OWASP releases list of Top 10 API security risks

The Open Worldwide Application Security Project (OWASP) has released the second edition of its Top 10 API Security vulnerabilities.

It’s the first update since 2019 and aims to be a comprehensive guide to help API developers, designers, architects and managers understand the risks and threats associated with their APIs, and how to secure them.

Application programming interfaces play a very important role in modern application architecture, the introduction to the list notes, adding, “But since innovation has a different pace than creating security awareness, we believe it’s important to focus on creating awareness for common API security weaknesses.”

Note the list doesn’t do risk analysis. Your organization will have to decide how much security risk from applications and APIs the organization is willing to accept, given your culture, industry, and regulatory environment, the report notes.

The Top 10 are

— broken object level authorization;
— broken authentication;
— broken object property level authorization
— unrestricted resource consumption
— broken function level authorization
— unrestricted access to sensitive business flows;
— server side request forgery;
— security misconfiguration;
— improper inventory management;
— unsafe consumption of APIs

APIs and cybersecurity go hand in hand, argues Mimecast. In fact, the company said in a blog, since they’re predominantly used over public networks, API security is a priority for developers at each stage of design, particularly since highly sensitive information such as login credentials is often shared between two pieces of software using the API. This means that integrating cybersecurity best practices when developing an API must be considered the benchmark upon release.

In a 2022 report, Imperva and Marsh McClennan Global Cyber Risk Analytics Center said that a lack of secure APIs could cost organizations around the world at least US$41 billion a year.

In January, U.S. wireless carrier T-Mobile admitted that a hacker leveraged an API to steal the personal information of 37 million customers over two months late last year. Malicious API requests targeting unprotected APIs are the top threat in the industry, a 2022 research report by Cequence Security revealed.

“The new API Top Ten may not be perfect,” said Jason Kent, hacker in residence at Cequece Security, “but it does show us exactly what we have known for several years now. The landscape of API security is changing, and organizations need to change with it. Whether it is knowing where your APIs are, testing them for flaws or mitigating bots attacking your unknown flows, API security needs to be a focus for everyone, and this new list is a great place to start.”

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer. Former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, Howard has written for several of ITWC's sister publications, including ITBusiness.ca. Before arriving at ITWC he served as a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

Featured Story

How the CTO can Maintain Cloud Momentum Across the Enterprise

Embracing cloud is easy for some individuals. But embedding widespread cloud adoption at the enterprise level is...

Related Tech News

Get ITBusiness Delivered

Our experienced team of journalists brings you engaging content targeted to IT professionals and line-of-business executives delivered directly to your inbox.

Featured Tech Jobs