity that would help them spot the red team’s efforts.

    It’s only after these threat prevention and detection tools are put in place that the blue team are ready to fend off the red team’s attacks.

    Although many organisations prioritise threat prevention as a security measure, it’s equally important to consider your ability to respond to attacks in progress. Organisations rarely get a chance to practice this, and it’s why red team vs blue team assessments are so helpful.

    How do the red team and blue team work together?

    Although the red and blue teams are on opposite sides during the assessment, they are both working to improve the organisation’s security posture.

    As such, they must work together to ensure that both sides are operating with the latest information. For instance, the blue team should stay up to date on emerging threat prevention technologies and share their findings with the red team.

    Likewise, the red team must keep an eye out for new hacking techniques, and explain to the blue team how they work.

    This type of communication is crucial between assessments, but depending on the objective of the test, the red team won’t necessarily inform the blue team about a planned attack.

    A surprise offensive is useful if the organisation wants to see how their security team responds to a crisis in a real-world scenario.

    Even in this scenario, however, someone in a management position should be aware of the test. Typically, this will be the top-level employee in the IT or cyber security team, who may also act as the manager of the blue team.

    This ensures that the senior personnel are aware that the activity is a drill while those responsible for incident response are not influenced by the knowledge that it’s only a practice.

    When the test is complete, both teams gather and share their findings. If the red team was successful, they will explain how they bypassed security systems and provide tips to combat future attacks.

    But if the blue team successfully repelled the attack, they would describe the steps they took to identify and thwart them.

    Both teams should then work together to plan, develop and implement stronger security controls where necessary.

    The purple team

    Although the activities of the red and blue team are designed to work in harmony, the reality is usually more complicated. The two sides will naturally be competitive, and they might be reluctant to share tips that helps their opponents.

    This is where the concept of a purple team comes in. As the name suggests, this team brings the red and blue team together to work in unison.

    Individual employees might take it in turns to play attack and defence, while everyone is encouraged to share ideas that help either side.

    Navigating the practicalities of a purple team can be tricky. For instance, it will be harder to spring a surprise attack on the blue team and therefore simulate a real-world attack.

    Likewise, the red team is often a more appealing option, as cyber security personnel break away from their day-to-day tasks and show off their hacking expertise. Persuading people to switch sides can therefore be tricky, and it will require strong leadership to keep everybody happy.

    However, when it’s done right, the purple team can prove an invaluable cyber security resource.

    Developing an effective assessment team

    Red and blue team assessments are among the most in-depth ways to manage cyber security.

    They are highly organised, and they put every part of your organisation to the test. You’ll gain a real-world understanding of the ways a cyber criminal might target your organisation and get a close-up view of the ways in which your defences hold up to attacks.

    Unfortunately, for many organisations, red and blue team assessments are impractical if not impossible. They either don’t have enough internal expertise to form opposing teams, or they don’t have the resources to conduct tests and monitor the results.

    But that doesn’t mean you can’t benefit from these sorts of assessment. With IT Governance’s  Red Team Assessment service, our team of experts will play the adversarial role and probe your organisation to see how you would handle an attack.

    Our team of ethical hackers will test your organisation and provide expert guidance on how to improve your organisation’s security posture.

    The scope of each engagement is tailored to your organisation’s requirements and goals, but in every assessment, we can:

    Attack scenarios can be crafted to emulate specific types of threat actor. We use traditional and non-traditional techniques to test your resilience to intrusion, fraud, data extraction, internal threats, corporate espionage and physical attacks.

    Resource : https://www.itgovernance.co.uk/blog/red-team-vs-blue-team-whats-the-difference

    13Jul, 2023
    NASA Engineers Help Create A Virtual World of Data

    For almost as long as it’s been a concept, NASA has been on the cutting edge of virtual reality (VR) technology. However, the space has seen a renaissance since the bulky headsets of the 1990s. Several high-profile companies now use VR for immersive video games and virtual chat rooms, but to some, this technology has a use beyond entertainment.

    NASA’s Jet Propulsion Laboratory in Southern California has been trying to improve data visualization for decades. When pictures come back from an alien world, scientists usually survey the environment with a panoramic photo, but this method has limitations. When observing a flat image, judging distances can be difficult.

    “Looking at pictures on a screen is a much different experience to walking through a canyon,” said Scott Davidoff, manager of the Human Centered Design Group at JPL.

    Davidoff began experimenting with VR using image data from the Curiosity rover on Mars. There had been attempts to solve the visual distance issue, like using 3D imagery viewable with red and blue filtered glasses, but nothing made scientists feel like they were really there. Davidoff and his colleagues decided to wrap the panorama around the scientist in a virtual environment. Geologists using VR in this way reported feeling like they were in the real Martian environment. They could ascertain the distance and size of features much more quickly and accurately than they could with a flat display, which sparked another idea. Davidoff thought that if viewing imagery in VR helped, it could be a game changer for more complex “multi-dimensional” data.

    “When you look at a network diagram as a system in 3D, it turns out your perception does something different,” Davidoff said. “We made a data world where an analyst could look at any science or engineering problem and see patterns and correlations more clearly than they can in a flat version.”

    At the same time, Ciro Donalek and George Djorgovski at the California Institute of Technology (Caltech) were researching how to use immersive environments for scientific data visualization and collaboration.

    The three of them teamed up to create software that uses 3D visualizations to examine relationships between points of data. Much like how viewing a three-dimensional Martian panorama allows for better interpretation, seeing data in virtual space makes spotting correlations easier.

