Category - API Security Blog

I have a new job, Im no longer working on the game.

If you want to keep playing it, go ahead https://t.co/HmlWT1DJVo ...

September 18, 2021

I’m a software engineer, currently working on the Google+ team.

I've worked on various parts of Google+, including the home stream, notifications, and search. I was born in Stuttgart (Germany) but grew up in San Diego (California). My parents are both computer sc ...

September 18, 2021

SAST tools are not designed for API-centric applications and as such do not work well on them.

WAFs cant protect APIs, but they try anyway Web Application Firewalls (WAFs) have been around since the early 2000's when OWASP released their first Top 10 list of web application vulnerabilities. ...

September 18, 2021

SAST tools are not designed for API-centric applications and so do not work well on them.

APIs Are Not Web Applications Theyre Microservices! The other problem with SAST is that it was designed to be used against monolithic web applications, which have a single entry point (typically ...

September 18, 2021

SAST tools are not designed for API-centric applications and therefore have a higher false positive rate.

API Security Testing is more complex than SAST SAST works by examining the source code of an application to determine where it may be vulnerable to external attack, but this does not take into accoun ...

September 18, 2021

SAST tools are not designed for the unique data flow of APIs SAST is too slow to be effective on API-centric applications The second problem with SAST is that its just too slow.

The typical approach to a web application vulnerability assessment involves scanning the codebase, creating a model and then running this against an automated scanner such as Burp Suite or ZAP. This p ...

September 17, 2021

The API-University book series is a collection of books that teach you how to design, build and manage APIs.

The first volume, "API Design" teaches you the basics of designing APIs for your business or startup. tl;dr: The second volume, "API Security" teaches you about the most critical security risks in AP ...

September 17, 2021

API security has often been a blind spot for enterprises.

In fact, its very common to see unauthenticated APIs. From incidents like mHealth APPs, Panera bread, Fiserv, LifeLock, Kay Jewelers and several others API security had remained a crucial factor. T ...

September 17, 2021