Download as PDF, PPTX
Uploaded by42Crunch
SecDevOps for API Security
The document discusses the importance of API security and presents the OWASP Top 10 security risks from 2010 to 2017. It emphasizes automated approaches to API security, including input validation, monitoring, and protecting APIs through security measures like API gateways. Key recommendations include ongoing vulnerability scanning, proper JWT token validation, and implementing a DevSecOps cycle for continuous improvement of API security.
SecDevOps for API Security
- 1. The API SecurityPlatform for the Enterprise ISABELLE MAUNY - CTO & CO-FOUNDER ISABELLE@42CRUNCH.COM SEC-DEV-OPS AN AUTOMATED APPROACH TO API SECURITY
- 2. OWASP : FROM2010 THROUGH 2017 2 For 2013, the OWASP Top 10 Most Critical Web Application Security Risks are: • A1 Injection • A2 Broken Authentication and Session Management • A3 Cross-Site Scripting (XSS) • A4 Insecure Direct Object References • A5 Security Misconfiguration • A6 Sensitive Data Exposure • A7 Missing Function Level Access Control • A8 Cross-Site Request Forgery (CSRF) • A9 Using Components with Known Vulnerabilities • A10 Unvalidated Redirects and Forwards • For 2010, the OWASP Top 10 Most Critical Web Application Security Risks are: • A1: Injection • A2: Cross-Site Scripting (XSS) • A3: Broken Authentication and Session Management • A4: Insecure Direct Object References • A5: Cross-Site Request Forgery (CSRF) • A6: Security Misconfiguration • A7: Insecure Cryptographic Storage • A8: Failure to Restrict URL Access • A9: Insufficient Transport Layer Protection • A10: Unvalidated Redirects and Forwards • • Top 10 2017 • A1:2017-Injection • A2:2017-Broken Authentication • A3:2017-Sensitive Data Exposure • A4:2017-XML External Entities (XXE) • A5:2017-Broken Access Control • A6:2017-Security Misconfiguration • A7:2017-Cross-Site Scripting (XSS) • A8:2017-Insecure Deserialization • A9:2017-Using Components with Known Vulnerabilities • A10:2017-Insufficient Logging&Monitoring
- 3.
- 4. CONTENT INJECTION: WORDPRESSAPI 4https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
- 5. TITLE TEXT Remote CommandExecution (A1) SQL Injection (A1) JSON injection (A1) Information Leakage (A3) Broken Access Control (A5) Check: https://blog.talosintelligence.com/2018/07/ samsung-smartthings-vulns.html 5
- 6.
- 7. 7 Information Leakage (A3) BrokenAccess Control (A5) Check: https://www1.cs.fau.de/ filepool/projects/n26/n26-roots.pdf
- 8.
- 9. 9 Failed to properlyvalidate that you can’t input any other number than yours!
- 10. UNPROTECTED API !(A6) Remote Command Execution SQL Injection Buffer Overflow JSON injection Information Leakage Check: https://blog.talosintelligence.com/2018/07/samsung- smartthings-vulns.html 10
- 11. AND OF COURSE…. EQUIFAX FOR A9 11
- 12. JWT TOKEN VALIDATION 12 Failedto properly validate JWT token (A5) Algorithm (set to None) Claims (audience)
- 13. HOW DID WE GETTHERE? 13
- 14.
- 15.
- 16.
- 17.
- 18.
- 19. VALIDATE AND SANITIZE INPUT 19 URLvalidation Verb validation ✓ Reject if not valid ✓ Reject if user not-authorized Query params validation ✓ Min / Max / Pattern-based matching Content-Type validation ✓ Don’t accept as-is! Accept Header validation ✓ Don’t copy into Content-Type Data inbound ✓ Format ✓ Message Size and complexity Data outbound ✓ Data Leakage ✓ Exception Leakage ✓ Use rules against data dictionary 2 OPEN API to the RESCUE !
