How do you keep your team apprised on emerging security risks for APIs? Looking for insights and best practices for consistently protecting against API vulnerability.
Sort by:
Overall awareness building is good: https://owasp.org/www-project-top-ten/ is a good resource to just impress upon your team that security doesn't happen by accident and every year companies suffer attacks that lead to massive reputation damage or financial penalties.
Ensure you have some sort of monitoring on your API's as anything that is publicly exposed is likely to be probed at some point. Showing your team that even "private" endpoints that are exposed on the internet will quickly become known by bots can help them understand "security through obscurity" is no security at all.
Acknowledge the risks associated with APIs, API Lifecycle Management, and your data. Understand the entire attack surface, both internal and external, and be sure you're aware of all API assets. Know the tools used in your environment, their roles, and capabilities well. Many believe that an API Gateway is the source of truth for their API inventory and that couldn't be further from the truth.
To fully understand the attack surface you'll need to get into the code repos and understand what, when, where, and how APIs are being used from Code to Runtime. Numerous tools on the market can help with this and also help prioritize findings from multiple tools that are more than likely in use today. This can help build trust between security and development teams over time, but it comes down to minimizing false positives and focusing on real-world risks to the organization. Vulnerabilities and findings must be prioritized based on risk and those are dependant on proprietary context and variables in your specific environment.
Artificial Intelligence fuels the fire, increasing risk and minimizing the window to respond to and defend new vulnerabilities. In the future, exploits will be crafted in days, hours, and possibly even minutes.
Changing our security approach and mindset from Defend Today, Secure Tomorow, to Secure Today, Defend Tomorrow is paramount.
The OWASP API Security Top 10 is not a bad start but is not updated very regularly...
https://owasp.org/API-Security/