    Obtaining an exclusive license from Caltech, which manages JPL, Donalek, Djorgovski, and new CEO Michael Amori founded Virtualitics Inc. of Pasadena, California, in 2016, with Davidoff in an advisory role. To further build out the software, they’ve incorporated features such as artificial intelligence to point out patterns and relationships in the visualized data.

    “We call it intelligent exploration. You’re using AI and 3D visualizations to quickly identify drivers and relationships in your data, and drive understanding in ways 2D graphs aren’t capable of,” Donalek, now CTO of Virtualitics, said. “You can start getting insights from your data right away because it’s literally drag and drop.”

    The software works on both desktop and VR and is compatible with several popular headsets. While the platform is designed for use anywhere there’s a significant amount of data, it is currently most often used in banking, retail, and medical research. It can visualize anything from a spreadsheet to a large “data lake” without having to move the data from where it resides. Donalek says the company maintains a relationship with JPL, and many of its 60 employees come from the center or Caltech.

    “One of them is from MIT, but we don’t hold it against him,” Donalek joked.

    Whether analysts are looking at science from the surface of Mars or stock trades on Wall Street, NASA’s visualization efforts have led to a whole new dimension of research.

    NASA has a long history of transferring technology to the private sector. The agency’s Spinoff publication profiles NASA technologies that have transformed into commercial products and services, demonstrating the broader benefits of America’s investment in its space program. Spinoff is a publication of the Technology Transfer program in NASA’s Space Technology Mission Directorate (STMD).

    Resource : https://www.nasa.gov/directorates/spacetech/spinoff/NASA_Engineers_Help_Create_A_Virtual_World_of_Data

    12Jul, 2023
    Web Security Gateway: Best Security Practices to Protect Enterprise Users

    Protecting employees from harmful content was a far more straightforward task once upon a time. COVID-19 changed all of that in an instant. The new hybrid work model has forced IT professionals to rethink their security strategy game plans. As threats continue to emerge, it becomes an ongoing game of cat and mouse for IT teams to outmaneuver cybercriminals.

    One of the biggest challenges is keeping up with the latest forms of malware. Kaspersky detected 516,617 malicious installation packages in Q1 2022. Any one of these packages could be unknowingly downloaded by a remote worker. 

    The focus then shifts to securing remote access to a corporate network to block dangerous websites and applications beyond the traditional perimeter that would give way to what we know as a Secure Web Gateway.

    A Secure Web Gateway or SWG, operates at the application level, unlike traditional firewalls that work by inspecting packets at the network level. It allows companies to enforce tighter security policies and block access to harmful sites with rules set by the admin, preventing malicious web traffic from entering a network.

    What is Enterprise Security Architecture?

    Enterprise security architecture is a term that encompasses all the policies, principles, and models implemented by an organization to ensure that the network is protected from cyber threats. Security architecture involves a detailed plan for web security that incorporates different security concepts and tools such as tiered networks, security domains, security policies, and different types of security systems and devices.

    An enterprise’s security architecture must include a layered plan covering all web security bases and implementing various security models and devices as needed. Enterprise security architecture recognizes that it is not enough to have standard security measures in place but they must be implemented expertly and accurately to ensure complete protection.

    Preparing efficient enterprise security architecture takes place in the following stages:

    • Research and risk assessment
    • Security protocol and system design
    • Security implementation and installation
    • Testing, assurance, and system operations and monitoring

    How an SWG Works in a Modern Enterprise Security Architecture Setting

    Secure Web Gateways can be immediately incorporated into an enterprise’s security architecture. They provide multi-layered protection covering different web security areas and protecting remote employees requiring corporate network access.

    Modern enterprise security architecture includes the most progressive methods, systems, and models for web security. Secure web gateways are one of these.

    A SWG provides the following features:

    Traffic Monitoring

    All traffic that passes through a network is inspected and monitored. Content not aligning with corporate policies can be immediately blocked or restricted. Default turnkey inspection policies can be customized to suit the organization’s needs.

    Enforcing Corporate Policies

    The security policies of a network determine who and what is allowed on the network, where or when they are allowed, and what kinds of interactions are permissible between internal users. These policies can be enforced to ensure all employees safely access the corporate network, regardless of device or location.

    URL Filtering

    A Secure Web Gateway can protect users by blocking access to known malicious websites. This can be done by setting restrictions on certain websites and applications. Permissions may be either “allowed” or “restricted” based on the employee’s role. Specific sites like gambling, gaming, and social media may be blocked by default, increasing productivity and minimizing the threat surface.

    Conclusion

    A Secure Web Gateway is an ideal addition to any enterprise security architecture’s line of defense. They provide a well-rounded form of security that protects an organization’s network and workforce from malicious threats. It also prevents Shadow IT, where employees use IT-related software without authorization or knowledge from the IT department. Avoid the risks and add a Secure Web Gateway to your enterprise security today.

    Resource : https://cybersecuritynews.com/secure-web-gateway-to-protect-enterpris/

    12Jul, 2023
    OpenAI launches new grant program for cybersecurity professionals

    OpenAI announced that it is launching the Cybersecurity Grant Program, which is a $1 million initiative to boost and quantify AI-powered cybersecurity capabilities and to foster high-level AI and cybersecurity discourse. 

    The company aims to collaborate with security professionals worldwide in order to shift the balance of power in cybersecurity. Their strategy involves leveraging AI technology and fostering coordination among individuals who share the same objectives, all working towards the common goal of ensuring collective safety.

    OpenAI’s primary objective is to empower security teams by prioritizing access to advanced AI capabilities. They are committed to measuring the cybersecurity potential of AI models, aiming to create methods that accurately assess and enhance their efficacy. 

