• Search for:
    14Jul, 2023
    API Penetration Testing Checklist

    API security is an undervalued but crucial aspect of information security. Cyber attacks often target APIs and web applications. To remain secure, organisations must test their systems to find and eliminate any weaknesses.

    Organisations can achieve this with API penetration tests. An ethical hacker (or ‘penetration tester’) will examine your applications using the same techniques that a cyber criminal would use. This gives you a real-world insight into the way someone might compromise your systems.

    Web application and API tests look specifically at security vulnerabilities introduced during the development or implementation of software or websites. There is no single checklist of how exactly the test should be conducted, but there are general guidelines.

    Benefits of API penetration testing

    The primary purpose of an API penetration test is to protect your organisation from data breaches. This is crucial given the increased risk of cyber attacks in recent years. According to a UK government report, 39% of surveyed organisations said they suffered a security breach in the past year.

    By conducting an API penetration test, you will gain a real-world overview of one of the biggest security threats that organisations face. The tester will use their experience to provide guidance on specific risks and advise you on how to address them.

    But penetration tests aren’t only about closing security vulnerabilities. Mitigating the risk of security incidents has several other benefits.

    For instance, you protect brand loyalty and corporate image by reducing the likelihood of a costly and potentially embarrassing incident.

    Penetration testing also helps you demonstrate to clients and potential partners that you take cyber security seriously. This gives you a competitive advantage and could help you land higher-value contracts.

    Most notably, penetration testing is a requirement for several laws and regulations. Article 32 of the GDPR mandates organisations to regularly conduct tests and evaluations.

    This is to assess the effectiveness of the technical and organisational measures employed to protect personal data.

    Likewise, if your organisation is subject to the PCI DSS (Payment Card Industry Data Security Standard), you must conduct external penetration tests at least once per year and after any significant changes are made to your systems.

    API penetration testing checklist

    IT Governance has its own proprietary checklist when conducting API and web application penetration tests.

    The system is modelled on the OSSTMM (Open Source Security Testing Methodology Manual) and the OWASP (Open Web Application Security Project) methodologies.

    A high-level overview of our process is outlined below, with a brief description of what is assessed during each section.

    1. Authentication

    The penetration tester ensures that appropriate mechanisms are in place to confirm a user’s identity. They then review how the authentication process works, using that information to circumvent the authentication mechanism.

    2. Authorisation

    The tester verifies that access to resources is provided only to those permitted to use them.

    Once roles and privileges are understood, the tester tries to bypass the authorization schema. They search for path-traversal vulnerabilities and ways to increase the privileges given to the tester’s user role.

    3. Session management

    The tester ensures that effective session management configurations are implemented. This broadly covers anything from how user authentication is performed to what happens when logging out.

    4. Input validation and sanitisation

    The tester checks that the application appropriately validates and sanitises all input from the user or the environment before using it.

    This includes checking common input validation vulnerabilities such as cross-site scripting and SQL injection, as well as other checks such as file uploads, antivirus detection and file download weaknesses.

    5. Server configuration

    The tester analyses the deployed configuration of the server that hosts the web application. They then verify that the application server has gone through an appropriate hardening process.

    6. Encryption

    The tester assesses encryption security around the transmission of communication. This includes checking for common weaknesses in SSL/TLS configurations and verifying that all sensitive data is being securely transferred.

    7. Information leakage

    The tester reviews the application configuration to ensure that information is not being leaked.

    This is assessed by reviewing configurations and examining how the application communicates to discover any information disclosure that could cause a security risk.

    8. Application workflow

    The tester determines whether the application processes and workflows can be bypassed.

    Tests are conducted to ensure that application workflows cannot be bypassed by either tampering with the parameters or forcefully browsing. This ensures the integrity of the data.

    9. Application logic

    The tester analyses how the application uses, stores, and maintains data. They do this by checking the underlying technology and any mitigating controls that may affect the risk to the application.

    10. Report

    The tester documents their findings. Their reports contain an executive summary, which provides a high-level, non-technical summary of any identified vulnerabilities, alongside a summary of the organisation’s business risks and an overall risk rating.

    It also contains a comprehensive review of testing details, such as the scope of the assessment, descriptions of the vulnerabilities identified and their impact, plus proofs of concept that support the findings.

    Finally, the report provides the tester’s commentary, where they discuss the issues identified and how the vulnerabilities could be linked within an attack chain. This is supplemented with remediation advice and supporting references.

    Resource : https://www.itgovernance.co.uk/blog/api-penetration-testing-checklist

    5Jul, 2023
    What is the OWASP API Security Top 10?

    Since 2003, the non-profit Open Web Application Security Project (OWASP) has maintained its Top 10 list of the most severe and pervasive web-application security risks — otherwise known as the OWASP Top 10. Web developers and security practitioners use the OWASP Top 10 as a reference to avoid common and dangerous mistakes when building and maintaining web applications.

    From that main Top 10 list, OWASP has since spun off nearly a dozen “daughter” lists of Top 10 risks for other aspects of information security, such as desktop-application security, privacy, machine-learning security and mobile-device security.

    One of the most important daughter lists is the OWASP API Security Top 10 list, which first appeared in 2019 and was given a full refresh in early June 2023. This list concerns itself with application-programming interfaces (APIs), the bits of software that let two or more separate computer programs communicate and exchange information with each other.

    APIs are crucial to the development of software functions, and APIs for web applications, which communicate across the internet rather than through a closed network, are frequently sources of security vulnerabilities.

    “APIs are a critical part of modern mobile, SaaS, and web applications and can be found in customer-facing, partner-facing, and internal applications,” states the foreword to the 2023 OWASP API Security Top 10 list. “By nature, APIs expose application logic and sensitive data such as personally identifiable information (PII) and because of this, APIs have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.”

