2022 APIsecure_API Discovery: First step towards API Security
0 likes61 views
The document discusses the importance of API discovery in the context of API security, emphasizing the need for tools that can automatically create and maintain an API catalog with essential features such as hierarchical grouping and classification. It highlights the challenges posed by diverse deployment options and microservices architecture, and outlines a minimum feature set for effective API security tools, including open API specifications and conformance analysis. Additionally, it addresses the necessity of tracking sensitive data exposure and integrating workflows to manage potential risks effectively.
2022 APIsecure_API Discovery: First step towards API Security
- 1. API First step towards API Security Discovery Amod Gupta Product Management, Traceable amod@traceable.ai
- 2. GOAL ▪ Define API Discovery in the context of API Security ▪ Minimum set of discovery related features that API Security tools should provide
- 3. What makes API discovery challenging ▪ Public cloud ▪ On-premises ▪ Hybrid Deployment Options Microservices architecture has made applications massively distributed Distributed Dev teams are releasing multiple times a week Agile releases
- 4. Automatically discover all API endpoints (by inspecting traffic) Group APIs by apps, services, domains etc. so security teams can digest the information Classify APIs as external (public), internal or 3rd party Automatically catalog new APIs and updates to existing APIs API discovery tool should… Minimum Feature Set 1. Automatically create an API Catalog ● Hierarchical grouping ● Classification of APIs ● Up to date
- 5. Now, that we have an API Catalog, how do we make it actionable
- 6. Open API Specification Are APIs being consumed securely? Are APIs being consumed as the developer intended? Are APIs exposing unknown parameters, responses, content-types etc. ? Without Common source of truth between different teams and partners Portability between different security tools Easy to identify which APIs expose sensitive data and where With Minimum Feature Set 1. Automatically create an API Catalog ● Hierarchical grouping ● Classification of APIs ● Up to date 2. Open API spec for API endpoints ● Create ● Download
- 7. Minimum Feature Set We’ve cataloged all the API endpoints We have Open API specifications for them But how do we consume this when there are 1000s of endpoints? CONFORMANCE ANALYSIS Open API spec Developer version ● Missing APIs (Shadow APIs) ● Issues with parameters ● Issues with request/response bodies Open API spec Prod/Test version Doing this at scale… 1. Automatically create an API Catalog ● Hierarchical grouping ● Classification of APIs ● Up to date 2. Open API spec for API endpoints ● Create ● Download 3. Conformance analysis to identify high priority issues at scale
- 8. Sensitive data exposure Minimum Feature Set 1. Automatically create an API Catalog ● Hierarchical grouping ● Classification of APIs ● Up to date 2. Open API spec for API endpoints ● Create ● Download 3. Conformance analysis to identify high priority issues at scale Catalog of Sensitive Data SSN email age gcp_api_key ip_address credit_card_no address Integrated workflows Detect ● New data exposure ● Policy violations Log ● Create tickets ● Integrations Track & Verify ● Pre-prod environments TIN SIN aws_api_key 4. Sensitive data exposure ● Catalog data types ● Integrated workflows
- 9. Risk Score brings it together API Endpoints Risk Score /juiceshop/getorder/{order-id} 8 /juiceshop/create-account 7 /juiceshop/order/checkout/ 5 /juiceshop/account/getaccount/{account-id} 5 /juiceshop/order/notification/ 2 7 Conformance deviations Public or Internal Sensitive Data Exposure HTTP vs HTTPs Minimum Feature Set 1. Automatically create an API Catalog ● Hierarchical grouping ● Classification of APIs ● Up to date 2. Open API spec for API endpoints ● Create ● Download 3. Conformance analysis to identify high priority issues at scale 4. Sensitive data exposure ● Catalog data types ● Integrated workflows 5. Integrated risk score
- 10. Summary API Catalog Automatically create and keep up to date Open API Spec Automatically create and keep up to date Conformance Identify the drift from expected behavior Risk Score Integrated score to identify APIs that need attention Sensitive Data Integrated score to identify APIs that need attention
- 11. Questions
- 12. THANK YOU