    Additionally, the company endeavors to elevate the discourse surrounding AI and cybersecurity, fostering in-depth and meticulous discussions that facilitate a comprehensive understanding of the challenges and opportunities within this field, according to OpenAI in a blog post that contains additional details. 

    “A traditional view in cybersecurity is that the landscape naturally advantages attackers over defenders. This is summed up in the well-worn axiom: ‘Defense must be correct 100% of the time, attackers only have to be right once.’ While it may be true that attackers face fewer constraints and take advantage of their flexibility, defenders have something more valuable – coordination towards a common goal of keeping people safe,” the authors of the blog wrote.

    Resource : https://sdtimes.com/ai/openai-launches-new-grant-program-for-cybersecurity-professionals/

    5Jul, 2023
    What is the OWASP API Security Top 10?

    Since 2003, the non-profit Open Web Application Security Project (OWASP) has maintained its Top 10 list of the most severe and pervasive web-application security risks — otherwise known as the OWASP Top 10. Web developers and security practitioners use the OWASP Top 10 as a reference to avoid common and dangerous mistakes when building and maintaining web applications.

    From that main Top 10 list, OWASP has since spun off nearly a dozen “daughter” lists of Top 10 risks for other aspects of information security, such as desktop-application security, privacy, machine-learning security and mobile-device security.

    One of the most important daughter lists is the OWASP API Security Top 10 list, which first appeared in 2019 and was given a full refresh in early June 2023. This list concerns itself with application-programming interfaces (APIs), the bits of software that let two or more separate computer programs communicate and exchange information with each other.

    APIs are crucial to the development of software functions, and APIs for web applications, which communicate across the internet rather than through a closed network, are frequently sources of security vulnerabilities.

    “APIs are a critical part of modern mobile, SaaS, and web applications and can be found in customer-facing, partner-facing, and internal applications,” states the foreword to the 2023 OWASP API Security Top 10 list. “By nature, APIs expose application logic and sensitive data such as personally identifiable information (PII) and because of this, APIs have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.”

    The OWASP API Security Top 10 list doesn’t list specific vulnerabilities but rather categories of common weaknesses in APIs, especially web-based APIs, that often result in vulnerabilities. Like the main OWASP Top 10 list, developers and DevSecOps personnel use the OWASP API Security Top 10 list to guide their work and steer away from pitfalls.

    What’s on the OWASP API Security Top 10 list

    The final version of the OWASP API Security Top 10 list, released June 7, 2023, is as follows. We’ll briefly go through each item.

    1. Broken Object Level Authorization

    OWASP says that “APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues.”

    It gives the example of an automaker using vehicle identification numbers (VINs) to control cars via a mobile app without verifying vehicles’ authorized users. Because of that mistake, an attacker could use a VIN — visible through every vehicle’s windshield — to unlock and start someone else’s car.

    2. Broken Authentication

    “This category encompasses all sorts of weaknesses that could allow an attacker to act as a valid user,” explains Invicti’s Zbigniew Banach in a recent blog post, “whether by permitting credential stuffing for brute-force access, failing to verify token signatures, or simply allowing unauthenticated access in some circumstances.”

    3. Broken Object Property Level Authorization

    “This is closely related to object-level authorization failures but applies at a more granular level, where defining and enforcing access control is much harder,” writes Banach. “Even with proper access control to, say, customer data records, you still need to define who can perform which operations on which data fields, and whether they can import, export, or modify data in bulk.”

    4. Unrestricted Resource Consumption

    This one involves failing to guard against running out of bandwidth, memory, processing power or other basic resources so that systems aren’t overwhelmed by too many requests. This most commonly leads to a denial of service for authorized users, but OWASP’s examples show how a malicious third-party vendor could abuse such a weakness to rack up fraudulent charges.

    5. Broken Function Level Authorization

    “This category covers weaknesses that expose application functionality rather than data,” writes Banach. “For example, if an attacker can access the export operation for customer records, they could extract sensitive information in bulk even if they cannot access each customer record object separately.”

    6. Unrestricted Access to Sensitive Business Flows

    This weakness comes from a failure to detect and limit rapid-fire automated requests that might not create a security issue but could nonetheless harm the business. For example, bots exploit this to quickly buy up popular concert tickets, limited-edition sneakers or scarce gaming consoles, earning a profit for resellers while creating bad publicity for the retailers.

    7. Server-Side Request Forgery

    “In the context of APIs,” writes Banach, “server-side request forgery vulnerabilities allow attackers to smuggle URLs through an API and trick a back-end server into sending a request to that URL.”

    OWASP gives an example of an attacker inputting a specially crafted URL to a social-media network’s image-upload function, resulting in a port scan (often part of pre-attack reconnaissance) from inside the social-media company’s internal network.

    8. Security Misconfiguration

    One of the most severe weaknesses on the list, this type of flaw lets attackers probe for “unpatched flaws, common endpoints, services running with insecure default configurations, or unprotected files and directories” to break into systems, steal data or completely hijack servers, OWASP writes.

    9. Improper Inventory Management

    “As interfaces and their underlying applications both undergo changes,” writes Banach, “any gaps in version control and documentation can expose additional attack surfaces in the form of deprecated APIs that are still accessible or undocumented API endpoints that go unnoticed during testing.”

    10. Unsafe Consumption of APIs

    “In this case, ‘unsafe consumption’ refers to using data retrieved from an API without sanitizing and validating it to the same standard as user-supplied data,” explains Invicti’s Banach.

    Banach adds that injection attacks fall into this category, and OWASP indeed supplies an example of a malicious third-party vendor using SQL injection to steal data from a company through a vulnerable API.  

    How to use the OWASP API Security Top 10 list

    With every entry on the list, OWASP provides several suggestions for how to prevent that particular sort of weakness, as well as links to further references on the OWASP website and externally.