    The OWASP API Security Top 10 list doesn’t list specific vulnerabilities but rather categories of common weaknesses in APIs, especially web-based APIs, that often result in vulnerabilities. Like the main OWASP Top 10 list, developers and DevSecOps personnel use the OWASP API Security Top 10 list to guide their work and steer away from pitfalls.

    What’s on the OWASP API Security Top 10 list

    The final version of the OWASP API Security Top 10 list, released June 7, 2023, is as follows. We’ll briefly go through each item.

    1. Broken Object Level Authorization

    OWASP says that “APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues.”

    It gives the example of an automaker using vehicle identification numbers (VINs) to control cars via a mobile app without verifying vehicles’ authorized users. Because of that mistake, an attacker could use a VIN — visible through every vehicle’s windshield — to unlock and start someone else’s car.

    2. Broken Authentication

    “This category encompasses all sorts of weaknesses that could allow an attacker to act as a valid user,” explains Invicti’s Zbigniew Banach in a recent blog post, “whether by permitting credential stuffing for brute-force access, failing to verify token signatures, or simply allowing unauthenticated access in some circumstances.”

    3. Broken Object Property Level Authorization

    “This is closely related to object-level authorization failures but applies at a more granular level, where defining and enforcing access control is much harder,” writes Banach. “Even with proper access control to, say, customer data records, you still need to define who can perform which operations on which data fields, and whether they can import, export, or modify data in bulk.”

    4. Unrestricted Resource Consumption

    This one involves failing to guard against running out of bandwidth, memory, processing power or other basic resources so that systems aren’t overwhelmed by too many requests. This most commonly leads to a denial of service for authorized users, but OWASP’s examples show how a malicious third-party vendor could abuse such a weakness to rack up fraudulent charges.

    5. Broken Function Level Authorization

    “This category covers weaknesses that expose application functionality rather than data,” writes Banach. “For example, if an attacker can access the export operation for customer records, they could extract sensitive information in bulk even if they cannot access each customer record object separately.”

    6. Unrestricted Access to Sensitive Business Flows

    This weakness comes from a failure to detect and limit rapid-fire automated requests that might not create a security issue but could nonetheless harm the business. For example, bots exploit this to quickly buy up popular concert tickets, limited-edition sneakers or scarce gaming consoles, earning a profit for resellers while creating bad publicity for the retailers.

    7. Server-Side Request Forgery

    “In the context of APIs,” writes Banach, “server-side request forgery vulnerabilities allow attackers to smuggle URLs through an API and trick a back-end server into sending a request to that URL.”

    OWASP gives an example of an attacker inputting a specially crafted URL to a social-media network’s image-upload function, resulting in a port scan (often part of pre-attack reconnaissance) from inside the social-media company’s internal network.

    8. Security Misconfiguration

    One of the most severe weaknesses on the list, this type of flaw lets attackers probe for “unpatched flaws, common endpoints, services running with insecure default configurations, or unprotected files and directories” to break into systems, steal data or completely hijack servers, OWASP writes.

    9. Improper Inventory Management

    “As interfaces and their underlying applications both undergo changes,” writes Banach, “any gaps in version control and documentation can expose additional attack surfaces in the form of deprecated APIs that are still accessible or undocumented API endpoints that go unnoticed during testing.”

    10. Unsafe Consumption of APIs

    “In this case, ‘unsafe consumption’ refers to using data retrieved from an API without sanitizing and validating it to the same standard as user-supplied data,” explains Invicti’s Banach.

    Banach adds that injection attacks fall into this category, and OWASP indeed supplies an example of a malicious third-party vendor using SQL injection to steal data from a company through a vulnerable API.  

    How to use the OWASP API Security Top 10 list

    With every entry on the list, OWASP provides several suggestions for how to prevent that particular sort of weakness, as well as links to further references on the OWASP website and externally.

    For example, with item No. 3, Broken Object Property Level Authorization, the suggestions are:

    — When exposing an object using an API endpoint, always make sure that the user should have access to the object’s properties you expose.
    — Avoid using generic methods such as to_json() and to_string(). Instead, cherry-pick specific object properties you specifically want to return.
    — If possible, avoid using functions that automatically bind a client’s input into code variables, internal objects, or object properties (“Mass Assignment”).
    — Allow changes only to the object’s properties that should be updated by the client.
    — Implement a schema-based response validation mechanism as an extra layer of security. As part of this mechanism, define and enforce data returned by all API methods.
    — Keep returned data structures to the bare minimum, according to the business/functional requirements for the endpoint.

    Among all 10 entries, there are dozens of such suggestions. There are also two pages detailing and linking to further OWASP resources specifically for developers and DevSecOps personnel.

    “Building secure APIs is crucial,” states the latter page. “Security cannot be neglected, and it should be part of the whole development life cycle. Scanning and penetration testing yearly are no longer enough.”

    Resource : https://www.scmagazine.com/resource/application-security/what-is-the-owasp-api-security-top-10

    26Jun, 2023
    API Penetration Testing Checklist

    API security is an undervalued but crucial aspect of information security. Cyber attacks often target APIs and web applications. To remain secure, organisations must test their systems to find and eliminate any weaknesses.

    Organisations can achieve this with API penetration tests. An ethical hacker (or ‘penetration tester’) will examine your applications using the same techniques that a cyber criminal would use. This gives you a real-world insight into the way someone might compromise your systems.

    Web application and API tests look specifically at security vulnerabilities introduced during the development or implementation of software or websites. There is no single checklist of how exactly the test should be conducted, but there are general guidelines.

    Benefits of API penetration testing

    The primary purpose of an API penetration test is to protect your organisation from data breaches. This is crucial given the increased risk of cyber attacks in recent years. According to a UK government report, 39% of surveyed organisations said they suffered a security breach in the past year.

    By conducting an API penetration test, you will gain a real-world overview of one of the biggest security threats that organisations face. The tester will use their experience to provide guidance on specific risks and advise you on how to address them.

