2022 APIsecure_Learn from the Past, Secure the Present, Plan for the Future: API Vulnerabilities
0 likes102 views
The document discusses API vulnerabilities, highlighting common exploitation methods and their evolution over time. It emphasizes that two-thirds of analyzed incidents involve improperly configured APIs and advocates for robust security measures, including documentation, testing, and real-time protective actions. The ultimate goal is to ensure APIs are built and used as intended while maintaining continuous security throughout their lifecycle.
2022 APIsecure_Learn from the Past, Secure the Present, Plan for the Future: API Vulnerabilities
- 1. Learn from the Past Secure the Present Plan for the Future API Vulnerabilities
- 2. © Noname Security. All rights reserved. 2 It's Great to Meet You Hila Zigman, VP Product Noname Security
- 4. © Noname Security. All rights reserved. The Traditional Exploitation - “Implementation” Vulnerabilities Mostly common in C, C++ Exploits Kernels, Web Browsers, Media Players and etc.. Requires deep understanding of the compiler 01 02 03
- 8. © Noname Security. All rights reserved. Code Execution Mitigations - Ever Increasing Complexity 2004 Dep - Windows XP Service Pack 2 2005 2008 ASLR 2012 2015 Sandbox technologies Windows Kernel ASLR Seccomp / SE Linux and other zero trust technologies Stack Canary 2017
- 9. © Noname Security. All rights reserved. Design / Logical Flaws There is no dependence on programming languages Requires deep understanding of the application’s logic or environment Usually a very short exploitation time 01 02 03
- 13. © Noname Security. All rights reserved. 13 The Attacker’s Fundamental Equation Attack surface Likelihood of a vulnerability
- 14. APIs as an Attack Surface 02.
- 15. © Noname Security. All rights reserved. 15 APIs as Structured Data HTML JSON
- 16. © Noname Security. All rights reserved. 16 APIs Evolution - Direct Proxy to The Data and Controls SOAP REST
- 17. © Noname Security. All rights reserved. 17 APIs Evolution - Direct Proxy to The Data and Controls GraphQL
- 21. © Noname Security. All rights reserved. 21 By 2022, API abuses will become the most-frequent attack vector. Public API policies represented a significant security gap. Two-thirds of the incidents analyzed involved improperly configured APIs APIs Are a Top Attack Vector
- 23. © Noname Security. All rights reserved. 23 Broken Authorization - Facebook (06/05/2021)
- 24. © Noname Security. All rights reserved. 24 Broken Authorization - Coinbase (02/22/2022)
- 25. © Noname Security. All rights reserved. 25 Broken Authentication - Peloton (05/2/2021)
- 26. © Noname Security. All rights reserved. 26 Excessive Data Exposure - 7-Eleven (07/12/2019)
- 27. What Can Be Done 04.
- 28. © Noname Security. All rights reserved. What Do We Aspire Every API will be built according to the way it was designed Every API will be used the way it was intended 01 02
- 29. © Noname Security. All rights reserved. How It Can Be Done 1. Document any API in a swagger document or a spec file and make sure its aligned with the organization policy 2. Built any API according to the spec file and test it for vulnerabilities or undesired behavior 3. Deploy any API according to the organization’s policy. Leverage API Gateways and WAFs to insure authentication, rate limiting, DOS protection and etc.. 4. Protect the APIs in real time, discover and block malicious users, rouge APIs and etc.
- 30. © Noname Security. All rights reserved. 30 Look at The Four Components of APIs Traffic Code Documentation Environment API
- 31. © Noname Security. All rights reserved. 31 API Security Scope Posture Management Inventory every API and Identify API security vulnerabilities Runtime Security Detection and prevention of attackers and suspicious behavior in real time APIs SDLC Continuously test APIs to identify API security risks before they emerge.
- 32. © 2021 Noname Security. All rights reserved. 32 Noname’s 360 Degrees of Security Coverage Assess every API, including legacy and shadow APIs, with data classification. Identify misconfigurations and vulnerabilities in source code, network configuration and policy. Runtime Security Behavioral-based models for runtime API threat detection. Automated and semi-automated blocking and remediation of threats. Secure SDLC Continuously test API endpoints to identify API risks before they emerge. Automated and dynamic test development and incorporation into CI/CD pipelines. Posture Management
- 33. © Noname Security. All rights reserved. Thank You
- 34. © Noname Security. All rights reserved. Noname Reference Architecture Workflow Integrations 34 Network and Cloud API Gateway Leverage APIs and Native Network Traffic and Gateway Services Development Platforms Flexible Engine Deployment on-premise, hybrid or SaaS (single tenant) Posture Attack Prevention Testing
- 35. © Noname Security. All rights reserved. 35 The Traditional Exploitation - “Implementation” Vulnerabilities ● Mostly common in C, C++ ● Exploits Kernels, Web Browsers, Media Players and etc.. ● Requires deep understanding of the compiler
- 36. © Noname Security. All rights reserved. 36 A “Good” API ● Exact scope ● Scope correlates to spec ● Managed by an API-GW ● Active ● Unique ● Serves a specific role ● Organizational requirements are enforced ● Authenticated ● Load balanced and Rate limited ● WAF defended
- 37. © Noname Security. All rights reserved. 37 Rogue API - Types ● The unmanaged API ● The deprecated API ● The dormant API ● The duplicated API ● The “unknown” API ● The unauthenticated API ● The wrongful scope API ● The misrouted API
- 38. © Noname Security. All rights reserved. 38 Security Through The Entire Life Cycle
- 39. © Noname Security. All rights reserved. 39 Secure The Environment Inventory Ass the Risk Protect the Production Secure Any New Release
- 40. © Noname Security. All rights reserved. 40 Broken Authorization - Run Time Issue Request Response
- 41. © Noname Security. All rights reserved. Request Response 41 Broken Authorization - Run Time Issue
- 42. © Noname Security. All rights reserved. 42 Broken Authorization - Run Time Issue Request Response
- 43. © Noname Security. All rights reserved. Request Response 43 Broken Authorization - Run Time Issue
- 44. © Noname Security. All rights reserved. Request Response 44 Broken Authorization - Run Time Issue
- 45. © Noname Security. All rights reserved. 45 Broken Authorization - Run Time Issue Request Response Request Response
- 46. © Noname Security. All rights reserved. 46 Broken Authorization - Run Time Issue Request Response Request Response
- 48. © Noname Security. All rights reserved. 48 Broken Authentication - (02/15/2021)