    For example, with item No. 3, Broken Object Property Level Authorization, the suggestions are:

    — When exposing an object using an API endpoint, always make sure that the user should have access to the object’s properties you expose.
    — Avoid using generic methods such as to_json() and to_string(). Instead, cherry-pick specific object properties you specifically want to return.
    — If possible, avoid using functions that automatically bind a client’s input into code variables, internal objects, or object properties (“Mass Assignment”).
    — Allow changes only to the object’s properties that should be updated by the client.
    — Implement a schema-based response validation mechanism as an extra layer of security. As part of this mechanism, define and enforce data returned by all API methods.
    — Keep returned data structures to the bare minimum, according to the business/functional requirements for the endpoint.

    Among all 10 entries, there are dozens of such suggestions. There are also two pages detailing and linking to further OWASP resources specifically for developers and DevSecOps personnel.

    “Building secure APIs is crucial,” states the latter page. “Security cannot be neglected, and it should be part of the whole development life cycle. Scanning and penetration testing yearly are no longer enough.”

    Resource : https://www.scmagazine.com/resource/application-security/what-is-the-owasp-api-security-top-10

    4Jul, 2023
    What is Cyberwar?

    Ask any three people to define cyberwar and you will get three different answers. But as global geopolitics worsen and aggressive cyberattacks increase, this becomes more than an academic question.

    The common view is that cyberwar is war in the cyber domain. This is only partially true. It is more productive to consider war and cyberwar as two separate entities, albeit with overlapping edges.

    The Merck insurance ruling illustrates this. For most people outside of government and military, the NotPetya attack against Ukraine was an obvious act of cyberwar. It was aggressive, it caused damage, and it was perpetrated by a Russian agency (the GRU) as part of an undeclared war against Ukraine. If it was an act of war within Ukraine, surely it was an act of war beyond Ukraine?

    The answer is no. NotPetya was never, technically, an act of cyberwar. Misunderstanding this and the definition of cyberwar cost the insurance industry $1.4 billion. Trying to shine a light on a common person’s actionable understanding of cyberwar and cybersecurity is the purpose of this article. 

    What is war?

    War is usually defined as kinetic military action between two nations, following the declaration of a state of war. This not a universal view. The purpose of war is for one party to exert supremacy over another – and this can be achieved by means other than armed conflict. It can be achieved just as effectively by economic means, by psyops including disinformation, or any other non-military means of effecting regime change.

    Kevin Tierney, VP of global cybersecurity at General Motors and a member of the CISA cybersecurity Advisory committee (CSAC), holds this wider view. “If two countries are fighting over something, it’s not always by kinetic means. Sometimes it involves economic disruption,” he told SecurityWeek.

    “If you disrupt large parts of the operational system of the target country, disrupt the financial systems, have a country lose trust in its information, lose governmental data, halt transportation or damage energy or water supplies, you can win a war without killing each other.”

    [See The Vulnerable Maritime Supply Chain – a Threat to the Global Economy for the potential effect of disrupting the maritime supply chain.]

    ADVERTISEMENT. SCROLL TO CONTINUE READING.

    The Cold War was an undeclared war, primarily non-kinetic (with localized flare-ups around the world), between the USSR and the West. The West prevailed in this war by economic means rather than force of arms – the USSR ceased to exist.

    But however you define war, there is a fundamental difference between the physical and cyber domains. Physical war is largely constrained within the national boundaries of the combatant nations. Cyberwar is not constrained by national boundaries and has a greater potential for spilling out to become global in effect, very rapidly. 

    Largely for this reason, cyberwar is usually and arbitrarily described as something separate to the wider concept of war. Cyberwar is neither viewed nor defined in the same terms as non-cyber-war.

    What is cyberwar?

    Most nations consider the correct response to a foreign nation-state’s cyberattack against their critical industries could include kinetic action. Cyber activity thus has the potential to spread accidentally and expand into a global military conflict. To limit this potential, the definition of what constitutes cyberwar must be, and is, set very high. 

    Most definitions ultimately derive from the Tallinn Manual – developed by international experts at the NATO Cooperative Cyber Defense Centre of Excellence based in Tallinn, Estonia. From this work, cyberwar is limited to cyber activity that causes, or can be expected to cause, death or destruction.

    Anything less than this is generally considered to be cyberespionage rather than cyberwar – and cyberespionage is specifically excluded by Tallinn. This ultimately leads to a common binary view of cyberwar based solely on the delivery of death or damage – especially if that occurs to the critical infrastructure.

    Tom Kellermann, senior VP of cyber strategy at Contrast Security, takes this view. “Cyberwarfare is when a nation state launches a destructive cyberattack against a critical infrastructure,” he told SecurityWeek. Almost everything else he would describe as cyberespionage.

    John Hultquist, VP of intelligence analysis at Mandiant, agrees. “Economic suppression isn’t war,” he said. He disagrees with calling the Cold War an actual war, describing the term as a metaphor. “The moment it is war is when violence or the threat of violence is being applied. I think that’s a crucial element. You only really cross that line when people start dying.” The implication is that anything that falls short of death (or at least the expectation and intent to cause death or destruction) can only –at the worst – be classified as cyberespionage and not part of cyberwar.

    The argument for excluding cyberespionage as a part of cyberwar is simple. It is spying conducted in the cyber domain. Spying is and always has been a part of everyday life, from individuals to corporations to governments. If spying is an act of war, the world has been at war with itself since the dawn of time. The only difference in the modern world is that cyber-spying is easier, more scalable, and more deniable than ever before.