    But penetration tests aren’t only about closing security vulnerabilities. Mitigating the risk of security incidents has several other benefits.

    For instance, you protect brand loyalty and corporate image by reducing the likelihood of a costly and potentially embarrassing incident.

    Penetration testing also helps you demonstrate to clients and potential partners that you take cyber security seriously. This gives you a competitive advantage and could help you land higher-value contracts.

    Most notably, penetration testing is a requirement for several laws and regulations. Article 32 of the GDPR mandates organisations to regularly conduct tests and evaluations.

    This is to assess the effectiveness of the technical and organisational measures employed to protect personal data.

    Likewise, if your organisation is subject to the PCI DSS (Payment Card Industry Data Security Standard), you must conduct external penetration tests at least once per year and after any significant changes are made to your systems.

    API penetration testing checklist

    IT Governance has its own proprietary checklist when conducting API and web application penetration tests.

    The system is modelled on the OSSTMM (Open Source Security Testing Methodology Manual) and the OWASP (Open Web Application Security Project) methodologies.

    A high-level overview of our process is outlined below, with a brief description of what is assessed during each section.

    1. Authentication

    The penetration tester ensures that appropriate mechanisms are in place to confirm a user’s identity. They then review how the authentication process works, using that information to circumvent the authentication mechanism.

    2. Authorisation

    The tester verifies that access to resources is provided only to those permitted to use them.

    Once roles and privileges are understood, the tester tries to bypass the authorization schema. They search for path-traversal vulnerabilities and ways to increase the privileges given to the tester’s user role.

    3. Session management

    The tester ensures that effective session management configurations are implemented. This broadly covers anything from how user authentication is performed to what happens when logging out.

    4. Input validation and sanitisation

    The tester checks that the application appropriately validates and sanitises all input from the user or the environment before using it.

    This includes checking common input validation vulnerabilities such as cross-site scripting and SQL injection, as well as other checks such as file uploads, antivirus detection and file download weaknesses.

    5. Server configuration

    The tester analyses the deployed configuration of the server that hosts the web application. They then verify that the application server has gone through an appropriate hardening process.

    6. Encryption

    The tester assesses encryption security around the transmission of communication. This includes checking for common weaknesses in SSL/TLS configurations and verifying that all sensitive data is being securely transferred.

    7. Information leakage

    The tester reviews the application configuration to ensure that information is not being leaked.

    This is assessed by reviewing configurations and examining how the application communicates to discover any information disclosure that could cause a security risk.

    8. Application workflow

    The tester determines whether the application processes and workflows can be bypassed.

    Tests are conducted to ensure that application workflows cannot be bypassed by either tampering with the parameters or forcefully browsing. This ensures the integrity of the data.

    9. Application logic

    The tester analyses how the application uses, stores, and maintains data. They do this by checking the underlying technology and any mitigating controls that may affect the risk to the application.

    10. Report

    The tester documents their findings. Their reports contain an executive summary, which provides a high-level, non-technical summary of any identified vulnerabilities, alongside a summary of the organisation’s business risks and an overall risk rating.

    It also contains a comprehensive review of testing details, such as the scope of the assessment, descriptions of the vulnerabilities identified and their impact, plus proofs of concept that support the findings.

    Finally, the report provides the tester’s commentary, where they discuss the issues identified and how the vulnerabilities could be linked within an attack chain. This is supplemented with remediation advice and supporting references.

    Penetration testing with IT Governance

    IT Governance is a CREST-accredited penetration testing provider. We offer a range of solutions to help you analyse and improve your security practices. These include web application and API penetration testing.

    Our consultants have experience working with organisations of all sizes and can ensure that you effectively manage cyber security risk.

    Following the methodology outlined in this blog, they will assess your organisation’s systems and provide a report that includes a prioritised action plan with remediation guidance.

    Resource : https://www.itgovernance.co.uk/blog/api-penetration-testing-checklist

    11Apr, 2023
    Noname Security releases API security updates

    API security vendor Noname Security today announced a new release of its platform, with a number of upgrades designed to enhance visibility into a user’s API environment and protect against the growing number of API-based threats.

    The growth in the number of those threats has been fueled by the increasing centrality of APIs to modern enterprise computing, Noname said in a press release. The company cited a recent report from IBM as saying that as many as two thirds of all incidents analyzed by IBM’s X-Force security team involved unsecured APIs.

    Noname’s latest updates cover a wide range of new capabilities, including customized discovery, Kubernetes features, simplified onboarding and more. The idea, according to the company, is to improve the solution’s coverage and allow it to work more quickly to discover potential vulnerabilities.

    “APIs are the connective tissue for the digital world,” said co-founder and CTO Shay Levi, in a statement.

    Visibility and discovery key to API security

    The updates, as a whole, are well-designed to target the most important parts of the broader API security issue, according to Forrester principal analyst Sandy Carielli. Visibility and discovery, for instance, are still a major challenge to many organizations. “Lots of companies don’t have a sense of what APIs are in their environments or what data is being used,” she said. “Any tooling improvements that add context to the discovery process, which this announcement talks about, I think will be good news for the organizations struggling to understand what they have.”

    Part of the problem that improved visibility attempts to solve is the presence of zombie APIs – which are APIs that have been depreciated or forgotten and aren’t in active use, but are still present on a company’s systems – and rogue APIs, which could be used to provide back doors into important subsystems.

    Testing APIs for vulnerabilities

    Testing, according to Carielli, is the other part of the API security landscape that is effectively addressed by Noname’s latest updates. Testing APIs for vulnerabilities can be time consuming based on the fact that they’re frequently not integrated in to development pipelines – as well as the aforementioned fact that there are increasingly large numbers of them present on the average company’s systems.

    “What jumps out to me about [Noname’s announcement] is the idea of leaving no API untested,” she said. “They’re looking not just at the tech but at the business logic aspects of APIs.”

