Slide 1

Slide 1 text

Securing APIs Lunch and Learn London

Slide 2

Slide 2 text

10+ years working in secure systems Hi! Platform Specialist at Okta Software Developer (.NET / Java / JS) @andymarch

Slide 3

Slide 3 text

OpenStreetMap Yelp Uber Get map data Get reviews Get a ride Find me 5 good pubs between Farringdon and Kings Cross BeerTour.io ThirstyWalker.net Find x good pubs between a and b BeerTour.api Find x good pubs between a and b

Slide 4

Slide 4 text

User API Client

Slide 5

Slide 5 text

Information wants to be free. Stewart Brand

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

Information wants to be free. Information also wants to be expensive. Stewart Brand

Slide 9

Slide 9 text

https://delivery/panerabread.com/foundation-api/users/uramp/738194 August 2017

Slide 10

Slide 10 text

https://delivery/panerabread.com/foundation-api/users/uramp/738194 https://delivery/panerabread.com/foundation-api/users/uramp/738195 https://delivery/panerabread.com/foundation-api/users/uramp/738196 https://delivery/panerabread.com/foundation-api/users/uramp/738197 https://delivery/panerabread.com/foundation-api/users/uramp/ … https://delivery/panerabread.com/foundation-api/users/uramp/ … https://delivery/panerabread.com/foundation-api/users/uramp/ … August 2017 Username, First and last name, Email, Phone number, Birthday, CC last 4 digits, Home address, linked social accounts, saved preferences and dietary restrictions, gift cards

Slide 11

Slide 11 text

Architecting for Security

Slide 12

Slide 12 text

API Maturity Model Phase 0 Integrate internal systems by private APIs Internal collaboration for internal applications Phase 2 Limited API access to partners, resellers and suppliers Phase 3 APIs as full fledged products with external developer access Security Team evaluates use cases, interfaces, authentication, access management, etc, etc Phase 1 Application microservices Shared microservices Trusted partner APIs Public service APIs

Slide 13

Slide 13 text

Think like a bad guy. Icon thenounproject.com/sultanm/

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

API1: Broken Object Level Authorization GET /api/user/12345 GET /api/user/12345 GET /api/user/12346 GET /api/user/12347 GET /api/user/12348

Slide 16

Slide 16 text

API2: Broken Authentication

Slide 17

Slide 17 text

Don’t roll your own identity

Slide 18

Slide 18 text

No content

Slide 19

Slide 19 text

No content

Slide 20

Slide 20 text

API3: Excessive Data Exposure { firstName: test, lastName: tester, email: [email protected], homeAddress: 123 Fake Street, cc: 1234 } Hi test tester /api/user Portal app

Slide 21

Slide 21 text

API3: Excessive Data Exposure { firstName: test, lastName: tester, email: [email protected], } Hi test tester /api/user Portal app { cc: 1234 } Would you like to update your payment card ending 1234 /api/user/payment Portal app

Slide 22

Slide 22 text

API4: Lack of Resources and rate limiting Icon thenounproject.com/sultanm/

Slide 23

Slide 23 text

API5: Broken Function Level Authorization TourOrganiser TourAttendee /tour/info GET GET PUT PUT

Slide 24

Slide 24 text

API6: Mass Assignment { firstName: test, lastName: tester, email: [email protected], homeAddress: 123 Fake Street } PUT /api/user { userid: 12345, firstName: test, lastName: tester, email: [email protected], homeAddress: 123 Fake Street, role: user } { role: admin } PUT /api/user { userid: 12345, firstName: test, lastName: tester, email: [email protected], homeAddress: 123 Fake Street, role: admin }

Slide 25

Slide 25 text

API7: Security Misconfiguration

Slide 26

Slide 26 text

API8: Injection Credit: https://xkcd.com/327/

Slide 27

Slide 27 text

API8: Injection GET /api/user?id=12345 { firstName: test, lastName: tester, email: [email protected], homeAddress: 123 Fake Street }

Slide 28

Slide 28 text

API8: Injection GET /api/user?id=12345%27%20union%20(select%20*%2 0from%20users%3B) {Result: {[ { firstName: test, lastName: tester, email: [email protected], homeAddress: 123 Fake Street}, { firstName: example, lastName: users, email: [email protected], homeAddress: 987 Demo Road}, { firstName: Ex, lastName: Ample, email: [email protected], homeAddress: Flat 1 Test Towers

Slide 29

Slide 29 text

API9: Improper Assets Management /tour/info v1 v1 v1 v2 v2

Slide 30

Slide 30 text

API10: Insufficient Logging & Monitoring Icon thenounproject.com/sultanm/

Slide 31

Slide 31 text

API Access Management

Slide 32

Slide 32 text

API Access Management (API AM) Lifecycle What state is it in? How was it designed? How was it built? Is it deployed? To which GWs? Is it live/available? Interface What does it expose? Which resources? Which methods? Which objects? Which fields? Access Who can use it? Which users/groups? How do they authenticate? Using which clients? In what contexts? Consumption How to succeed with it? API Documentation? Debugging/errors? Track usage? Examples/SDKs? Business How does it drive business goals? Partner CRM Monetization Marketing Business Analytics

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

Delegated authorization with OAuth 2.0

Slide 35

Slide 35 text

Who’s who of OAuth 2.0 Resource Owner Client Authorization Server Resource Server Guest Hotel Room Reception Desk Hotel

Slide 36

Slide 36 text

Authorization Server (The source of trust for the application)

Slide 37

Slide 37 text

No content

Slide 38

Slide 38 text

No content

Slide 39

Slide 39 text

No content

Slide 40

Slide 40 text

Scope (a requested permission)

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

Register: redirect address ClientID, Client secret

Slide 43

Slide 43 text

No content

Slide 44

Slide 44 text

No content

Slide 45

Slide 45 text

ClientId (a unique identifier of an application)

Slide 46

Slide 46 text

ClientSecret (an authenticator for an application)

Slide 47

Slide 47 text

No content

Slide 48

Slide 48 text

No content

Slide 49

Slide 49 text

client id, client secret, scopes Access Token Access Token

Slide 50

Slide 50 text

Access Policy (control the behavior of the authz server for a given application)

Slide 51

Slide 51 text

No content

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

No content

Slide 54

Slide 54 text

No content

Slide 55

Slide 55 text

No content

Slide 56

Slide 56 text

API Access Management (API AM) Lifecycle What state is it in? How was it designed? How was it built? Is it deployed? To which GWs? Is it live/available? Interface What does it expose? Which resources? Which methods? Which objects? Which fields? Access Who can use it? Which users/groups? How do they authenticate? Using which clients? In what contexts? Consumption How to succeed with it? API Documentation? Debugging/errors? Track usage? Examples/SDKs? Business How does it drive business goals? Partner CRM Monetization Marketing Business Analytics

Slide 57

Slide 57 text

&