    The danger here is the difference between genuine cyberespionage and actual cyberwar could be a simple instruction from a C2 server at any time, or a mistake from the attackers, or a bug in their software. This brings two other terms into the classification: expectation and intent, both of which are fundamentally subjective interpretations that are easily deniable by an aggressor.

    Vladimir Putin once famously denied government involvement in hacking, saying it may have been patriotic Russian citizens “contributing, as they believe, to the justified fight against those speaking ill of Russia.” In short, it wasn’t the Russian state, it didn’t cause death or destruction, and it cannot be considered an act of cyberwar.

    Deniability is important. In a western democracy, legality is defined by the courts. Knowing something is not enough – it must be provable to the higher standards of a civilian court. Intelligence agencies may know something to be true, but be unable to make public the source of their knowledge.

    Helder Figueira, founder at Incrypteon, studied and briefly practiced law before becoming an Electronic Warfare Signals Officer commanding a cryptanalysis unit with the South African Army. “Cyberwarfare is military action in the digital domain,” he said. “But a cyberattack by a sovereign state is hard to prove or identify. To complicate identification further, such activities are usually outsourced to independent contractors – which leads to the incidence of these activities increasing, since there are no actual diplomatic repercussions.” 

    He adds a further complication for the future. “Now imagine AI attackers waging ‘cyberwar’ against a target.” There are no legal remedies against a sub-contracted AI attacker.

    Dr. Stephanie Carter, principal of FedRAMP advisory services at Coalfire, comments, “The last official release of what this means was published by the Senate Armed Services Committee stating that ‘The determination of what constitutes an act of war in or out of cyberspace, would be made on a case-by-case and fact-specific basis by the President.’” 

    Right now, she continued, “We are at the mercy of the Presidents to declare what is a part of cyberwar and what is not. That decision will be greatly influenced by political power and national defense… the goal should be defining cyberwar so that there are only clear-cut lines, not ‘clear as mud’ interpretations.”

    NotPetya

    A commonsense view of NotPetya is that it was an act of cyberwar undertaken by Russia against Ukraine in 2017. There was an undeclared state of war between the two nations since the annexation of Crimea in 2014. The attack was perpetrated by a Russian state agency (the GRU), and it caused damage.

    It would be equal commonsense to view any collateral damage (such as that to the US pharmaceutical giant, Merck) to be a part of that act of cyberwar. However, on May 1, 2023, the US courts declared that the NotPetya attack could not be classified as an act of cyberwar. Among other arguments, the ruling stated, “While the attack caused property damage, there was no evidence the NotPetya malware caused bodily injury or death… the NotPetya attack is not sufficiently linked to a military action or objective as it was a non-military cyberattack against an accounting software provider.”

    Juan Andres Guerrero-Saade, senior director of SentinelLabs at SentinelOne and an adjunct professor of strategic studies at John Hopkins SAIS, explains some of the complexities in describing a cyberattack as an act of cyberwar. Firstly, can it be proven in a court of law (beyond simply known to the intelligence agencies) that it was delivered by (in this case) the GRU? “Who exactly did it; where they were sitting; what uniform were they wearing. Who ordered what, and to what extent was it a premeditated action rather than the result of fat fingering something that turned it from a simple cyberattack into a potential act of war?”

    This is where expectation and intent become important. The NotPetya weaponry could hardly be called a traditional weapon of war – it was fundamentally ransomware. The aggressor could simply claim that it was criminal ransomware that went wrong – certainly not an act of war. “In the context of intentional damage to critical infrastructure, I really like to point to malware such as Industroyer, as a really clear case,” continued Guerrero-Saade. “Industroyer has specialized tooling that is baked into the code and is specifically designed to interact with infrastructure so that it can damage it.”

    If it is difficult for a third party (the US) to prove NotPetya was an act of war within Ukraine, it becomes impossible to prove that collateral damage outside of Ukraine (such as that caused to Merck and very many other global companies) was caused by an act of cyberwar against the US or other nations. “I’m not sure how you could prove intent to cause collateral damage without having access to the notes or recording of the meeting at which the decision to use NotPetya was made,” comments Robin Long, founder of Kiowa Security.

    The basic problem is that much of the artifacts of any cyberattack are primarily dual purpose tools used as much for ‘friendly’ purposes as for nefarious purposes. “Many of the things that would be considered reconnaissance phases in cyber [and therefore a fat finger away from causing damage] are things that are currently being done to our systems every day by ad tracking networks, by Google – run of the mill things,” added Guerrero-Saade.

    But herein lies an example of the fundamental problems with what amounts to an interpretive definition of cyberwar. A cyberwar wiper could be delivered by ransomware with broken decryption and be invisible as an act of war. Any damage could be claimed as accidental to the proffered purpose of collecting money, while the perpetration could be blamed on criminals.

    This is not just a theoretical possibility. “The actors,” said Hultquist. “have known that for a long time. They were doing it before NotPetya. They were experimenting with that for a year. They’ve done it many, many times since the invasion in Ukraine. It’s a wonderful tool if you want to hide yourself behind an operation that looks criminal. I’ll go one step further,” he continued. “I’m certain that has already happened, and the real motivation has simply been ascribed to financial motivation.”

    The Colonial Pipeline incident demonstrates these blurred lines. It caused damage to the critical infrastructure but is not classed as an act of cyberwar. “If you look at Colonial Pipeline” comments Hultquist, “there was a massive disruption to American critical infrastructure. But the intent wasn’t to disrupt the infrastructure, the intent was to just make money. So, although it followed the same sort of blueprint you might expect from a state actor in a time of war, it was just designed to make money.”

