Heading 1

In today’s fast-paced digital ecosystem, APIs are the lifeblood connecting an ever-growing universe of applications and systems, driving efficiency and agility for modern organizations. But as APIs continue to proliferate, they introduce new risks that cybersecurity teams must navigate with precision and purpose. The Enterprise Strategy Group (ESG) has released a new report, “API Security from Development to Runtime” that sheds light on critical trends, challenges, and best practices shaping the landscape of API security. Here’s a look at a few of the report’s compelling insights – each of which underscores why it’s a must-read for cybersecurity professionals.

1. API Explosion: Growth Outpacing Security Preparedness

The report confirms what we’ve been observing for the past few years – the API footprint is expanding at an astonishing rate, with API usage expected to encompass 78% of applications within the next two years. APIs facilitate critical connections, from internal systems to third-party applications and now of course AI workloads, making them high-value targets for attackers. This massive expansion heightens the challenge of monitoring, securing, and controlling APIs, especially as over a one third of APIs connect directly to the internet and another third serve as conduits to other applications. Given the high stakes, this growing reliance on APIs demands a more mature, comprehensive approach to security that begins at development and extends through deployment and runtime. Ideally, an approach that shifts left while protecting right.

Cybersecurity professionals need to be ahead of the game, with strategies that focus on secure-by-design principles, pre-production API testing, continuous monitoring, and real-time threat detection and mitigation. Organizations lacking solid API discovery, inventory, and monitoring protocol leave themselves open to breaches, service disruptions, and regulatory risks as their API landscape expands.

2. API Attacks are Frequent and Costly

While API usage grows, so do the attacks. The report notes that a striking 64% of organizations faced API security incidents in the past year. Common attack types include injection attacks (39%), denial-of-service (DoS) incidents (35%), and data exposure events (34%). Each type of attack highlights different vulnerabilities – DoS attacks disrupt availability, while injection attacks and data exposure compromise sensitive information. What makes API security particularly challenging is the diverse threat landscape: each attack requires a distinct approach for prevention and mitigation. For example, API business logic abuse requires special capabilities to detect, as the APIs are behaving as designed, per specification. Notably, 82% of respondents are concerned about API business logic abuse.

The business impacts of these attacks can be severe. Almost half of the organizations reported increased operational costs, and a third faced compliance issues or brand damage. Negative customer experiences and application downtime round out the list of repercussions, reinforcing the need for cybersecurity teams to approach API security as both a technical and a strategic imperative. Threats are constantly evolving, even taking advantage of AI, requiring security professionals to be agile with tools to match.

3. Collaboration and Training: The Core of a Proactive API Security Strategy

The shift toward DevOps and agile development means that API security isn’t just the security team’s problem; it requires a cross-functional, collaborative approach. The report points to a significant gap in this area, with only half of organizations involving security teams before publishing APIs, and nearly 10% waiting until APIs are live in production. This delay leaves a wide window open for potential vulnerabilities.

To address this, organizations are prioritizing training, with 85% offering formal API security training to development teams. However, the report emphasizes that training alone isn’t enough—cross-functional collaboration must become the norm. Teams across development, operations, and security need consistent engagement throughout the API lifecycle. Improving collaboration not only minimizes security risks but also fosters a culture where secure development is an embedded practice rather than an afterthought.

4. Tools and Budget: Investing in the Right Solutions

API security requires specialized tools that can handle everything from API discovery and inventory to real-time threat prevention and monitoring. Encouragingly, the report shows that organizations are dedicating substantial budget increases to API security, with 52% planning a significant boost in spending. These funds are channeled toward dedicated API security tools, integrated application security solutions, and cloud-native protection platforms. This would appear to signal a shift from a reactive to proactive approach, giving teams the resources to detect and mitigate threats before they impact business operations.

Final Thoughts

API security is at a critical juncture. With API usage skyrocketing and new threats emerging, cybersecurity professionals must adopt a holistic approach that spans the entire API lifecycle. The insights from “API Security from Development to Runtime” provide a comprehensive framework for tackling these challenges, from enhancing collaboration to investing in the right tools and embracing automation. This report is more than an industry overview; it’s a call to action for organizations to fortify their API security strategies and stay ahead of an ever-evolving threat landscape.

