Our advanced, holistic approach to API security moves beyond a ‘shift left, shield right’ strategy. As threats emerge at every stage of API development, the limited, siloed approach of traditional and legacy solutions continues to expose organizations to API blind spots by focusing on either code analysis or production traffic alone.
We created a multi-lens, single platform solution to shine a light on the entire API development lifecycle, ensuring protection against threats wherever they exist across your API estate.
Introducing API security into your development at the earliest possible stage ensures you can eliminate security vulnerabilities in the source code. Wib’s Fusion Defense uses static code analysis to scan customer repositories and detect API endpoints and logic vulnerabilities. It directly integrates with source code management (SCMs) providers such as GitHub, Bitbucket, and GitLab.
Testing your APIs and reviewing their resilience against attacks is a critical step in securing your APIs. As every API is unique, the testing stage must contain specific tests for each of the APIs in your code. Our Fusion Defense provides automated testing to validate identified vulnerabilities and fixes that have been implemented to remediate or patch them.
As some vulnerabilities only emerge just before or in production, protection at this stage is the final piece of the security puzzle. Wib’s Fusion Defense analyses API traffic – through traffic mirroring, agent-based, wasm/plugin, sidecar or dedicated API gateway – to enable the detection of API security incidents in real-time.
Fusion Defense continuously tests your APIs in the development and testing stages to identify API security vulnerabilities in the code. This provides organizations with insights earlier in the development process instead of relying on finding vulnerabilities in the live environment. Fusion Defense liberates enterprise to innovate, free from the associated security risks of modern application development.
Our API PenTesting service will test your API business logic and empower you to meet your compliance requirements.
The advanced intelligence of Wib’s Fusion Defence was designed to protect organizations against the OWASP top 10 API security vulnerabilities. These attacks aim to exploit the capabilities and features of APIs to gain unauthorized access to sensitive information or systems, disrupt operations or steal valuable resources.
These attacks evade traditional and legacy technologies such as Web Application Firewalls (WAFs) and API Gateways, which rely on predefined rules and patterns to identify and block potentially malicious traffic. Detection therefore requires an advanced, intelligent API security solution.
BOLA/Broken Object Level Authorization
Broken Authentication
Broken Object Property Level Authorization
Unrestricted Resource Consumption
Broken Function-Level Authorization
APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues. Object level authorization checks should be considered in every function that accesses a data source using an ID from the user.
Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user’s identities temporarily or permanently. Compromising a system’s ability to identify the client/user, compromises API security overall.
This category combines API3:2019 Excessive Data Exposure and API6:2019 – Mass Assignment, focusing on the root cause: the lack of or improper authorization validation at the object property level. This leads to information exposure or manipulation by unauthorized parties.
Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request. Successful attacks can lead to Denial of Service or an increase of operational costs.
Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws. By exploiting these issues, attackers can gain access to other users’ resources and/or administrative functions.
Unrestricted Access to Sensitive Business Flows
Server Side Request Forgery
Security Misconfiguration
Improper Inventory Management
Unsafe Consumption of APIs
APIs vulnerable to this risk expose a business flow – such as buying a ticket, or posting a comment – without compensating for how the functionality could harm the business if used excessively in an automated manner. This doesn’t necessarily come from implementation bugs.
Server-Side Request Forgery (SSRF) flaws can occur when an API is fetching a remote resource without validating the user-supplied URI. This enables an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.
APIs and the systems supporting them typically contain complex configurations, meant to make the APIs more customizable. Software and DevOps engineers can miss these configurations, or don’t follow security best practices when it comes to configuration, opening the door for different types of attacks.
APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. A proper inventory of hosts and deployed API versions also are important to mitigate issues such as deprecated API versions and exposed debug endpoints.
Developers tend to trust data received from third-party APIs more than user input, and so tend to adopt weaker security standards. In order to compromise APIs, attackers go after integrated third-party services instead of trying to compromise the target API directly.
Get complete and absolute visibility of your entire API estate with automated API documentation and inventory with Fusion Discovery.
Liberate your business from API security constraints that threaten digital innovation.