API Security

In the OWASP list of top ten vulnerabilities that affect web applications Broken Authentication comes in second.  It means that a potential attacker can exploit the connection between the visitor’s browser and the API server to steal credentials. If the passwords are encrypted using a weak algorithm the attacker can easily reverse the encyprted password to plain text. In tip 2 we have seen a method to address the broken authentication vulnerability, in this post we will examine the ways to harden the passwords before it can be persisted to the database.

Security Misconfiguration is one of the top ten vulnerabilities in the OWASP list. Misconfigured security rules can lead to several types of “Services attack” where the API’s can be overwhelmed in several ways:
Injection : Commands or Macros can be passed to API’s as payloads which are then run in the background 
Malware : When API’s expect files such as a photos or documents, very Large files can be uploaded 
Abuse of Functionality : The API functionality can be exploited to attack itself

Cloud based applications whether in the Financial domain or otherwise, implement a logical separation between the user interface that is presented to the customer and the programs that fetch the data from the database, perform computation and return a result set. The User Interface (UI) is usually built using graphical components while the  programs that perform computations are built using a framework that exposes them as an API (Application Programming Interface). The coupling between the UI and API is asynchronous i.e. the UI sends a request and gets a response.

The number of security breaches on the Cloud grows exponentially each year. Security breaches target all kinds of applications from a simple website to API driven functional deployments. Cloud Architects should deploy tools and mechanisms to prevent breaches and secure their software assets and data. In a series of posts we present the way we build in application security in the SaaS products we make.