With just days to go before the U.S. election, securing our digital landscape is more critical than ever. Our latest infographic, Vote for API Security: Which States Are Leading the Charge?, provides an in-depth analysis of state-by-state API infrastructures, highlighting both strengths and vulnerabilities. Cequence analyzed the public-facing attack surface of each state in the U.S. and analyzed metrics related to API hosting, provider distribution, and security findings. Discover where risks are minimized and learn about best practices in API security. This is your opportunity to make a difference – not just at the polls but also in the vital realm of cybersecurity.

Which States Are Excelling in API Security?

According to our data, states like Kansas, New Mexico, and Hawaii demonstrate the lowest levels of API security risk. These states have implemented rigorous API management and security practices, setting a standard for others to follow. By focusing on proactive risk mitigation, they exemplify what it means to build secure digital infrastructure.

On the other end of the spectrum, California and Alabama show higher instances of security vulnerabilities in their API setups, particularly around Transport Layer Security (TLS) and publicly accessible non-production environments. These findings highlight areas where there’s room for improvement to better protect sensitive data.

For an in-depth look, explore the full Infographic to see which states are leading the charge and which still have work to do.

Key API Security Insights by State

States with the Most API Hosts

States like California, Texas, and New York host a high volume of APIs hosts, indicating a heavy reliance on APIs to deliver services and manage data. This also makes them prime targets for cyberattacks, as each API represents a potential entry point for malicious actors. Organizations in these data-rich environments must prioritize robust security measures to protect sensitive information and maintain resilience against evolving threats.

States with the Fewest API Hosts

States with fewer API hosts, such as Kentucky, New Mexico, and Hawaii, may have a smaller attack surface, but that doesn’t mean they are invulnerable. With fewer resources allocated to API security, these states could be using outdated or less secure technology, making them attractive targets for attackers looking for “low-hanging fruit” vulnerabilities.

States with the Most Security Findings

States like California, New Hampshire, and Alabama have high numbers of security findings, highlighting gaps in API management and security practices. Each security finding represents a risk that could lead to data breaches or service disruptions. Addressing these vulnerabilities helps reduce exposure to attacks and strengthens cyber resilience across the state.

Top Security Vulnerabilities in Focus

The infographic identifies the Top 3 Security Findings in APIs across the United States:

1. TLS Misconfigurations: Weak or outdated encryption practices jeopardize secure data transmission.
2. Login Risks: Authentication vulnerabilities at login endpoints increase the risk of unauthorized access.
3. Publicly Accessible Non-Production Environments: Poorly secured test environments can unintentionally expose sensitive data to public access.

These common vulnerabilities indicate areas that are often overlooked but critical to securing API infrastructure. By addressing these specific risks, organizations can better protect user data, maintain operational integrity, and reduce the likelihood of security incidents.

The Role of API Providers in Security

The infographic also sheds light on the top API infrastructure providers:

• Cloudflare, Amazon Web Services (AWS), and Google Cloud Platform (GCP) are the most popular hosting providers for APIs, supporting vast networks of data-driven services across the country.
• Akamai, AWS API Gateway, and Azure API Management are among the top gateway providers, helping organizations centralize and secure their API management.

These providers are integral to modern API ecosystems, and their configurations play a critical role in either reinforcing or undermining API security.

Security Best Practices Checklist

To help organizations and public sector entities minimize risks, we’ve compiled a list of API Security Best Practices:

• Restrict API Exposure: Limit access to sensitive data by enforcing strict access controls.
• Minimize Provider Dependencies: Rely on fewer, highly secure third-party providers.
• Utilize Mature Cloud Providers: Choose providers with strong security track records and continuously monitor for vulnerabilities.
• Limit Gateway Diversity: Using fewer gateway types can simplify management and improve oversight.
• Implement Strong Transport Encryption: Regularly audit encryption methods to ensure secure traffic transmission.

For a complete list, be sure to check out our Infographic for actionable steps you can take to secure your digital landscape.

