Web Application and API Vulnerabilities Video

This web application and API vulnerabilities webinar was presented by Kyle Lai on 07/18/2020 at CISO Platform – a 40,000 member international community dedicated to information security (www.cisoplatform.com) 43% of all data breaches were through hacker attacks on web applications in 2019. And that’s more than twice as many as reported in the 2018 (Verizon DBIR). Kyle discusses the most prevalent web application and API vulnerabilities and recommends best practices and tools to mitigate them

Why Modern Web Applications and API’s Are Not Secure:

  1. Insufficient training on Modern Authentication (oAuth, OIDC) and secure handling of access tokens
  2. Insecure implementation of oAuth leads to access token leak and account take over
  3. Insufficient training on new technologies and platforms like cloud and oAuth
  4. Lack of developer training in secure coding practices
  5. Attack trends and current mitigation techniques aren’t be incorporated into coding practices
  6. Security is being compromised in the DevOps pipeline in favor of deployment speed
  7. Weak security in Open Source Libraries and Container Vulnerabilities
    1. Web Application and API’s inherit vulnerabilities from Open Source Components
    2. Rate limiting session management is lacking
    3. Lack of Penetration Testing to identity vulnerabilities

To Reduce Web Application Vulnerabilities:

  1. Train developers on secure coding practices.
  2. Also train software developers on the organization’s modern authentication (i.e. oAuth) implementation
  3. Review authentication and authorization design and implementation
  4. Remove credentials in the code and configuration files; Use Key Vault
  5. Train developers to securely develop in cloud platforms with cloud features
  6. Always fix the root cause of vulnerabilities
  7. Implement Web Application Firewall (WAF)
  8. Scan for vulnerabilities in the code (Static Testing) and when the web app is running (Dynamic Testing)
  9. Likewise, scan for open source components vulnerabilities and apply patches (NPM, Maven, Pypi)
  10. In addition, scan for vulnerabilities on supporting infrastructure such as containers, web servers, and apply patches
  11. Perform manual vulnerability assessment / penetration testing on high risk web applications and APIs

Please see our related discussion of recent Verizon Data Breach Investigation Reports (DBIR)

Scroll to Top