    Now apply this reasoning to Russian meddling in the 2016 US elections. To many, it may appear to be an attempt at engineering regime change – from a global liberalism to a local America First platform (and from there to a weakened NATO and a more successful war against Ukraine). While attempted regime change might seem an obvious act of war, how can you prove this when you cannot prove the perpetrator in a court of law, no physical damage was done, and nobody died?

    So, what is the definition of Cyberwar?

    The official definition is clear: it must result in physical damage and or loss of life. Cyberespionage is excluded. Intent, which is largely a value judgment by the defender, is part of the argument. It is perpetrated by one nation state against another nation state. Knowing that an action is an act of cyberwar is not enough – it must be provable to a western democracy’s court of law.

    The difficulties in this semi-formal definition are not all bad because it allows flexibility in government response. A government is not required to ask a civilian court of law, ‘is this an act of war to which we can respond?’ Politically, the government can simply say, this is too much – we respond. 

    The international danger is that the UK made it clear as long ago as 2018 that it considers an actual cyberwar attack can legally trigger in an immediate and unannounced kinetic response; and that since this is an interpretation of international law, any of its allies can take a similar stance. For this ultimate reason, the definition of cyberwar is purposely set high.

    The Merck ruling makes it clear that the political/military definition of cyberwar is not a common person’s understanding of cyberwar. The correct response to what appears to be cyberwar needs to be based on the visible effect of a nation-state or nation affiliated attack, and not a government’s definition of cyberwar.

    Does it matter?

    A cyber act that is a clearcut act of cyberwar could easily demand or spiral into military kinetic retribution. For the reasons we have discussed, that final decision is ultimately left to the President – and that being so, the final question we need to ask is whether this distinction between cyberwar and cyberespionage has any practical relevance to the corporate cyber defender. After all, that defender must be resilient to all attacks by whomever and for whatever purpose.

    Just as there are multiple opinions on the constitution of cyberwar and its relation to general war, there are multiple answers to this question.

    “There’s a risk equation,” says Malcolm Harkins, chief security and trust officer at Epiphany Systems. “Risk is a function of threat, vulnerability, and consequence. I have no ability to control either the threat actor or the threat agent – it’s an uncontrollable variable. As a CISO, the only thing I have in my ability to manage security for my organization is my ability to manage how exploitable I am. That’s the only thing I can control. Everything else is just what it is. Running security is managing exploitability. If I over-focus on the nature of the perpetrator, I’m wasting time, because I have no ability to affect the actor.”

    Hultquist has a different view. “It absolutely matters. You can’t do risk assessments if you don’t care who the attacker is. If you were in Ukraine two years ago and were responsible for securing the IT infrastructure, and you decided it didn’t matter whether or not there was a war looming, you would have failed. If you don’t consider who the adversary is, you can’t begin to secure your systems.”

    He continued, “We sometimes forget to ask, who are the bad guys and what capabilities do they have – when will they attack and when will they not attack? Am I even at risk of these people? Imagine it’s the eve of World War Two, and you are responsible for making all the purchasing decisions for the military. You want to know what capabilities the enemy has developed, but somebody says to you: ‘You don’t need to know that; you can just make decisions based on what you think is best.’“

    A third, potentially more political view comes from Guerrero-Saade. “This should be a very real nuanced concern for people both as citizens of law-abiding nations and as people trying to figure out what the right measures are for defense.” If the President is ultimately responsible for the right measures beyond CISOs defending their networks, we need to understand the arguments underlying those decisions taken in our name.

    4Jul, 2023
    The Impacts of Data Loss on Your Organization

    What are the causes of Data Loss and which are their impact on your organization?

    In today’s digital age, data has become the lifeblood of organizations, driving critical decision-making, improving operational efficiency, and allowing for smoother innovation. Simply put, businesses heavily rely on data. In an era where data has become the cornerstone of business operations, the loss of vital information can result in severe setbacks and irreparable damage. Whether it’s due to accidental deletion, hardware failure, cyber-attacks, or natural disasters, the loss of valuable data can have devastating impacts on an organization. In a survey, it was found that 26% of businesses suffered some form of data loss in 2022, bringing to light worrisome statistics and further stressing the need for organizations to simply be more proactive in protecting their data.

    Types of Data

    Organizations deal with different types of data in their day-to-day activities. Understanding the different types of data is crucial for organizations as it helps them devise appropriate data protection and management strategies. Data can be classified into;

    Structured Data:

    Structured data refers to information that is organized in a predefined format. It is usually stored in databases and can be easily categorized and analyzed. Structured data is highly valuable for generating reports, performing statistical analysis, and gaining insights into operational efficiency.

    Examples: Customer Personal Identifiable Information, transactional data, inventory records, and financial statements.

    Unstructured Data:

    Unstructured data, on the other hand, is characterized by its lack of organization and predefined format. It includes information that does not fit neatly into databases or spreadsheets. Extracting meaningful insights from unstructured data can be challenging, but advancements in natural language processing and machine learning techniques have enabled organizations to derive valuable insights from this vast and untapped data source.

    Examples: emails, social media posts, customer feedback, audio and video files, images, and documents.

    Semi-Structured Data:

    Semi-structured data lies between the structured and unstructured categories. It contains elements of both organized and unorganized data. While this type of data may have some level of organization, it lacks a rigid schema or predefined structure, requiring specific parsing techniques to extract relevant information.

    Examples: XML files, JSON files, and log files.

    MetaData:

    Metadata refers to data about data. It provides context and information about the characteristics, properties, and attributes of other data. This additional layer of information is essential for data management, data governance, and data integration processes.

    Example: Metadata can include information about the source, creation date, file format, or authorship of a document.

