APIs Get Their Own Top 10 Security List

The Open Web Application Security Project (OWASP) has unveiled its first release candidate for a top 10 list focused on the most critical classes of security issues affecting the communications between online applications, mobile devices, and Web services.

The top issues identified in the API Security Top 10 list, published today, include broken authorization and authentication functions, excessive data exposure, and a failure to focus on rate limiting and resource limiting attacks. While the group's most well-known list — the OWASP Top 10 rankings — focuses on online services and Web application, and includes security issues that are caused by application programming interfaces (APIs), it does not focus on the specific problems plaguing the communications technique, says Erez Yalon, one of the leaders of the API Security Top 10 project and director of security research at software security firm Checkmarx.

"Modern applications that are built on these APIs directly expose the business logic," he says. "Since these APIs are directly exposed, there is a new class of attacks that are specific to APIs. Hence, we have to think about APIs and their security in a whole new way."

Currently labeled as an incubator project, the list focuses on issues that have caused recent data breaches and pose common security hazards in modern cloud-based applications. A number of major data breaches have been caused by cloud infrastructure and Web-based applications that have exposed insecure APIs. 

In 2018, for example, a research fellow with the Mozilla Foundation scraped nearly 208 million transactions on the peer-to-peer payment app Venmo, revealing the purchase profiles of its users— from lovers to weed dealers. In June, another 7 million transactions were scraped using the company's developer API over six months, despite the company's limiting for API calls. The issues exploited by the attack include excessive data exposure and a lack of rate limiting. 

While privacy is often a major casualty of lax API security, insecure API infrastructure can also allow attackers to take control. Just last month, Cisco patched several critical vulnerabilities that could have allowed an attacker to send malicious API requests to the Web management interfaces and compromise its small-business switches and big-data packages. This underscores the hazards of broken authentication mechanisms and broken function-level authorization flaws — both issues on the top 10 list.

"Every modern architecture concept, like mobile, IoT, microservices, cloud environments, and single-page applications, deeply rely on APIs," Yalon says. "The majority of enterprises cite APIs as important to digital transformation and API security as their top challenge."

Publication of the list comes as companies increasingly worry that a combination of the move to developing applications for the cloud and undocumented APIs are leaving their businesses open to attack. Six in 10 companies have more than 400 APIs, and nearly half of companies do not have confidence that they can detect the malicious use of their APIs, according to a survey of 100 security and IT professionals conducted by security firm Ping Identity.

"We're quickly moving from a world where the average enterprise manages a handful of APIs and web services to one where they are contending with thousands of APIs and microservices," said Jason Bonds, vice president of intelligence at Ping Identity, in a statement. "And, these are spanning multiple infrastructure providers and regions around the globe."

For that reason, many API security issues are often hidden, resulting in some serious data breaches. 

In perhaps the worst failure in recent memory, First American Financial allowed anyone with a browser to send requests to its server for sensitive financial documents provided as part of the mortgage process. The documents were serialized — meaning the identifiers incremented in sequence — allowing anyone to harvest 885 million files dating back to 2003. 

And even when the API itself is secure, many developers inadvertently leak credentials online as part of backing up files to a repository, such as GitHub. Last month, the company — now a subsidiary of Microsoft — revealed its automated scanning service found, in a single year, a billion authentication tokens in the code libraries that developers placed online.

For that reason, companies should make sure they are inventorying their APIs, including requiring DevOps engineers to document a secure process for creating and deploying new API hosts and tracking old APIs, says Checkmarx's Yalon. They also need to review and analyze their authentication and authorization mechanism, as well as the process by which developers modify the code behind the API.

"Having a very clear understanding of the APIs, with a well-maintained inventory and documentation ... is very critical in the world of APIs," Yalon says. "It helps developers prevent shadow APIs and excessive data exposure."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Community Projects Highlight Need for Security Volunteers."