Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

APIs are great for accessing specific functions and features, but what happens when they allow unauthorized access? Imagine a social media platform where users can share posts. To enable users to access posts, the platform provides an API that allows GET requests to retrieve posts by specifying the user ID and post ID. GET/api/v2.1/user/1438/posts?id=40. The API will return the 40th post for user id 1438. As these are public forums, any user can submit GET requests to access posts.

Balancing the volume of applications and the increased deployment frequency with the need for security is a struggle for both development and security teams. Recent research indicates that vulnerability management in modern software development has become more complex, with 69% of CISOs acknowledging this challenge. Consequently, many applications are not adequately covered by security scans.

The accolades continue for Salt Security! Hot on the heels of being named in Inc.’s Best Workplaces 2023, our platform has now been included in the CyberTech 100 list, which highlights the top companies in cybersecurity for financial services organizations. These company recognitions also follow a slew of recent awards for us, among them the Ally Technology Peace of Mind award presented by Ally Financial, the largest US digital-only bank and auto finance company.

In this post we will explore Linux Crypto API for user applications and try to understand its pros and cons. The Linux Kernel Crypto API was introduced in October 2002. It was initially designed to satisfy internal needs, mostly for IPsec. However, in addition to the kernel itself, user space applications can benefit from it.

Excessive data exposure occurs when APIs reveal more fields, data, and information than the client requires through the API response. Excessive data exposure flaws expose all object properties to API calls rather than what the user needs to act on without considering the object’s sensitivity level. This vulnerability exposes you to data leaks, man-in-the-middle attacks, and other cyber threats. That is why excessive data exposure in APIs is listed as #3 in the OWASP API Security Top 10 2019.

What a week we’re having – and it’s only Thursday! RSA has been action-packed, meeting with customers, showing off our new product enhancements, and booking time with new prospects. Interest in API security is running at an all-time high, as more organizations recognize what Salt saw years ago, that APIs entirely upend the security playing field!

This is the fourth blog in the series focused on PCI DSS, written by an AT&T Cybersecurity consultant. See the first blog relating to IAM and PCI DSS here. See the second blog on PCI DSS reporting details to ensure when contracting quarterly CDE tests here. The third blog on network and data flow diagrams for PCI DSS compliance is here.

With warm and sunny weather expected all week, a bunch of the Salt team is thrilled to be at RSA in San Francisco! We’ll get the chance to talk with security leaders about why API security has become a priority project, and we’ll get time to catch up with customers and each other. It’ll be a great week!