    Causes of Data Loss:

    Data loss is almost inevitable and can occur in any organization of any size at any scale. Understanding what can lead to a loss of data is important for organizations when drafting their cyber security policies, especially with relating to compliance. Data loss can be a result of technical issues, human error, and malicious activities. For better context, the causes of data loss are:

    Hardware Failures: Hardware failures can occur at any time. The longer hardware is being used, the more wear and tear occurs in its basic components. Over time, these components housing sensitive data can fail and shut down, leading to data loss. Without adequate backups, the data they house can be lost forever.

    Human Error: Human error is another contributing factor to data loss, one that accounts for a significant portion of data loss incidents. Accidental actions by employees, such as deleting files, formatting drives, or overwriting data, can result in the loss of data. These errors may occur due to a lack of awareness, improper training, or simple oversight.

    Software Corruption: Software are not infallible products. They can experience failures that can occur due to bugs, malware, operational glitches, or runtime conflicts between different applications on an operating system. Software vulnerabilities can also be exploited using malware to steal and/or corrupt the data they house.

    Cyber Attacks: Cyber-attacks are another cause of data loss. Cyber-attacks can include malware infections, ransomware, rootkits, viruses, and worms. They pose a significant threat to data security. These cyberattacks can gain unauthorized access to systems, steal or encrypt data, or delete valuable information.

    Natural Disasters: Natural disasters occur unexpectedly and can cause severe physical damage to infrastructure of all kinds. When natural disasters affect physical data storage devices, it can lead to data loss especially if backups and disaster recovery plans are not in place.

    Theft or Loss of Devices: At times, data storages can simply be stolen or lost, potentially exposing sensitive data to unauthorized individuals.  Encrypting physical storage devices, and following industry guidelines for the storage and transport of these physical devices is a good way to mitigate data theft and loss.

    Power Failures/Outages: Unexpected outages can inadvertently lead to hardware failure by interrupting ongoing operations, resulting in data loss. A permanent loss of this data can then occur in a situation where there are no backup copies.

    Consequences of Data Loss

    Data loss has a wide range of consequences ranging from financial loss and intellectual property theft to operational disruption and Legal and Regulatory consequences. Some of the consequences of data loss are;

    Financial Loss: Financial loss can be devastating to organizations. The finances associated with data recovery efforts, potential legal actions, business interruptions, and reputational damage can be a lot for any organization to have to bear. Financial loss can also lead to revenue decline, especially if organizations have not yet recovered fully.

    Operational Disruption: Data loss can disrupt the way organizations function. Without employee access to essential data and systems, day-to-day functionality can become challenging. Leading to reduced operational functionality which can invariably lead to reputational damage and a loss in revenue.

    Reputational Damage: Data loss incidents can severely damage an organization’s reputation and erode the trust of customers, partners, and stakeholders. Rebuilding trust and restoring a damaged reputation can be a challenging and time-consuming process. Especially if the organization does not have the right business continuity and disaster recovery processes in place.

    Legal and Regulatory Consequences: Data loss can have legal and regulatory ramifications on organizations, especially when it involves the loss of personally identifiable information (PII) or sensitive data subject to data protection laws. Organizations may face penalties, fines, or legal actions if they fail to comply with data privacy regulations, such as the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA).

    Increased risks to future cyber-attacks: Data loss incidents can leave organizations more vulnerable to future cyber-attacks. This would be the case if the data loss was a result of an exploited vulnerability in the software or systems. Malicious actors could decide to exploit these vulnerabilities in subsequent attacks, leading to a heightened risk of further data loss or security breaches.

    Intellectual Property (IP) Theft: Data loss can also involve the loss or theft of valuable intellectual property, trade secrets, or proprietary information. This can directly impact an organization’s competitiveness, market position, and future innovations.

    How to prevent a data loss

    Reducing or preventing data loss is crucial for organizations and their operational health. Here are some ways organizations can prevent data loss;

    • Implement regular data backups.
    • Ensure robust cybersecurity measures and protocols.
    • Train employees on data security best practices.
    • Use encryption to protect sensitive data.
    • Establish access controls and permissions.
    • Conduct regular vulnerability assessments and penetration testing.
    • Develop and implement a comprehensive data loss prevention strategy.

    Resource : https://securityaffairs.com/148086/security/impacts-of-data-loss.html

    3Jul, 2023
    10 Essential Figma Plugins for Frontend Developers in 2023

    In 2023, tools for frontend developers drop by the minute, and Figma might be the most visually appealing. The cloud-based UX and UI design tool that simplifies almost any design process recently scored a scanty 20-billion-dollar sale, and it was partly for allowing programmers and designers — yes, two tribes that are often considered worlds apart — to create user interfaces for mobile and web applications and collaborate without hassles.

    Just like the legacy Photoshop allowed users to install fonts or bokeh presets, or just like Chrome can be revved up with convenient extensions, Figma lets in several plugins that developers can use to boost its capacity a notch up. Installing plugins is very easy: You only have to click the “Install” button on the websites we’re about to feature.

    With so many options out there, this article will focus on the best UI and Web Development Figma plugins. These are the latest and most relevant ones, useful and approachable for frontend developers in 2023.

    1. Figma to React 

    Figma to React converts your Figma to React codes instantly. This plugin aids in this process by turning Figma designs into usable React components, effectively translating the visual design into code.

    To better understand this, let’s consider a simplified example. Suppose you design a simple button in Figma with the label “Submit” (or “absenden,” if you’re working for a Munich startup). In Figma, you would visually design the button with the appropriate size, colours, and text. With the Figma to React plugin, you can convert this design to a fundamental React component, which might look like the following:

    The Figma to React plugin does much more than this simple example, as it can convert complex designs with multiple components, nested elements, and dynamic behaviour. However, the basic concept remains the same: the visual design in Figma is converted into a React component (or components) that you can use in your actual application. Sounds like a 20-billion-dollar idea, doesn’t it?