    The new features are available now, and no pricing changes were announced.

    Resource : https://www.csoonline.com/article/3692248/noname-security-releases-api-security-updates.html

    1Mar, 2023
    Application Security vs. API Security: What is the difference?

    As digital transformation takes hold and businesses become increasingly reliant on digital services, it has become more important than ever to secure applications and APIs (Application Programming Interfaces). With that said, application security and API security are two critical components of a comprehensive security strategy. By utilizing these practices, organizations can protect themselves from malicious attacks and security threats, and most importantly, ensure their data remains secure.

    Interestingly enough, despite the clear advantages these disciplines provide, businesses are struggling to understand which security approach is best for their needs. So in this article, we’ll discuss the differences between application and API security, best practices that you should consider, and ultimately make the case for why you need both.

    What is Application Security

    Application security, better known as AppSec, is a critical aspect of any organization’s cybersecurity strategy. Application security helps protect data and systems from unauthorized access, modification, or data destruction by utilizing techniques around authentication and authorization, encryption, access control, secure coding practices, and more.

    The benefits of application security are numerous. It can help protect sensitive data from being stolen or misused, reduce the risk of data breaches, and ensure that applications are compliant with industry regulations. Additionally, application security can help organizations reduce the costs associated with responding to a security incident by providing proactive measures that reduce the risk of a successful attack. Finally, it can also improve customer trust by providing a secure environment for customers to interact with your business.

    According to the ISACA, the five key components of an application security program are:

    1. Security by design
    2. Secure code testing
    3. Software bill of materials
    4. Security training and awareness
    5. WAFs and API security gateways and rule development

    In the next section, we’ll take a look at how API security fits into this framework, as well as where it still needs to be addressed.

    Comparing Application Security vs. API Security

    Though often used synonymously, AppSec and API security are very distinct disciplines. API security helps to protect APIs from unauthorized access, misuse, and abuse. It also helps to protect against malicious attacks such as SQL injection, cross-site scripting (XSS), and other types of attacks. By implementing proper API security measures, organizations can ensure that their applications remain secure and protected from potential threats.

    As you can see, securing APIs is a critical aspect of a proper application security strategy. However, to be clear, API Security is different enough from ‘traditional’ Application Security that it requires specific consideration. AppSec focuses on protecting the entire application while API security focuses on protecting the APIs that are used to connect modern applications and exchange data.

    The biggest difference between an API and an Application is how each impacts the user. APIs are intended to be used by software applications, while software applications themselves are intended to be used by humans. This implies different security controls are required. Now that we’ve got that out of the way, let’s dig into how API security is embedded within four of the five key components of AppSec and where it still needs help:

    Security by design

    The core idea here “is to consider security at the point of architecture and design, before any source code is written or compiled.” The ISACA goes on to say that “controls can include, but are not limited to, the use of web application firewalls (WAFs) and application program interface (API) security gateways, encryption capabilities, authentication and secrets management, logging requirements, and other security controls.”

    With that in mind, in the 2022 Hype Cycle for Application Security, Gartner points out that “traditional network and web protection tools do not protect against all the security threats facing APIs, including many of those described in the OWASP API Security Top 10.” Which illustrates the need for developers and security professionals to consider unique nuances of API protection in their cybersecurity strategy.

    Discover all of the elements to consider when securing APIs by downloading in the in-depth API Security Buyers Guide.

    Secure code testing

    As you can imagine, application security testing (AST) and API security testing are different disciplines. Ultimately the goal of securing the software development lifecycle (SDLC) is the same, but the approaches are fundamentally different. The ISACA recommends pursuing traditional security testing methods like static application security testing (SAST) and dynamic application security testing (DAST). They also recommend supplementing AppSec testing with penetration (pen) testing. The problem here is that APIs require additional testing that these techniques cannot address.

    According to Gartner, “traditional AST tools — SAST, DAST and interactive AST (IAST) — were not originally designed to test for vulnerabilities associated with typical attacks against

    APIs. They go on to say that, “to identify the optimal approach to API testing, they are looking to a mix of traditional tools (such as static AST [SAST] and dynamic AST [DAST]) and emerging solutions focused specifically on the requirements of APIs.” A good example to explain their rationale would be the discovery of each individual endpoint and it’s associated CRUD operations depending on the authentication/authorization. This is something SAST tools simply cannot do.

    You can learn more about the key differences Gartner is calling out by downloading the new ebook, API Security Testing For Dummies.

    Security training and awareness

    According to the ISACA, “all developers should be minimally trained on the Open Worldwide Application Security Project Top 10 list (OWASP Top 10)”. However, this list of web application risks is just a piece of the puzzle. Due to the unique vulnerabilities APIs present, coupled with the rise in API related security breaches, OWASP established the OWASP API Security Top 10. This list addresses the most pressing API threats facing organizations. With that said, it’s important for developers to abide by both lists in order to secure their applications and APIs.

    You can learn how to defend against these critical vulnerabilities in the ebook, Mitigating OWASP Top 10 API Security Threats.

    WAFs and API security gateways and rule development

    There is no denying that both API gateways and web application firewalls (WAFs) are important components of the API delivery stack. To be honest, neither are designed to provide the security controls and observability required to adequately protect APIs. And organizations are now realizing the false sense of security they had thinking their WAF or API gateway were enough to keep their APIs secure.

    The reality is, you need a purpose-built API security platform to find your APIs, evaluate their security posture and monitor for any unusual network traffic or patterns of use. Otherwise, you’re just fooling yourself that your APIs are safe from cyber-attacks. If you’re interested in seeing how these legacy tools measure up to a purpose-built platform, check out this comparison page.

    How Noname Security Provides Comprehensive API Protection

    Noname Security is the only company taking a complete, proactive approach to API Security. Noname works with 20% of the Fortune 500 and covers the entire API security scope — Discovery, Posture Management, Runtime Protection, and API Security Testing.

