Don’t Worry, Be API: Addressing AppSec’s Newest Challenge
summary
Checkmarx-led research defines an OWASP API Security Top 10 and claims access control is the biggest API risk, splitting it into BOLA (broken object-level authorization), broken authentication and broken function-level authorization. Findings show classic injections decline while exposed APIs, forgotten endpoints from fast CI/CD and raw JSON leaks rise; concrete incidents include a smart vacuum camera leaking user video and location, the 3Fun profile/GPS leak, and a Google Firebase misconfiguration exposing 24,000 apps. Recommendations: inventory, dev education, bake authorization into design.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:12What do these companies have in common
- 1:55What is API
- 2:32Who uses API
- 3:09Traditional vs modern applications
- 6:03Different abstraction layers
- 6:27What makes API vulnerable
- 7:20Clients consume raw data
- 8:18Flexible CICD
- 9:01Traditional Vulnerabilities
- 10:11How do you bridge the gap
- 10:51Open Web Application Security Project
- 12:03OSAPI Security Top 10
- 12:30Injection Issues
- 13:16Access Control
- 15:15Access Data
- 18:08API for
- 20:59Biggest challenge
- 21:13Categories
- 24:02Authentication endpoints
- 25:00API 1 bola
- 25:37API 1 attack surface
- 26:07Idle
- 27:11BOA
- 27:32Why is it so common
- 28:25Summary
related talks
30mDon’t Worry, Be API Addressing AppSec’s Modern Challenge
01h 29mAPI Vulnerabilities and What to Do About Them
25mOWASP Top 10 for APIs
30mBOLA, IDOR, MA, BFLA. Welcome to the OWASP API Top 10!
35mSecuring Your API: The OWASP Top 10
26mOffensive API Penetration Testing
31mStandard Classification: API Security Top 10 - A Beginner's Guide to Mitigation
43mApisecure, 14 & 15 March 2023 - Brenton House, Vice President, Digital Evangelism at Software AG.