What is it?
This assessment targets the security of APIs, which connect systems, services, and applications. It looks for flaws in authentication, authorisation, data validation, and encryption to ensure that APIs are robust against common threats such as injection attacks, data exposure, and abuse.
What could happen?
Compromised APIs may allow attackers to steal confidential data, manipulate back-end systems, or overload services. Poorly secured APIs can lead to fraud, brand damage, and non-compliance with data protection regulations.
What to do about it?
Foundational: Enforce basic authentication, validate all input parameters, and use HTTPS to protect data in transit.
Outcome: A foundational layer of security that reduces common, easily exploitable flaws.
Enhanced: Implement token-based authentication (OAuth, JWT), rate limiting, and logging to detect suspicious behaviour. Use automated scanning tools to uncover common API vulnerabilities (e.g., OWASP API Top 10).
Outcome: Stronger defences against credential abuse and brute-force attacks.
Comprehensive: Integrate runtime application self-protection (RASP), advanced anomaly detection, and machine learning-based tools to identify subtle behavioural anomalies. Continuously refine authorisation policies as APIs evolve.
Outcome: A mature, adaptive API security posture that resists sophisticated threats.