    2. Figma GPT

    Figma GPT is a plugin that can have “conversations” (mind the quotation marks) with ChatGPT. With this shortcut, you’ll be able to make use of all the advantages of ChatGPT without leaving Figma. You can also run AI code generation (which can be easily copied and executed) and code completion.

    Want one Easter Egg? Online users reported that ChatGPT’s API won’t stash away information like chatting on the official ChatGPT website does. This means the API is way more convenient if you’re concerned about privacy or intellectual property. So, if you’re a potential Samsung employee, make sure you mention you’ve already ensured you won’t share any copyrighted content with OpenAI. On the other hand, this is your opportunity to create a browser-based chat web app that interacts with a LLM but does not store your information or conversations. How about PrivacyGPT for a name?

    3. Anima 

    The Anima Figma plugin is a tool that allows designers to export their Figma designs to HTML, React, and Vue code. With Anima, designers can create fully responsive prototypes, add live text inputs, videos, charts, Google Maps, and more. 

    The plugin also offers collaboration tools to build consensus across teams and create real experiences rather than clickable prototypes. Additionally, Anima offers a Storybook add-on that extracts the Storybook data and transforms stories into Figma components for a better design-development workflow.

    (If you still haven’t caught wind of it, Storybookis an open-source tool that allows developers to build, test, and document UI components in isolation. By using a plugin to extract the data from Storybook and transform it into Figma components, designers can easily design and prototype with up-to-date and accurate components, and developers can build components that are consistent with the design and functionality of the final product.)

    4. Forms 

    Forms is (or are?) a plugin that can generate various forms that can be customised and integrated with your design library. You can customise your forms, their typography, spacings, and colours.  There’s no need to create variations for error, disabled, focus, and hover states, as every form element will automatically generate them. 

    5. SVG Motion

    The SVG Motion plugin for Figma is a tool that animates vector lines with the “Stroke” property to create animations of logos, backgrounds, titles, loaders, John Lennon headshots, and more. It allows users to quickly and easily create vector line animations within their Figma designs. The plugin is available for purchase and has been used by designers and businesses to create animated graphics and icons for websites and other digital assets.

    Their creators are going against the tidal wave of Internet purchases, though: they sell the plugin for a single payment of $39 — with no recurring subscriptions. If you’re not convinced, browse through their obviously Figma-based, picturesque website.

    6. Run Plugin API  

    Brought to the Figma community by a self-assessed developer and designer, Run Plugin API is a plugin that can, as the name states, run the Figma Plugin API, which allows developers to create their own plugins that can be run within the Figma design interface. The Plugin API enables communication between Figma and external applications or services using JavaScript, HTML, and CSS.

    Run Plugin API can be highly beneficial for frontend developers in several ways:

    • Creating custom plugins: As a frontend developer, you might have specific workflows or tasks that you perform repeatedly when designing interfaces in Figma. You can automate them. Or maybe you want to land a spot in this article. That’s why this plugin is so meta.
    • Learning and experimentation: If you’re a frontend developer looking to learn more about plugin development or are interested in experimenting with the Figma Plugin API, the Run Plugin API plugin provides a sandbox for you to test, learn, and iterate. 
    • Bridging design and development: With the Run Plugin API plugin, you can manipulate Figma documents programmatically, using code.
    • Prototyping and testing: Developers can use the Run Plugin API plugin to prototype and test out ideas for new plugins or to create proof-of-concept models for new functionality.

    7. Stark 

    Stark is a convenient tool that helps every frontend developer create and test accessible software in record time. The plugin checks for colour contrast, text spacing, image alt text, and other accessibility properties, and provides suggestions for improving these properties. By using the Stark plugin, frontend developers can create software that is more inclusive and accessible to users with different abilities, which can lead to a better user experience for everyone. So if you want your website to be accessible in stark contrast to your competitor’s, run this plugin.

    8. Inspector 

    Inspector is a plugin that provides an easy way to view and explore node properties. You only need to click on a layer to display that node’s properties and styles within the inspector panel.  

    Each of them has a copy-to-clipboard button for finding the properties you need while working on Figma. The Inspector plugin is a useful tool for developers who need to access node properties in their Figma projects, without having to use console.log statements.

    So, for instance, if a button in your Figma design has a Hex colour value of “#C0C0C0”, font size of “16px”, and padding of “10px”, these values can be quickly copied from the Inspector panel and pasted into your CSS code.

    9. Instance Finder 

    The Instance Finder plugin allows users to find all instances of a specific component used in their Figma file, by searching through all pages and frames. It creates a list of all instances used, which can save time when working on larger Figma projects with multiple instances of the same component. The Instance Finder plugin is a useful tool for designers and developers who need to manage and locate components within their Figma files.

    Ever noticed a website using two different shades of blue for two seemingly paired buttons? Instance Finder can also support a frontend developer’s consistency in design by ensuring that the same components are being used consistently throughout the project.

    10. Flowbase Component Library 

    Flowbase Component Library is only a plugin because it exists in Figma’s “plugins” section; it’s more like a catch-all Swiss Army resource repository. This so-called plugin — an understatement, certainly — gives you access to over 1000 components which you can copy and paste instantly. Wireframes, templates, and layouts are all ready for the fatigued frontend developers to snatch up, so that lack of inspiration won’t be an issue here. If “Leave the design for designers, let’s focus on the development” were a plugin, it could be this one.

    Resource : https://www.wearedevelopers.com/magazine/figma-plugins-for-frontend-developers