    With Noname Security, you can monitor API traffic in real-time to uncover insights into data leakage, data tampering, data policy violations, suspicious behavior, and API security attacks. We also provide a suite of over 150 custom-built API security tests based on years of enterprise-grade API security experience, not relying on generalized approaches like fuzzing. You can run the suite of tests on-demand or as part of a CI/CD pipeline.

    Resource : https://thehackernews.com/2023/02/application-security-vs-api-security.html

    20Feb, 2023
    API management (APIM): What It Is and Where It’s Going

    Analyzing the concept of API management (APIM), its benefits, and what it will look like as the API landscape continues to evolve.

    There are two fundamental truths in the API landscape.

    • First: APIs have become a strategic tool for companies to expand their digital reach, accelerate their businesses, and do more for their customers.
    • Second: because of the way they work and how they’ve been used so far, APIs are particularly vulnerable to attacks from bad actors. In fact, according to recent research, malicious API attack traffic surged 117% over the past year, indicating that the threat on APIs is far from abating.

    So, where does this leave businesses that want to leverage the power of APIs? For starters, they need to invest in an API security strategy that covers all their bases. A robust strategy will be held up by a number of different tools and methodologies, including API management (APIM).

    In this article, we’re taking a closer look at what APIM is, its benefits, and what it will look like as the API landscape continues to evolve.

    What Is APIM?

    APIM is the process of creating, distributing, monitoring, and analysing APIs that connect applications and data across the enterprise and clouds. Typically deployed as a scalable platform, APIM allows enterprises to share their API configurations while controlling access, monitoring and collecting usage data, and enforcing security policies related to APIs.

    In other words, APIM gives businesses the power to better leverage the API economy without compromising on security. There are also internal benefits: managing all APIs on one unified platform lets enterprises share API documentation and coding constructs between teams, ultimately making things easier (and faster) for developers.

    What Are the Components of APIM?

    To facilitate flexibility, quality, speed, and security for enterprise APIs, APIM platforms are usually comprised of five key elements, outlined below.

    API gateway: The API gateway acts as the portal through which all routing requests and protocol translations are handled. As APIs often have different structures and languages and are constantly changing, an API gateway facilitates communication, providing a single point of contact for internal and external parties to interact with APIs.

    API developer portal: The developer portal provides a self-service hub for developers that want to access and share API documentation. This contributes significantly to speeding up how developers work with APIs, streamlining the building and testing processes, and providing consistency across the team.

    API analytics: There’s a lot of value in understanding and evaluating a given API’s usage and operational metrics — and that’s where an API reporting and analytics function comes in. APIM platforms are often equipped with dashboards that provide this visibility and allow enterprise teams to make better decisions about how they use their APIs, such as whether it’s worth monetizing them. From an operational perspective, these dashboards help identify issues early so they can be addressed proactively.

    API lifecycle management: With APIs, one of the biggest challenges is that there isn’t visibility into the whole lifecycle — from design to implementation and retirement. The reason is that APIs are often created for small internal uses and then launched into bigger use cases without the proper vetting. Lifecycle management mitigates this, providing a sustainable solution for building, testing, and managing APIs with version control support.

    API policy manager: Each API should operate within a set of API policies that shape its evolution. API policy managers control the lifecycle of these policies and house broader policies that impact the entire API infrastructure.

    In an APIM platform, each of these tools comes together to give companies a more complete and comprehensive view into their APIs and the control to enhance security across the API ecosystem.

    What APIM is Not

    From a security perspective, while APIM platforms are key for creating unified visibility and control over a company’s API infrastructure — and for facilitating the implementation of API security features — it’s important to note that it’s only one pillar in a robust API security strategy. API management platforms are not, fundamentally, security platforms. They lack key API security elements organizations should enforce, including continuous authentication and authorization, access control, data validation, runtime security tailored to the OWASP API Top 10 attacks, and a testing plan for APIs both in production and pre-prod.

    It’s also important to note that APIM isn’t a one-size-fits-all solution. It’s essential to evaluate the company’s IT infrastructure and other resources to ensure that they are equipped to adopt and implement a new platform for its APIs. Do you have the right level of expertise on your team? Are you working with enough APIs to justify the adoption of an APIM platform? Do you have API security policies in place to enable your APIM tool to do its best work? These are all critical questions to ask as you evaluate this solution.

    What Are the Benefits of APIM?

    For many enterprises, APIs are the Wild West of their technical infrastructure. APIs often differ significantly from one another, making it challenging to create overarching measures to manage them. The landscape is constantly changing, so documentation quickly becomes outdated and irrelevant. This is part of what makes APIs such an appealing threat vector for cybercriminals. APIM remedies this while providing other benefits.

    APIM supports businesses by:

    • Centralising visibility to all API connections, lowering the risk of attacks, and giving teams the ability to identify gaps and duplicates
    • Facilitating data-driven decisions for the business, such as monetizing the API
    • Protecting the business from API-related threats
    • Enabling the creation of detailed API documentation
    • Creating better user experiences for API consumers
    • Improving developer experiences
    • Providing better insights into the current state of API security, allowing teams to create a better ecosystem

    What Does the Future of APIM Look Like?

    APIs aren’t going anywhere. Businesses are continuing to build applications that rely on hundreds, if not thousands, of APIs. With APIs exposed to multiple data centres, cloud providers, and customers, with different levels of access requirements and customization, the scale and complexity of the ecosystem are only going to get bigger. For enterprises that want to stay agile, organised, and secure, APIM will be crucial.

    APIM will continue to be an important driver for functions such as versioning, deployment processes, usage metrics, and interoperability. And from a security perspective, they will develop as API gateways become more mature, doing more in the rate limiting, data masking, and authentication spaces.

