This first blog post of the API security series addressed Discovery, or the ability for an organization to identify which APIs are present and where they are hosted. The second post addressed how a proper API Inventory can reduce redundant development costs by identifying duplicate API functionality. We are now at Profile phase, where we need to classify API usage, exposure, data, and compliance.

As discussed in previous blog posts, your inventory can impact the potential for additional attack surface. How the API is used and the type of data that is exposed becomes important for your organization’s security maturity. The Open Worldwide Applications Security Project (OWASP) has provided the 2023 OWASP Top 10 API Security Risks for organizations to see potential vulnerabilities and risks that APIs pose.

API Scenario

The API inventory does begin to classify API usage and which parties use the inventory internally within the organization or amongst third parties. Tracking and managing API inventories should help with the exposure of the API and support from the responsible parties. While organizations should address governance, it is necessary to understand how API usage can impact an organization’s data and potential compliance issues. I have addressed API protection tools in previous posts, and organizations can leverage these tools to greatly enhance security. For instance, if you consider the vulnerabilities listed above, these tools can help with terminating API attacks and supporting API throttling, as well as preventing account takeover, sensitive data exposure, and data exfiltration.

Understanding the risks of APIs to the organization will require the knowledge of the data that is exposed. To understand this, see the scenario below on information disclosure.

In this scenario, an API provides the following:

Image

Figure 1: API data

APIs should only expose the data necessary for the downstream consumer:

Below is the API GET for this user’s information:

Image

Figure 2: API GET for user information

But what is all the information being exposed for this API? In this case, having a simple understanding of the API can help the responsible parties address and mitigate organizational risk. What we discover is that the API response of the user information returns additional personally identifiable information (PII), which includes:

Personal Information: UserID, FirstName, LastName, Email, Address, City, State, Zip, Country, HomePhone, CellPhone, OfficePhone, NickName, MiddleName, MaidenName, GradeYear, Department, SpouceID, ChildNames, ChildIDs

Control Information: InsertDate, ModifiedBy, LastModifiedDate, LastModifyUserID, Internal_ID, Vendor_External_ID

Image

Figure 3: API response

To better understand the significance of the security of data being transmitted, it is important to understand the capability of the API and what it returns. In similar cases, the API could provide PII, as well as financial, health, or company data that should not be public. You can help decrease the frequency and severity of these issues by using API protection tools or by leveraging API assessment services to gain awareness of API vulnerabilities putting company systems at risk.

API Profile

Understanding the profile of an API can be difficult. As you begin to work through each of these phases, you grow to better understand your environment. You also learn how to maintain your environment and limit the exposure of unnecessary data to end users or potentially malicious individuals.

By using tools like Postman or Burp Suite to perform security tests, you can build efficiency through the use of automation. You can also use these tools for quality assurance, data reviews, adding security checks into build scripts, and performing incremental testing as you review the API. As mentioned above and in previous posts, API assessment services are manual efforts, but they differ from web application penetration testing. Manual testing is necessary to ensure that you mitigate any findings that you have reviewed. This will ensure that you are protecting yourself from the top 10 API security risks provided by OWASP.

In our next blog post, we will dive into the dependency phase to understand how API security concepts are related and where your concerns should be.