- 20. VALIDATE JWT TOKENS 20 Don’t trustthe incoming token! Validate algorithm (the one you chose!) ✓ HS256 ? ✓ RS256 (recommended) Reject None Validate signature ✓ Prefer digital signatures over HMAC ✓ If not, be careful of key exchange Validate standard claims Add your own claims 3 OPEN API to the RESCUE !
- 21. EXTERNAL TOKEN VS.INTERNAL JWT 21 Token Server Validate/ Issue token
- 22. FINE-GRAIN AUTHORIZATION 22 Who is calling? ✓ Is it your own app ? ✓ Is it a trusted user ? What can they do ? Example: T-Mobile number Scopes are often not enough ! ✓ Need ABAC solution ✓ SAML ! 4
- 23.
- 24. START EARLY: SHIFTLEFT ! 24 DeploymentTestingDevelopmentDesign
- 25. COVER THE BASICS 25 Automated Analysis Staticcode analysis 3rd party libraries validation (CVEs) NPS / Snyk for Node.js GitHub dependencies graph Manual Analysis Code reviews 1
- 26. HACK YOURSELVES! 26 API Scanning/Fuzzing ✓ Veracode,Coverity ✓ 42Crunch (alpha) Further Analysis ✓ Bug Bounty ✓ Pen Testing 2
- 27.
- 28. 28 PROTECT YOUR APIS 1 Deploy securitymeasures such as API Security Gateways/Firewalls ✓ Introduce Rate Limiting • Brute force attacks (see N26!) • DOS attacks ✓ Security Policies automatically applied and enforced ✓ Serves as Virtual Patching for protection ✓ Deploy at the edge and/or close to APIs (microservices architecture)
- 29. Use Development ticketingsystem for tracking issues Analyse runtime behaviour and raise issues automatically 29 MONITOR AND ANALYZE 2
- 30. 42CRUNCH DEV-SEC-OPS CYCLEFOR APIS 30 Monitor Assess Protect Test Develop Deploy Monitor Security Vulnerabilities and runtime behavior Continuous API hardening including API fuzzing Deploy to containerized PEP Configure and apply security policies from assessed risk Assess API description and evaluate risk level Develop and document API with OpenAPI/Swagger
- 31. TITLE TEXTHOW SECURITYPEOPLE FEEL ABOUT APIS 31
- 32. CONTACT: INFO@42CRUNCH.COM WWW.42CRUNCH.COM The APISecurity Platform for the Enterprise
- 33. RESOURCES OWASP Top 10 ✓https://www.owasp.org/index.php/Category:OWASP_Top_Ten_2017_Project OWASP DevSlop Project ✓ https://www.owasp.org/index.php/OWASP_DevSlop_Project Chaos Engineering ✓ http://principlesofchaos.org ✓ https://github.com/dastergon/awesome-chaos-engineering OWASP ZAP ✓ https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project Source Code Analysis ✓ https://www.owasp.org/index.php/Source_Code_Analysis_Tools Code Security reviews ✓ https://www.owasp.org/index.php/Code_Review_Introduction Systems Scans ✓ https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools 33
- 34. RESOURCES SSL Setup Scan ✓https://hardenize.com ✓ https://securityheaders.io ✓ https://www.ssllabs.com/ssltest/ Threat Modelling ✓ https://www.owasp.org/index.php/Application_Threat_Modeling Attacks Type Information ✓ XSS: https://excess-xss.com ✓ Buffer Overflow: https://www.youtube.com/watch?v=1S0aBV-Waeo ✓ SQL injection: https://www.youtube.com/watch?v=ciNHn38EyRc ✓ Cookie stealing /XSS: https://www.youtube.com/watch?v=T1QEs3mdJoc Pixi / DevSlop ✓ https://github.com/DevSlop/Pixi ✓ https://devslop.co JWT as session data ✓ https://dzone.com/articles/stop-using-jwts-as-session-tokens 34