OWASP releases list of Top 10 API security risks

The Open Worldwide Application Security Project (OWASP) has released the second edition of its Top 10 API Security vulnerabilities.

It’s the first update since 2019 and aims to be a comprehensive guide to help API developers, designers, architects and managers understand the risks and threats associated with their APIs, and how to secure them.

Application programming interfaces play a very important role in modern application architecture, the introduction to the list notes, adding, “But since innovation has a different pace than creating security awareness, we believe it’s important to focus on creating awareness for common API security weaknesses.”

Note the list doesn’t do risk analysis. Your organization will have to decide how much security risk from applications and APIs the organization is willing to accept, given your culture, industry, and regulatory environment, the report notes.

The Top 10 are

— broken object level authorization;
— broken authentication;
— broken object property level authorization
— unrestricted resource consumption
— broken function level authorization
— unrestricted access to sensitive business flows;
— server side request forgery;
— security misconfiguration;
— improper inventory management;
— unsafe consumption of APIs

APIs and cybersecurity go hand in hand, argues Mimecast. In fact, the company said in a blog, since they’re predominantly used over public networks, API security is a priority for developers at each stage of design, particularly since highly sensitive information such as login credentials is often shared between two pieces of software using the API. This means that integrating cybersecurity best practices when developing an API must be considered the benchmark upon release.

In a 2022 report, Imperva and Marsh McClennan Global Cyber Risk Analytics Center said that a lack of secure APIs could cost organizations around the world at least US$41 billion a year.

In January, U.S. wireless carrier T-Mobile admitted that a hacker leveraged an API to steal the personal information of 37 million customers over two months late last year. Malicious API requests targeting unprotected APIs are the top threat in the industry, a 2022 research report by Cequence Security revealed.

“The new API Top Ten may not be perfect,” said Jason Kent, hacker in residence at Cequece Security, “but it does show us exactly what we have known for several years now. The landscape of API security is changing, and organizations need to change with it. Whether it is knowing where your APIs are, testing them for flaws or mitigating bots attacking your unknown flows, API security needs to be a focus for everyone, and this new list is a great place to start.”