    Other changes will come within the interfaces themselves. There’s a growing shift in the developer tooling space with the emergence of tools that favour visual drag-and-drop functionalities instead of coding. This way, different teams can contribute to APIM within the bounds of their skill sets and still have a clear understanding of the workflows, API lifecycles, and API security policies.

    As APIM platforms continue to mature, they will become an even more strategic asset for businesses that want to make the most of the API landscape without compromising their security.

    About the Author: Ali Cameron is a content marketer that specializes in the cybersecurity and B2B SaaS space. Besides writing for Tripwire’s State of Security blog, she’s also written for brands including Okta, Salesforce, and Microsoft. Taking an unusual route into the world of content, Ali started her career as a management consultant at PwC where she sparked her interest in making complex concepts easy to understand. She blends this interest with a passion for storytelling, a combination that’s well suited for writing in the cybersecurity space. She is also a regular writer for Bora. 

    Resource : https://securityaffairs.com/141738/security/api-management-apim.html

    20Feb, 2023
    Top 5 API Lessons for Software Engineering Leaders

    It is important for software engineering leaders to balance the technical and business goals of their API strategy and practice by considering these top 5 aspects.

    Software engineering leaders around the world see application programming interfaces (APIs) as the best option to connect systems and applications to build impactful and composable software architectures. However, they overlook the business potential of APIs as digital products and focus largely on technical use cases. 

    To deliver meaningful business outcomes and gain the trust of stakeholders, organizations need a modern API strategy that is closely aligned to business goals, and which covers API security, governance, life cycle management, developer enablement and potential for monetization. 

    “Software engineering leaders responsible for API strategies shouldn’t focus only on the technical benefits of APIs. They must incorporate the business perspectives to avoid risking the support of business stakeholders,” says Shameen Pillai, Sr Director Analyst at Gartner.

    Here are the top five considerations for software engineering leaders to develop an effective API strategy and practice.

    No. 1. Don’t let API governance create bottlenecks

    For developing, managing and governing APIs without creating bureaucratic hurdles, software engineering leaders can implement an “adaptive governance” model. The idea is to create a federated API platform team (for example, having product managers from different business groups such as digital, commerce and logistic API teams) and manage the locally built APIs without undermining the overall API strategy.

    To support localized standards, tools and processes, ensure that API product teams do not create disjointed or overlapping standards and actively participate in federated API governance. The platform teams and product managers should have consistent communication to be aware of shared assets, policies and practices.

    No. 2. Treat APIs as products, even if you don’t plan to monetize them

    Looking at APIs as a way to achieve technical purposes isn’t enough in the postpandemic world. They are now essential in advancing digital business strategies and should be treated as products without prioritizing monetization. Although many organizations monetize APIs, the majority don’t. Many organizations use API products for internal consumption only.

    Regardless, the development, organization and management of APIs should be driven by a consumer-centric mindset that requires product managers to:

    • Prepare API roadmaps and measure business outcomes
    • Understand and cater to the needs of API consumers (for example, developers) to promote API products and improve developer relations (DevRel)

    No. 3. Discover your APIs before hackers do

    As APIs are the gateways to systems, applications and services, they are always vulnerable to security threats. This may result in the loss of private and sensitive information about millions of users.

    The security strategy for APIs should focus on threat protection, well-refined access control and data privacy. Software engineering leaders often protect the published APIs, but there can be shadow or unpublished APIs. API discovery is the key to ensuring that there are no blind spots and to track any malicious usage of APIs.  

    Software engineering leaders should adopt a DevSecOps strategy and institute a security governance policy across the organization. They should assess and enhance the capabilities of API security and management solutions to discover APIs and potential threats from hackers.

    No. 4.Manage the life cycle of APIs

    An API’s life cycle involves four stages:

    • Planning and initial design
    • Implementation and testing
    • Deploy and run
    • Versioning and retirement

    Software engineering leaders should build a consistent process around the four life cycle stages to develop a comprehensive API strategy and practice. For example, the “planning and initial design” stage should focus on an iterative process, consisting of a design approach, methodology and governance. Likewise, the “deploy and run” stage should focus on advanced security analytics to measure API business value.

    Leverage automation to sustain API quality, track issues and optimize the API’s life cycle based on actual performance.

    Align the development of APIs with the organization’s DevOps process for continuous integration and delivery. This way, software engineering leaders learn about other considerations when building, deploying, testing and implementing APIs in various environments. For example, as per API testing guidelines, certain functional, performance and security testing requirements can be mandatory.

    No. 5. Choose best-fit API technologies

    There are a variety of vendor solutions for developing and managing APIs available in the market today. However, the API market is evolving, with some vendors focusing on specific aspects of APIs like design, testing, monitoring, security, portals and ecosystem management. 

    Related webinar: How to Benefit From API Startups and New API Trends

    With so many different solutions to select from, software engineering leaders should have clarity regarding the needs of their organization and engineering groups. To make the selection more credible and collaborative, involve API product managers, API platform teams and security teams in the process. 

    It may be difficult to identify what differentiates different vendor solutions when it comes to potential, viability and maturity. Review critical capabilities for API life cycle management to understand the respective strengths and weaknesses of each solution and select the best possible fit.

    Resource: https://www.gartner.com/smarterwithgartner/top-5-api-lessons-for-software-engineering-leaders

    21Dec, 2022
    Bug Bounty Radar // The latest bug bounty programs for December 2022

    Bug bounty platform HackerOne has launched a scheme to encourage customers to adopt a standard policy geared towards protecting hackers from potential legal problems.

    The Gold Standard Safe Harbor (GSSH) is designed to be “short, broad, [and] easily-understood”, according to HackerOne.

    Many bug bounty and vulnerability disclosure programs offer safe harbor agreements that allow hackers acting in good faith to do their thing. HackerOne’s standard policy is designed to collate best practices while reducing the administrative burden for hackers, who will have no need to scrutinize the terms and conditions of targets before looking for in-scope vulnerabilities.

