What is API Security?

APIs (Application Programming Interfaces) are a key part of digital transformation strategies, and securing those APIs is a top challenge. APIs are a rapidly growing attack surface that isn't widely understood and can be overlooked by developers and application security managers.

Let’s let OWASP API Security Project take this: “APIs are a critical part of modern mobile, SaaS and web applications and can be found in customer-facing, partner-facing and internal applications. By nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.”

How API Based Apps are Different?

Again, from OWASP: The server is used more as a proxy for data The rendering component is the client, not the server Clients consume raw data APIs expose the underlying implementation of the app The user’s state is usually maintained and monitored by the client More parameters are sent in each HTTP request (object IDs, filters)

How is API security different from general application security?

API Security focuses on strategies to mitigate the unique security risks of APIs. Traditional vulnerabilities are less common in API-based apps: SQLi – Increasing use of ORMs CSRF – Authorization headers instead of cookies Path Manipulations – Cloud-based storage Classic IT Security Issues - SaaS

Why is API security important?

API security is important because businesses use APIs to connect services and to transfer data, so a hacked API can lead to a data breach. According to Gartner, 90% of web-enabled applications will have more attack surface area in exposed APIs rather than in the user interface . API Usage Continues to Rise According to Forrester, from December 2020 to June 2021, the percentage of API traffic that was malicious grew 85%. . In December 2021, Cloudflare reported that API calls accounted for 54% of total requests and increased 21% from February to December 2021. Attackers have taken notice and increased their focus on APIs. API security testing is part of the core capabilities in the Gartner MQ for Application Security Testing. APIs have become an essential part of modern applications (e.g., single-page or mobile applications), but traditional AST toolsets may not fully test them, leading to the requirement for specialized tools and capabilities. The ability to discover APIs in both development and production environments and test API source code, as well as the ability to ingest recorded traffic or API definitions to support the testing of a running API, are typical functions.

What is the OWASP API Security Top 10?

OWASP recently announced the API Security Top 10 Release Candidate. Read more about the OWASP API Security Project (and check out presentation deck in the Quick Links section). Here is the top 10: API1 - Broken Object Level Authorization API2- Broken User Authentication API3 - Excessive Data Exposure API4 - Lack of Resources & Rate Limiting API5 - Broken Function Level Authorization API6 - Mass AssignmentAPI7 Security Misconfiguration API8 - Injection API9 - Improper Assets Management API10 - Insufficient Logging & Monitoring

How does Fortify helps with API Security?

API Security with Fortify: Attack Surface Coverage – Discover new and shadow API endpoints automatically during testing and identify the breadth of endpoints with OpenAPI, Swagger, Odata, or WSDL schemas. API Authentication – API authentication is varied and complex. Fortify supports virtually all types of bearer tokens and implementations. Vulnerability Detection – Ever-expanding coverage of API-specific vulnerabilities affecting areas such as bearer tokens or GraphQL introspection. Scan Automation – Scale API testing with enterprise-grade orchestration delivered via SaaS, hosted, or on premise.

什么是 API 安全？| Micro Focus

什么是 API？

OWASP API 安全计划是这样描述的：“API 是现代移动、SaaS 和 Web 应用程序的重要组成部分，可以在面向客户、面向合作伙伴的应用程序及内部应用程序中找到。因性质使然，API 会暴露应用程序逻辑和个人身份信息 (PII) 等敏感数据，正因为如此，API 逐渐成为众多攻击者的目标。没有安全的 API，就不可能实现快速创新。”

基于 API 的应用程序有何不同？

同样，还是来自 OWASP：

服务器更多地用作数据的代理
呈现组件的是客户端，而不是服务器
客户端使用原始数据
API 暴露应用程序的底层实现
用户的状态通常由客户端维护和监控
在每个 HTTP 请求中发送更多参数（对象 ID、过滤器）

API 安全与一般应用程序安全有何不同？

API 安全的重点在于制定降低 API 特有安全风险的策略。传统的漏洞在基于 API 的应用程序中不太常见：

SQLi - 增加 ORM 的使用
CSRF - 授权标题而不是 Cookie
路径操作 - 基于云的存储
典型的 IT 安全问题 - SaaS

为什么 API 安全如此重要？

API 安全之所以如此重要，是因为企业使用 API 来连接服务和传输数据，所以被攻击的 API 可能会导致数据漏洞。根据 Gartner 调查，支持 Web 的应用程序有 90% 在暴露的 API 中较之在用户界面中更容易遭受攻击。

API 使用量不断攀升

根据 Forrester 调查，从 2020 年 12 月到 2021 年 6 月，恶意 API 流量的百分比增长了 85%。2021 年 12 月，Cloudflare 报告称，API 调用数占总请求数的 54%，从 2021 年 2 月到 12 月增加了 21%。攻击者已经注意到并增加了对 API 的关注。

API 安全测试是 Gartner MQ 应用程序安全测试核心功能的一部分。

API 已成为现代应用程序（例如，单页或移动应用程序）的重要组成部分，但传统的 AST 工具集可能无法对其进行全面测试，因此需要专门的工具和功能。在开发和生产环境中发现 API 和测试 API 源代码的能力，以及摄取记录的流量或 API 定义以支持测试运行中 API 的能力，都是典型的功能。

OWASP 发布的十大 API 安全漏洞是什么？

OWASP 最近发布了十大 API 安全漏洞候选版本。阅读有关 OWASP API 安全计划的更多信息（并在“快速链接”部分中查看演示文稿）。以下是十大安全漏洞：

API1 - 失效的对象级别授权
API2 - 失效的用户身份验证
API3 - 过度数据暴露
API4 - 缺乏资源和评级限制
API5 - 失效的功能级授权
API6 - 批量分配 API7 安全错误配置
API8 - 注入
API9 - 资产管理不当
API10 - 日志记录及监控不足

Fortify 助力 API 安全

借助 Fortify 实现 API 安全：

攻击面覆盖范围 - 在测试过程中自动发现新的和影子 API 端点，并使用 OpenAPI、Swagger、OData 或 WSDL 架构确定端点的广度。
API 身份验证 - API 身份验证复杂多样。Fortify 几乎支持所有类型的不记名令牌和实现。
漏洞检测 - 影响不记名令牌或 GraphQL 内省等领域的 API 特定漏洞的覆盖范围不断扩大。
扫描自动化 - 通过 SaaS（软件即服务）、托管或本地部署交付的企业级编制来扩展 API 测试。

在 Fortify Unplugged YouTube 频道观看以下演示

Your browser is not supported

OpenText 云

什么是 API 安全？

概述

什么是 API？

基于 API 的应用程序有何不同？

API 安全与一般应用程序安全有何不同？

为什么 API 安全如此重要？

API 使用量不断攀升

OWASP 发布的十大 API 安全漏洞是什么？

Fortify 助力 API 安全

资源

资产

相关产品

Fortify Application Security

Fortify on Demand (FoD)

Fortify Static Code Analyzer

Fortify WebInspect

NetIQ Secure API Manager

Fortify Software Security Center

立即开始体验。