This week, OWASP launched their Top 10 project for API Security. We also look at the changing landscape of OAuth 2.0 security, and the use of Postman and Burp for API penetration testing.
OWASP API Top 10
The Open Web Application Security Project (OWASP) has long been popular for their Top 10 of web application security risks. Now they are extending their efforts to API Security.
Here’s what the Top 10 API Security Risks look like in the current draft:
- Broken Object Level Access Control
- Broken Authentication
- Improper Data Filtering
- Lack of Resources and Rate Limiting
- Missing Function/Resource Level Access Control
- Mass Assignment
- Security Misconfiguration
- Injection
- Improper Assets Management
- Insufficient Logging and Monitoring
See also:
- OWASP API Top Encyclopedia
- OWASP API Security Top 10 Cheatsheet
- The project’s inaugural slide deck from Erez Yalon and Inon Shkedy
- Project’s github repo for your contributions.
The goal is to release version one of the document by the end of 2019.
OAuth 2.0 Security Reinforced
OAuth 2.0 and OpenID Connect have become one of the cornerstones of API Security. However, the technology and threat landscape has changed a lot since the adoption of RFC 6749 in 2012.
Torsten Lodderstedt has covered the key changes and new security best practices in his recent talk at EIC 2019. Please find his slide deck here: “OAuth 2.0 Security Reinforced”.
Tools
Mic Whitehorn-Gillam is doing a series of tutorials on API penetration testing with Postman & Burp:
- Getting started with Postman
- Proxying through Burp
- Variables, parameters, tokens
- JWT, authorization problems
Opinions
Alissa Knight from Aite Group has published a write-up on API Security:
- API adoption has grown fast. REST APIs have taken the world by storm.
- This led to the rise of API breaches. Legacy technology such as Web Application Firewalls (WAF) do not help.
- Poor API key management and poor handling of API contracts are some of the major factors that companies need to mitigate.
Get API Security news directly in your Inbox.
By clicking Subscribe you agree to our Data Policy