    European crowdsourced security platform Intigriti, meanwhile, has launched Bug Bounty Calculator, a tool designed to help bug bounty program owners pitch their payout rates at the appropriate level.

    To generate reward suggestions program providers select their industry and describe their assets in terms of risk level, maturity level, and incentive curve.

    Inti de Ceukelaire, head of hackers at Intigriti, explained why he built the tool: “Anyone can set up a bug bounty program, but if you aren’t sure what you’re doing, you may pay too much for vulnerabilities. Even worse, set your bounties too low and you may not attract any researchers at all.”

    The maximum payout awards under a growing number of programs have reached $1 million and more. Earlier this week The Daily Swig took a closer look into these high potential reward programs and discovered that market forces, in particular a scarcity of skilled talent, are driving up the value of rewards offered.

    Web 3.0 and crypto platforms, in particular, are competing to offer dazzlingly high potential rewards. However, experts questioned by The Daily Swig pointed out the rarity of firms in this arena actually paying out seven-figure sums, which suggests some are offering enormous potential bounties in an attempt to court publicity.

    Against this are several examples of six-figure payouts by more established tech vendors such as Apple and Intel. However, HackerOne reports that the median payouts for critical vulnerabilities comes in at $3,000 – a figure worth bearing in mind by anyone tempted to quit their day job in pursuit of greater riches on the bug bounty circuit.

    An example of an interesting flaw on the lower end of the scale dropped early in November when a researcher revealed that they had earned a $250 bug bounty payout after discovering a code injection flaw in Acronis’ cloud management console that could be abused for data theft.

    On November 4, ‘Medi’ (under the alias ‘mr-medi’), published a technical analysis of the client-side path traversal flaw, which they described as the “favorite bug” they’d ever found.

    Resource : https://portswigger.net/daily-swig/bug-bounty-radar-the-latest-bug-bounty-programs-for-december-2022

    20Dec, 2022
    Mobile App Users at Risk as API Keys of Email Marketing Services Exposed

    Analysis of 600 apps on the Google Play store by CloudSEK’s BeVigil security search engine found that 50% were leaking application programming interface (API) keys of three popular transactional and marketing email service providers.

    The providers included Mailgun, MailChimp and SendGrid. CloudSEK has notified all involved entities and affected apps about the hardcoded API keys.

    The leaked API keys allow threat actors to perform a variety of unauthorized actions such as sending emails, deleting API keys, and modifying two-factor authentication (2FA).

    An API is a piece of software that allows applications to communicate with each other without any human intervention. An API key is a special identification used by users, developers or calling programs to authenticate themselves to an API.

    CloudSEK said that an overall examination of all three providers’ data revealed that the USA was the country with the highest number of downloads followed by the UK, Spain, Russia and India, leaving over 54 million mobile app users vulnerable.

    In a breakdown of the research, CloudSEK noted how attackers could potentially exploit leaked API keys and said that it is advisable to keep API keys private.

    MailGun provides email API services, enabling brands to send, validate and receive emails through their domain at scale. The research noted that in this case, an API key leak could allow threat actors to send and read emails, get Simple Mail Transfer Protocol (SMTP) credentials, IP addresses and statistics, as well as retrieve mailing lists of customers in order to launch phishing campaigns.

    CloudSEK said that 35% of the analyzed packages contained a valid Mailgun key embedded in their android code and 132 domains were configured with the valid keys.

    MailChimp is a transactional email service first introduced in 2001 and later launched as a paid service with an additional freemium option in 2009. An API key leak in this case would allow threat actors to read conversations, fetch customer information, expose email lists of multiple campaigns containing PII, start fake email campaigns and manipulate promotional codes. The research also noted that threat actors could authorize third party applications connected to a MailChimp account.

    The report highlighted that of a total of 319 identified API keys, 28% were found to be valid and of those, 12 keys allowed read email access.

    Finally, SendGrid is a communication platform intended for transactional and marketing emails. It provides cloud-based services to assist businesses with shipping notifications, friend requests, sign-up confirmations, email newsletters, etc.

    An API lead would allow a threat actor to send emails, create API keys and control IP addresses used to access accounts, according to CloudSEK.

    The research found that of 319 API keys, 128 were found to be valid and of those, 121 could allow threat actors to send emails using SendGrid, 65 could allow threat actors to delete API keys and 42 could allow the modification of 2FA.

    Following the findings, CloudSEK said: “In modern software architecture, APIs integrate new application components into existing architecture. So its security has become imperative. Software developers must avoid embedding API keys into their applications and should follow secure coding and deployment practices like standardize review procedures, rotate keys, hide keys and use vault.”

    Resource : https://www.infosecurity-magazine.com/news/api-keys-email-marketing-services/?&web_view=true

    10Dec, 2022
    Why is Robust API Security Crucial in eCommerce?

    API attacks are on the rise. One of their major targets is eCommerce firms like yours.

    APIs are a vital part of how eCommerce businesses are accelerating their growth in the digital world.

    ECommerce platforms use APIs at all customer touchpoints, from displaying products to handling shipping. Owing to their increased use, APIs are attractive targets for hackers, as the following numbers expose:

    • API attack traffic increased by 681% in 2021
    • 77% of retail respondents experienced API security incidents in 2021– according to Noname security

    If left unaddressed, API abuse can damage your reputation, harm consumers, and affect the bottom line. Hence API security is worthy of consideration for eCommerce stakeholders.

    Why do eCommerce companies need APIs?

    API makes it easy for retailers and eCommerce platforms to handle product listings and orders. It transformed the static website into a completely customizable headless store. Retailers use APIs for various functions, including login, product catalog, shipping, and subscription.

    It empowers businesses to enhance customer experience. While making purchases, one service handles orders; another calculates tax; another enables shipping, and so on.

    But customers have no idea what is happening behind the screen. API connects these decoupled elements and helps to share data seamlessly.

