Outpost24 webinar Why API security matters and how to get it right.pdf
0 likes109 views
In this webinar, our expert panel will discuss why continuous API security testing is critical to securing your applications and reducing risk of API hacking in the wild. We will provide best practice guidance to improve your API security posture through automated detection for vulnerabilities lurking in API endpoints, ensuring your application business is protected against abuse.
Ad
More Related Content
Similar to Outpost24 webinar Why API security matters and how to get it right.pdf (20)
More from Outpost24 (20)
Ad
Recently uploaded (20)
Ad
Outpost24 webinar Why API security matters and how to get it right.pdf
- 1. Why API security matters and how to get it right 27th April 2022
- 2. 2 Corey Ball Author Hacking APIs: Breaking Web Application Programming Interfaces Dan Barahona CMO and VP of Business Development, APIsec Simon Roe Application Security Product Manager at Outpost24 Speakers
- 3. Outpost24 Group leads to cyber risk reduction 3 Technology Assets Applications – website, CMS, shopping carts Critical data – PII and cardholder data Cloud infrastructure – AWS, Azure, Docker Endpoints – desktop, laptop, smartphone Data center – data storage, backup, recovery User access – password and credential Malware Ransomware kit Data breach Vulnerability exploits Phishing attempts Credential stuffing Crytojacking Cyber Threats Where can attackers gain access and disrupt, extort, or steal? Who are the attackers, who are they targeting, and what techniques do they use? Outpost24 Group uniquely bridges these domains with continuous risk assessment • Security assessment of all technology assets • Intelligence about threat actors and their methods of attack • Combined into the most effective prescriptive actions that reduce business risk at the least cost
- 4. What is an API? • Application programming interface • Governs the communication between services • Used in almost all web applications today • Segregation of front end and back end elements of an Application • Machine to Machine, Machine to human communication is evolving • You use them every day • Reports suggest 83% of web traffic passes through one or more API’s 4
- 5. APIs are everywhere APIs, microservices, CI/CD have transformed how apps are built and run 5 of all internet traffic is from APIs 83% of web app attack surface area are APIs 90% of breaches targeted web applications 90% APIs will become “most frequent attack vector” 2022
- 6. Why attackers target API layer APIs: •Direct access to sensitive data •Often “over-permissioned” •Vulnerable to logic flaws 6
- 7. Corey Ball 7
- 8. Simon Roe, [email protected] Thank you for attending Any questions?
- 9. 1 API Exposure APIs are the pipelines that enable modern business APIs are a technological advancement that facilitates the transfer of one of the most valuable commodities, data. APIs are often the path of least resistance for data theft APIs expose programming logic and data to consumers. Unprotected APIs are an attack vector that can help an attacker bypass complex security infrastructure. Testing API security is the way to validate weaknesses. If you have the best developers, cybersecurity team, and tools the only way to provide assurance that your API is secure is to test the security controls in place.
- 10. 2 Getting API Security Right API Defense in Depth • Ensure that security has a seat at the table • Document and Manage • Limit Access • Test Regularly • Monitor
- 11. 1 Today’s Challenges with API Security Rapid migration to microservices and API-based applications Massive expansion in number of API endpoints Ever-widening attack surface of APIs Developers are closer to production changes than ever Changes can happen daily/hourly There is a wide gap between code releases and security testing Manual security testing requires skilled engineer and knowledge of application APIs very difficult to test manually – no UI, no standard workflows
- 12. 2 API Breaches in the News API returned full transaction details. 200M transactions harvested. API allowed User A to access User B data. 60M accounts accessed. API required 6-digit code for account reset but did not prevent brute force. API breaches are result of logic flaws in application Unsecured API endpoint provided access to all 4M users. “The underlying cause of the bug was a missing logic validation check.”
- 13. 3 Addressing API Security Leverage automation to create relevant security attack playbooks Test for logic flaws, not just common vulnerabilities or contract validation Maintain full test coverage as your APIs grow Security testing should be continuous Provides safety net to developers, prevents issues from getting to production Precisely matches security testing frequency with release cycles FUNCTIONAL SECURITY TESTING
- 14. 4 Continuous, Automated API Testing • No source code access • Nothing to install • Nothing inline Zero Touch Deployment Endpoints Target API API Analyzer Attack Generator Scanner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .