How to Prevent an
API Breach
Ebook
In this Ebook
Introduction 4 - 5
What is an API Breach?
API Breaches from Known Vulnerabilities 6 - 8
Where’s the Failure?
What’s the Fix?
How Noname protects against known vulnerabilities 8 - 10
Security Testing with Noname Active Testing
Noname Posture Management
Breaches from Rogue APIs 11-13
What’s the Failure?
What’s the Fix?
How Noname protects against Rogue, Zombie, and Shadow APIs
API Breaches from External Exposures 14 - 15
What’s the Failure?
What’s the Fix?
How Noname protects against external exposures
API Breaches from Misconfigurations and Operator Errors 16 - 1 7
What’s the Failure?
What’s the Fix?
Posture Management at Noname Security 1 7
nonamesecurity.com © Noname Security
Ebook
In this Ebook
API Breaches from New Vulnerabilities 18 - 21
What’s the Failure?
What’s the Fix?
Runtime Protection at Noname Security
Conclusion 21 - 22
About Noname Security 23
nonamesecurity.com © Noname Security
Ebook
Introduction
More than 80% of today’s internet traffic consists of API-based communication, and as
Forrester has noted, “As API traffic dominates, API attacks are ubiquitous.”1 While APIs
are now essential for software interoperability, API security has not kept pace with
staggering growth.
Organizations today have an average of 15,564 APIs to secure; large enterprises
(10,000+ employees) have an average of 25,592 APIs. A vulnerability in a single API is all
it takes to invite a breach.
Given the sheer numbers and continued growth and evolution, API security has become
a moving target. In response, the Open Worldwide Application Security Project (OWASP)
has updated its list of top ten API threats for 2023 to help organizations keep up with
the latest vulnerabilities.
Even the largest and most technically sophisticated organizations are vulnerable to API
attacks and data breaches. For instance, a team of researchers recently discovered
critical API flaws across the automotive industry, potentially exposing sensitive
customer data, including addresses, credit card numbers, and VINs. Additional
vulnerabilities can expose a vehicle's location or allow a vehicle's remote management
system to be compromised, enabling a car to be unlocked, started, or disabled.
Telemetry code shared among multiple manufacturers caused these problems to be
widespread.
The examples in this eBook aren’t meant to shame the companies involved. Rather, they
demonstrate how vulnerable all organizations using APIs are—both long-established
enterprises and “digital natives”—and to underscore the diversity of threats in the real
world. Most companies either have experienced an API breach or will in the future. It’s
more a question of “when” than “if.”
What is an API Breach?
Simply put, an API breach is any intentional misuse or abuse of an API, often to gain
access to sensitive data. The various API breaches that have occurred can be
subdivided according to various criteria. For the purposes of identifying risks and
avoiding breaches in production operations, it’s useful to consider the following
classification scheme which breaks down risks into 5 categories:
nonamesecurity.com © Noname Security 4
Ebook
Known vulnerabilities.
1
Hackers exploit known vulnerabilities that haven’t been patched.
Rogue, zombie, and shadow APIs.
2
Unmanaged APIs leave operations vulnerable. (What you don’t know CAN hurt
you.)
External exposures.
3
Credentials, keys, and other exposures may exist outside your control.
Operator errors.
4
Security misconfigurations in infrastructure and services create entry points that
can be exploited.
Undiscovered vulnerabilities and bugs.
5
No software can ever be 100% bug free. Cyber criminals seek to identify and
exploit undiscovered vulnerabilities lurking in your APIs.
T his ebook explores these five types of API breaches and explains where the security
failure occurs in each case and how to fix it. It can help you z
ero in on specific
z
weaknesses in your API security program to maximi e API security and minimi e risk. z
nonamesecurity.com © Noname Security 5
Ebook
About Noname Security
Noname Security is the only company taking a complete, proactive
approach to API Security. Noname works with 20% of the Fortune
500 and covers the entire API security scope — Discovery, Posture
Management, Runtime Protection, and API Security Testing. Noname
Security is privately held, remote-first with headquarters in Silicon
Valley, California, and offices in Tel Aviv and London.
nonamesecurity.com [email protected] +1 (415) 993-7371
nonamesecurity.com © Noname Security 23
