What are APIs? Why are they important in our life? What can go wrong if they were mishandled? How can we make them more secure? Our Speaker Asim Jaweesh answers these questions in his presentation on API Insecurity.

1. API IN(SECURITY)
Asim Jaweesh
Asim [dot] Jaweesh (at) owasp [dot] org

2. AGENDA and technical knowledge
History Rank Issues? defense resource Finish

3. BRIEF HISTORY
0
1
2
3
4
5
6
7
E-Commerce Social Mobile IoT
Time

4. IMPORTANCE
• Integration with other systems.
• Control of UI/UX.
• Cheap tweaks and change requests.
• Saving time and effort.

5. WHAT COULD GO WRONG?

6. MOST VULNERABLE TO HAX

7. COMMON API HACKS OF 2014

8. THINK LIKE A HACKER PROTECTOR
• Access control
• Input validation
• Output encoding
• Cryptography
• Message integrity
• confidentiality

9. ACCESS CONTROLS
• Anti-framing
• Protect HTTP methods
• Whitelist allowable methods
• Protect privileged actions.
• Protect against CSRF
• Protect against IDOR
• API rate limits

10. INPUT VALIDATION
• Input sanitization
• Secure parsing
• Strong typing
• Validate incoming content-type
• Validate response-type
• XML input validation
• Framework-Provided validation

11. OUTPUT ENCODING
• Send secure headers
• JSON encoding
• XML encoding

12. CRYPTOGRAPHY
• Data in transit
• Data in storage

13. MESSAGE INTEGRITY
• In addition to HTTPS, JSON Web Token (JWT)
• JWT guarantee message integrity and authenticate both
sender/ receiver

14. CONFIDENTIALITY
• RESTful web services can leak credentials, tokens and API keys
• https://example.com/resourceCollection/<id>/action
• https://Twitter.com/Jaweesh/lists
• https://example.com/controller/<id>/action?apikey=12345678
• http://example.com/controller/<id>/action?apikey=987654321

15. RESOURCES
• OWASP cheat sheet
• History of API
• Internet of things definition
• SmartBear Practical tips for API
security

16. RECAP
• API new business technology.
• Gaining popularity and trending.
• Can easily wreck your business.
• Good API helps your business.
• Integrate security in development.
• Do periodic security tests.
• Spread awareness.

17. THANK YOU
Asim [dot] Jaweesh (at) owasp [dot] org
@jaw33sh