API Security with Postman and Qualys
1 like1,941 views
This document discusses API security testing with Postman and Qualys. It notes that APIs are widely used but often built without security in mind. It highlights some of the top API security risks from the OWASP API Security Top 10, including broken object level authorization, broken user authentication, and broken function level authorization. The document then outlines Qualys' web application scanning capabilities for APIs and how it can utilize existing Postman collections to quickly scan APIs for vulnerabilities. It concludes by emphasizing the importance of API security and recommending the OWASP API Security Top 10 as a resource.
API Security with Postman and Qualys
- 1. API Security with Postman and Qualys Security Solution Architect, Application Security Qualys, Inc.
- 2. 2 APIs Are Everywhere Highly exposed Greater likelihood of attack Constantly being probed Internet-facing APIs Custom / domain-specific For employees or contractors Often built without security considered Internal APIs Unknown risk posture No access to source code Often process critical data Vendor APIs Cloud provider not responsible for security of your apps and APIs APIs in public clouds
- 3. 3 https://owasp.org/www-project-api-sec urity/ OWASP API Security Top 10 API1 Broken Object Level Authorization API2 Broken User Authentication API3 Excessive Data Exposure API4 Lack of Resources & Rate Limiting API5 Broken Function Level Authorization API6 Mass Assignment API7 Security Misconfiguration API8 Injection API9 Improper Assets Management API10 Insufficient Logging & Monitoring
- 4. OWASP API Security Top 10 - Highlights API1 Broken Object Level Authorization API2 Broken User Authentication API5 Broken Function Level Authorization
- 5. API1 Broken Object Level Authorization API1 Broken Object Level Authorization (BOLA)
- 6. API5 Broken Function Level Authorization API5 Broken Function Level Authorization
- 7. API2 Broken User Authentication API2 Broken User Authentication SolarWinds CVE-2020-10148 Administration bypass Lack of authentication Request processed before authentication is verified
- 10. Note on API8 Injection Frequently, practitioners feel that XSS attacks are not valid for APIs due to JSON responses If JSON is written into an application with a UI, the attack may execute Microservices - Be aware of all areas the responses are used
- 12. Qualys WAS Highlights Unlimited scans Unlimited users Cloud based Not a point solution Massive scalability Flexible licensing Scheduled scans Ad-hoc, targeted scans Multi-site scanning Scanner pooling API scanning Out-of-Band detections Comprehensive API Splunk TA Integrations with: - Qualys WAF - CI/CD tools - Burp Suite - Bugcrowd RBAC Tagging Detection history Scheduled reports Customizable reports Retest findings Ignore findings Low TCO Scanning Flexibility Integrations Features
- 13. Postman Support
- 14. API Security - Coming Soon
- 15. Demo
- 16. Wrap-up Qualys can utilize existing Postman collections Quickly scan APIs for vulnerabilities API Security is important The OWASP API Security Top 10 is an excellent resource
- 17. Thank You! earnold@qualys.com Security Solution Architect, Application Security Qualys, Inc.