What is API Security?

APIs (Application Programming Interfaces) are a key part of digital transformation strategies, and securing those APIs is a top challenge. APIs are a rapidly growing attack surface that isn't widely understood and can be overlooked by developers and application security managers.

Let’s let OWASP API Security Project take this: “APIs are a critical part of modern mobile, SaaS and web applications and can be found in customer-facing, partner-facing and internal applications. By nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.”

How API Based Apps are Different?

Again, from OWASP: The server is used more as a proxy for data The rendering component is the client, not the server Clients consume raw data APIs expose the underlying implementation of the app The user’s state is usually maintained and monitored by the client More parameters are sent in each HTTP request (object IDs, filters)

How is API security different from general application security?

API Security focuses on strategies to mitigate the unique security risks of APIs. Traditional vulnerabilities are less common in API-based apps: SQLi – Increasing use of ORMs CSRF – Authorization headers instead of cookies Path Manipulations – Cloud-based storage Classic IT Security Issues - SaaS

Why is API security important?

API security is important because businesses use APIs to connect services and to transfer data, so a hacked API can lead to a data breach. According to Gartner, 90% of web-enabled applications will have more attack surface area in exposed APIs rather than in the user interface . API Usage Continues to Rise According to Forrester, from December 2020 to June 2021, the percentage of API traffic that was malicious grew 85%. . In December 2021, Cloudflare reported that API calls accounted for 54% of total requests and increased 21% from February to December 2021. Attackers have taken notice and increased their focus on APIs. API security testing is part of the core capabilities in the Gartner MQ for Application Security Testing. APIs have become an essential part of modern applications (e.g., single-page or mobile applications), but traditional AST toolsets may not fully test them, leading to the requirement for specialized tools and capabilities. The ability to discover APIs in both development and production environments and test API source code, as well as the ability to ingest recorded traffic or API definitions to support the testing of a running API, are typical functions.

What is the OWASP API Security Top 10?

OWASP recently announced the API Security Top 10 Release Candidate. Read more about the OWASP API Security Project (and check out presentation deck in the Quick Links section). Here is the top 10: API1 - Broken Object Level Authorization API2- Broken User Authentication API3 - Excessive Data Exposure API4 - Lack of Resources & Rate Limiting API5 - Broken Function Level Authorization API6 - Mass AssignmentAPI7 Security Misconfiguration API8 - Injection API9 - Improper Assets Management API10 - Insufficient Logging & Monitoring

How does Fortify helps with API Security?

API Security with Fortify: Attack Surface Coverage – Discover new and shadow API endpoints automatically during testing and identify the breadth of endpoints with OpenAPI, Swagger, Odata, or WSDL schemas. API Authentication – API authentication is varied and complex. Fortify supports virtually all types of bearer tokens and implementations. Vulnerability Detection – Ever-expanding coverage of API-specific vulnerabilities affecting areas such as bearer tokens or GraphQL introspection. Scan Automation – Scale API testing with enterprise-grade orchestration delivered via SaaS, hosted, or on premise.

什麼是 API 安全？| Micro Focus

什麼是 API？

OWASP API Security Project 是這樣描述的：「API 是現代行動，SaaS 和 Web 應用程式的重要組成部分，存在於面向客戶、面向合作夥伴和內部的應用程式中。因其性質，API 會暴露應用程式邏輯和個人識別資訊 (PII) 等敏感資訊，正因為如此，API 逐漸成為眾多攻擊者的目標。沒有安全的 API，快速創新就行不通。」

以 API 為基礎的應用程式有什麼不同？

一樣是 OWASP 的描述：

伺服器更常作為資料的代理
呈現元件的是用戶端，而不是伺服器
客戶使用原始資料
API 暴露應用程式的底層實作
使用者的狀態通常由用戶端維護和監控
在每個 HTTP 請求中發送更多參數 (物件 ID，篩選條件)

API 安全與一般應用程式安全有何不同？

API 安全的重點在於降低 API 特有安全風險的策略。傳統的弱點在以 API 為基礎的應用程式中較不常見：

SQLi — 增加 ORM 的使用
CSRF — 授權標題而不是 cookie
路徑操作 — 雲端儲存
典型的 IT 安全問題—SaaS

為什麼 API 安全如此重要？

API 安全之所以如此重要，是因為企業使用 API 來連接伺服器和傳輸資料，所以 API 被駭入可能會導致資料外洩。根據 Gartner 的報告，相較於使用者介面，90% 的 Web 型應用程式在暴露的 API 中會有較大的攻擊面積。

API 使用持續增長

Forrester 指出，自 2020 年 12 月至 2021 年 6 月間，惡意 API 流量的百分比成長了 85%。在 2021 年 12 月，Cloudflare 回報 API 呼叫佔了總請求數的 54%，從 2021 年 2 月到同年 12 月增長了 21%。攻擊者已注意到 API，並在這方面花了更多心思。

API 安全測試是 Gartner 應用安全測試 MQ 中的核心要素之一。

API 已成為現代應用程式 (例如單頁或行動應用程式) 中不可或缺的一部分，但傳統的 AST 工具組可能無法對其進行完整的測試，因此需要專門的工具和功能。在開發與生產環境中探查 API、測試 API 原始碼，以及擷取記錄流量或 API 定義，以支援執行中 API 測試的能力，都是典型的功能需求。

OWASP API Securty 的前 10 名有哪幾家？

OWASP 最近公佈了 API Security 前 10 名的候選名單。進一步了解 OWASP API Security Project (並用快速連結查看簡報 )。前 10 名如下：

API1 - 失效的物件層級授權
API2 - 失效的使用者驗證
API3 - 資料過度暴露
API4 - 缺乏資源與速率限制
API5 - 失效的功能層級授權
API6 - 批量配置不當 API7 安全錯誤配置
API8 - 注入攻擊
API9 - 資產管理不當
API10－日誌記錄和監控不足

Fortify 協助打造 API 安全性

Fortify 的 API 安全性：

攻擊面涵蓋範圍 – 在測試期間自動探查新的與陰影 API 端點，並透過 OpenAPI、Swagger、OData 或 WSDL 綱要來識別端點的廣度。
API 驗證 – API 驗證程序複雜且各不相同。Fortify 幾乎支援所有類型的持有人記號與實作。
弱點偵測 – 不斷擴增影響持有人記號或 GraphQL 自我檢查等區域的特定 API 弱點涵蓋範圍。
掃描自動化 – 使用透過 SaaS、代管或內部部署系統傳送的企業級協調化作業，擴充 API 測試規模。

在 Fortify Unplugged YouTube 頻道中觀看以下示範

Your browser is not supported

OpenText Cloud

什麼是 API 安全？

綜覽

什麼是 API？

以 API 為基礎的應用程式有什麼不同？

API 安全與一般應用程式安全有何不同？

為什麼 API 安全如此重要？

API 使用持續增長

OWASP API Securty 的前 10 名有哪幾家？

Fortify 協助打造 API 安全性

資源

資產

相關產品

Fortify 應用程式安全性

Fortify on Demand (FoD)

Fortify Static Code Analyzer

Fortify WebInspect

NetIQ Secure API Manager

Fortify Software Security Center

今天就開始行動。