Safeguarding Digital Assets_ Uncovering Security Risks in APIs - Automation Guild 2024 (1).pptx

APIs (Application Programming Interfaces) are omnipresent. API security testing has become increasingly important, yet it is often overlooked. Security flaws in APIs can lead to a wide range of nefarious activities such as data theft, account hijacking, and more. API security has grown to be of utmost importance to organizations as a result of the digital landscape's fast expansion and broad adoption of APIs.

1. Safeguarding Digital Assets: Uncovering Security Risks in APIs

2. Hello there!! 👪 @pricillabelwin I'm Pricilla Bilavendran, Team Leader Billennium IT Services, Malaysia.

3. Table of contents Introduction to API Security 01 OWASP Top 10 for APIs 02 The Role of Testers in API Security 03 Recap 04 @pricillabelwin

4. Introduction Why API Security Testing? 01

5. —Cory Doctorow, Canadian Blogger and Journalist “ We should treat personal electronic data with the same care and respect as weapons-grade plutonium - it is dangerous, long-lasting and once it has leaked there's no getting it back ” @pricillabelwin

6. Evolving API Landscape Exponential Growth 83% of internet traffic is from APIs Major Attack Target Most frequent attack vector High Profile Breaches High profile API breaches weekly Regulatory Compliance Privacy policies, Vulnerability Detection, Testing @pricillabelwin

7. High-Profile API Breaches

8. @pricillabelwin

9. Why APIs are targeted ? Direct entry point to apps and databases Direct Access to sensitive data (backend) Quick and Easy compared to the Classic Cyber Attack Access to entire system API Documentation provides insights on Business logic @pricillabelwin

10. What do we lose? Access to confidential data Disrupt operations, or even take control of a system Financial losses Reputation damage @pricillabelwin

11. OWASP Top 10 for APIs 02 Common API Security Risks

12. What’s OWASP? OWASP (Open Web Application Security Project) is an online community focused on improving the security of software. It works to identify, document, and promote methods for preventing security vulnerabilities in web applications and services. @pricillabelwin

13. What’s OWASP Top 10? @pricillabelwin The OWASP Top 10 is an industry-standard list published by OWASP comprising the ten most critical web application security risks.

14. OWASP Top 10 for APIs @pricillabelwin The OWASP Top 10 for APIs is similar to the OWASP Top 10 for web applications, but it’s more focussed on the security risks for APIs. First list was released in 2019 and the updated list is released in 2023.

15. @pricillabelwin API Security Top 10 2023 API 01:2023 Broken object level authorization API 02:2023 Broken authentication API 03:2023 Broken Object Property Level Authorisation API 04:2023 Unrestricted resources consumption API 05:2023 Broken function level authorization API 06:2023 Unrestricted access to sensitive business flows API 07:2023 Server side request forgery API 08:2023 Security misconfiguration API 09:2023 Improper inventory management API 10:2023 Unsafe consumption of APIs

16. Role of Testers in API Security 03

17. According to Postman’s 2023 State of API Report:

18. Shift Left Approach @pricillabelwin Identify and address security issues early reduces the risk of vulnerabilities in the later stages of development. Active participation in security discussions during the requirements and design phase. Incorporate security testing tools and practices in the early stages of development.

19. Collaboration is the Key @pricillabelwin Developers bring in-depth knowledge of the codebase, while testers provide a critical eye for potential security vulnerabilities. Conduct joint code reviews focused on security aspects. Provide feedback and insights on secure coding practices.

20. API Testing is a necessity @pricillabelwin Testing API endpoints t horoughly for common security issues. Conduct penetration testing to identify potential weaknesses. Creating awareness on the API Vulnerabilities .

21. Use strong Authorization methods Implement “Zero Trust” Approach Perform Regular Security Scans Audit All Third-Party Applications Use Secure Communication Protocols Implementing Rate Limiting and Throttling Monitor API Usage and Activities Retire the unused API Versions Best Practices

22. Recap 04

23. APIs are most attacked vector. API Security Testing is everyone’s responsibility . Stay updated on the API Vulnerabilities and API Trends. Testers can make a difference. @pricillabelwin

24. https://securiti.ai/blog/biggest-data-breaches-caused-by-api-mistakes https://www.wired.com/story/i-scraped-millions-of-venmo-payments-your-data-is-at-risk/ https://owasp.org/www-project-api-security/ https://www.postman.com/state-of-api/ https://www.postman.com/pynt-io/workspace/pynt/collection/21132333-8064f672-29e5-4d7f-bef4-3004cd6dd636 References @pricillabelwin

25. Thanks Do you have any questions? Please keep this slide for attribution @pricillabelwin