BLOG

Questions Answered: Top API Security Issues Found During POCs

You had questions, and we’ve got answers!

Thank you for all the questions submitted on our “Top API Security Issues Found During POCs” webinar. Below is the replay and all the answers to the questions that were asked. If you’d like more information please feel free to contact us.

 

[xyz-ihs snippet=”POCs-Webinar”]

 

 

Is there a way to add specific rules to the allowlist?

There are two things you can do today: one is annotating operations or an API so that no authentication checks are required. If the security section is present though, that will take precedence. You can also influence operations sensitivity to increase/decrease the points assigned to a problem. 

We are working on allowing users to specify a list of checks which must not be taken in account for scoring. They will still be reported but will not affect the score. The goal is that this is decided by the security team at the organization level.

 

What are the parameters in OpenAPI for the API firewall? How do you configure that?

The API Firewall directly interprets the OAS file contents.

 

I’m using the VS extension, but it fails every time since a path is not defined. Is there a way to still run tests even though there is no path defined?

Please open a ticket here, attaching the file if you can and we will fix that ASAP.

 

How do you do security testing on API driven applications via lambda functions for beginners in API security?

My recommendation would be to start with being familiar with OWASP Top10 project for API Security (https://apisecurity.io/encyclopedia/content/owasp/owasp-api-security-top-10.htm) and diving into the OWASP cheat sheets  attached to those issues. 

The threats mentioned in that OWASP list are independent from the implementation and therefore you will need to adapt the implementation recommendations to AWS Lambda. 

 

Try our security audit for free. If you want to see the whole platform in action, request a demo now!

Latest Resources

WEBINAR

Protect Your APIs with Microsoft Azure Sentinel and 42Crunch Platforms

This webinar showcases how users of the Microsoft Azure Sentinel platform via the 42Crunch platform integration can proactively protect their APIs. By leveraging 42Crunch’s API security platform, Azure Sentinel users gain visibility into their API infrastructure, identify vulnerabilities, and mitigate risks.

NEWS

42Crunch member of MISA

42Crunch expands Microsoft collaboration by joining MISA

By Newsdesk | January 10, 2023

42Crunch Expands Collaboration with Microsoft by Joining Microsoft Intelligent Security Association Collaboration Consolidates End-to-End API Security Experience for the Enterprise San Francisco, January 10, 2023 – 42Crunch, the Developer First API Security platform company, announced today that it has joined the Microsoft Intelligent Security Association (MISA), a group of […]

DataSheet

Datasheet Cover Images P1-02

Product Datasheet Addressing API Security Challenges

APIs are the core building block of every enterprise’s digital strategy, yet they are also the number one attack surface for hackers. 42Crunch makes developers’ and security practitioners' lives easier by protecting APIs, with a platform that automates security into the API development pipeline and gives full oversight of security policy enforcement at every stage of the API lifecycle.

WEBINAR

Protect Your APIs with Microsoft Azure Sentinel and 42Crunch Platforms

This webinar showcases how users of the Microsoft Azure Sentinel platform via the 42Crunch platform integration can proactively protect their APIs. By leveraging 42Crunch’s API security platform, Azure Sentinel users gain visibility into their API infrastructure, identify vulnerabilities, and mitigate risks.

NEWS

42Crunch member of MISA

42Crunch expands Microsoft collaboration by joining MISA

By Newsdesk | January 10, 2023

42Crunch Expands Collaboration with Microsoft by Joining Microsoft Intelligent Security Association Collaboration Consolidates End-to-End API Security Experience for the Enterprise San Francisco, January 10, 2023 – 42Crunch, the Developer First API Security platform company, announced today that it has joined the Microsoft Intelligent Security Association (MISA), a group of […]

DataSheet

Datasheet Cover Images P1-02

Product Datasheet Addressing API Security Challenges

APIs are the core building block of every enterprise’s digital strategy, yet they are also the number one attack surface for hackers. 42Crunch makes developers’ and security practitioners' lives easier by protecting APIs, with a platform that automates security into the API development pipeline and gives full oversight of security policy enforcement at every stage of the API lifecycle.

Ready to Learn More?

Developer-first solution for delivering API security as code.