    Key benefits of APIs in eCommerce

    • It streamlines operations and ensures seamless customer engagements
    • It is effective for data monitoring and analytics, a vibrant factor for retailers
    • It enables communication with chatbots
    • Connects eCommerce platform with 3rd party marketplaces

    Why Is API Security Crucial for Ecommerce?

    APIs are easy to use and integrate for businesses. Even though most APIs are not intended for public use, they often have full access to all sensitive assets and information.

    Customers enter PII while purchasing on online sites like emails, passwords, credit card details, and phone numbers. They also share transaction details like bonuses, balances, and rewards. This increases the opportunity for attackers to steal the data.

    They are easy to expose if not designed and tuned for robust, ongoing security. Inadequate security testing and a lack of business logic have resulted in an overall rise in API security risks.

    Important factors that drive API security concerns are

    Authentication Flaw

    Many APIs not properly checking if the request comes from a legitimate user. Hackers find coding errors in authentication and escalate privileges. They further use enumerated technologies to compromise users’ accounts.

    For instance, some eCommerce platforms integrate with external logistics systems to pass on shipping details. In this situation, if there is an insufficient authentication chain, API can leak PII via replay attacks.

    Automated Attacks #

    Automated attacks on insecure APIs are increasing with the widespread adoption of APIs. Rather than exploiting vulnerabilities in APIs code, hackers exploit business logic flaws within APIs.

    They may feed malicious scripts into bots to access your product details at scale.

    With bad bots overwhelming your site, your genuine user cannot shop on your site. For example, they can snatch the complete inventory of high-demand products within seconds.

    Volumetric attacks against eCommerce API without rate limiting (#4 in OWASP API Security Top 10) can cause shopping apps non-responsive, resulting in user dissatisfaction.

    Shadow and Zombie APIs

    Still, many businesses struggle to separate real transactions from fake. They are also blindsided by unprotected shadow APIs.

    Equally, Zombie APIs are the most common method of attack. Zombie APIs may longer be unmonitored. They can contain malicious codes or may expose sensitive data or functionality.

    Third-party APIs

    E-commerce businesses integrate with 3rd parties like shipping and payment systems. Third-party APIs are challenging to manage. These are the ones that attackers typically target.

    For example, shopping cart API is a prime target as it offers entry points into the business. A leading UK retailer experienced attacks more than 1000 times a day on this API. The attack increased 10-fold times when special offers were running.

    Traditional Security Tools

    Most businesses lack adequate defense capabilities to protect against the ever-evolving API risks. API threats are highly sophisticated and persistent, and traditional methods are ineffective against them.

    Legacy WAF or API gateways need more real-time ability to understand bad from good API activity.

    Hackers can manipulate the discount and promotion APIs during peak times. These tools find it hard to protect against such attacks.

    You will need comprehensive API protection solutions like AppTrana to protect your website and customers’ sensitive information.

    API Security Best Practices for Ecommerce#

    The API threats to eCommerce security are potentially devastating to retailers and customers. For this reason, you must take appropriate measures to address them.

    API Discovery

    The first step is to understand what you have in your API landscape. An inventory of all APIs, including undocumented APIs, is essential if you want to secure what you don’t know about.

    API discovery involves finding and inventorying APIs. 67% of the retail respondents say they lack visibility on API inventory. A good API security solution offers strong API discovery features. It automatically inventories all APIs, including Zombie and shadow APIs.

    Make sure zombie APIs are turned off. After the last customer stops integrating with a deprecated API, ensure the API is turned off. If you’re going to publish API documentation externally, make sure it’s valid and tested, and it’s not exposing vulnerabilities.

    API Security Testing and Penetration Testing#

    Integrate API security at the early stage of the development process. Security enhancement and vulnerability management are key aspects of your API development. Use API security scanners (e.g., Infinite API Scanner) for smooth API vulnerability scans. Make sure to patch the identified vulnerabilities immediately.

    In addition to automated API scanning tools, manual pen testing is vital. It helps you to detect misconfiguration that could otherwise go unseen.

    Proper Authentication and Authorization#

    Validating purchasers who they are and only allowing access to specific resources they have permission for is essential in API security.

    OAuth 2.0, API keys, and Token based authentication are a few API authentication methods to verify users’ identity.

    API Rate Limiting

    According to data, there were 28 API endpoints in 2020 and 89 in 2021, a three-fold increase in API endpoints. A similar increase in API calls is logical. There was a 141% increase in API calls in H1 2021. There has been a corresponding increase in attack surfaces.

    Attackers can make eCommerce sites unavailable for legitimate purchasers with DDoS attacks. With API rate limiting, you can limit the number of requests from overwhelming system resources. It can throttle the request that exceeds the limits. It enables you to make your site available for purchasers without impacting performance.

    API Behaviour and Analytics

    Leverage API protection solution to look for abnormal behaviour in API traffic. Differentiating malicious traffic from normal API traffic can help to detect attacks in progress.

    It also highlights system misbehaviors and other malicious disruptions to your service. It analyzes traffic metadata to pinpoint the attack source. You can use this information to stop the incident and fix the issue in API.

    Tips to protect your eCommerce Site

    • Make sure all third-party integrations and plugins are regularly inspected
    • Help your customers to create strong, unique passwords
    • Ensure that only necessary customer data is stored
    • Always keep your site up-to-date
    • Secure your website with HTTPS
    • Keep a backup of your data

    Ecommerce Security: Plan Ahead to Stay Safe

    An increase in API usage has increased the attack surface, which leaves eCommerce businesses vulnerable. It calls for the immediate requirement to mitigate the API security risks mentioned above.

    Failing to secure an eCommerce platform can directly impact sales. It ruins your reputation. Take immediate measures to win your API security platform.

    Resource : https://thehackernews.com/2022/12/why-is-robust-api-security-crucial-in.html