Why API Security Matters During Election Season

The current landscape of API security is as divided as the political map, with states led by different political parties showing varied readiness levels. Our findings show that Democratic-led states currently pull slightly ahead in cybersecurity readiness, though the difference is slight. Just as we participate in elections to shape our political future, adopting robust API security practices allows us to shape a safer digital future for all.

Let’s make sure we’re protecting what matters most, from the polling stations to our digital platforms.

Get a Free API Security Assessment

Curious about where your organization stands in the API security landscape? Cequence Security offers a Free API Security Assessment to help you understand potential vulnerabilities and bolster your defenses. Request your free assessment today and join the states leading the way in API security.

Today’s businesses are increasingly cloud-forward and becoming more agile than ever, and the retail vertical in particular has embraced this digital transformation. Amazon Web Services (AWS) and Cequence have partnered to offer a unique set of solutions ideally suited for retailers looking to ensure application and API security. The integrated solutions combine the world’s most comprehensive and broadly adopted cloud in AWS with the best-in-class API security and bot management from Cequence. Retail businesses using the combined solution can be sure to have a highly scalable set of solutions that will protect their applications and APIs against manual and automated attacks. Now, we are excited to announce that Cequence has attained AWS Retail Competency status.

AWS Retail Competency Status

The AWS Retail Competency designation confirms Cequence’s ability to meet the rigorous standards required to deliver quality, scalable solutions to AWS customers. This recognizes Cequence’s ability as an AWS Partner Network (APN) member to provide innovative offerings that support retailers’ modernization efforts and grow and evolve with their businesses. Earning the AWS Retail Competency requires partners to demonstrate success deploying solutions on AWS in real-world retail businesses as Cequence has proven across its retail customer base. As an AWS Retail Competency partner, Cequence delivers advanced API security and bot management designed for cloud environments and leveraging the power of AWS.

“Cequence is proud to achieve AWS Retail Competency status,” said Arun Gowda, VP of business development at Cequence. “It highlights our commitment to helping retail customers secure their applications and APIs from attacks as well as to AWS, our trusted partner. Leveraging the agility and scalability of AWS ensures that we can deliver the tools to maintain a robust application and API security posture.”

Cequence is also an ISV Accelerate partner and is certified CloudFront Ready.

Cequence Solutions on the AWS Marketplace

Cequence currently offers two solutions in the AWS marketplace. AWS customers can leverage the AWS Marketplace to easily procure Cequence solutions and burn down AWS EDP/PPA commitments

• Cequence Unified API Protection (UAP) platform – the full Cequence API security and bot management platform, offering complete protection from the application and API threats that cause data loss, theft, fraud, and business disruption.
• Cequence Managed Application and API Security – pairs the Cequence UAP platform and Cequence managed services with AWS WAF to deliver a scalable, managed API security and bot management solution.

Cequence Integrations with AWS

Cequence integrates with several AWS products. The links below lead to detailed integration guides for more information.

• AWS CloudFront
• Amazon API Gateway
• AWS VPC Traffic Mirroring
• AWS App Runner

Webinar: Upgrade Your Edge Security with AWS and Cequence API Security

Watch the on-demand webinar and learn how AWS and Cequence Security’s joint solution can level up your edge security program and deliver superior performance, enhanced security, and significant cost savings. Hear from AWS and Cequence experts how Amazon CloudFront and AWS Web Application Firewall combine with Cequence API security and bot management to provide a comprehensive solution.

Learn More

• Visit Cequence on the AWS marketplace
• Check out the Cequence AWS partner page
• Read the joint solution brief
• Watch the on-demand joint webinar

The retail industry is highly seasonal, experiencing tremendous activity bursts during specific periods. Many of these periods coincide with holidays like Memorial Day, Labor Day, and Christmas with retailers launching grand promotions that result in frenzied activity in both their physical and electronic storefronts. Major retailers now see levels of revenue from their e-commerce engines that rival, and in some cases surpass, their physical stores. As a result, e-commerce is no longer a “nice to have” alternative revenue generator, but a critical part of the broader business.

Every retailer knows exactly how much revenue their electronic presence delivers over a given time period, making it easy to assess the potential damage of an outage or interruption. In fact, it’s not uncommon for retailers to put that figure at thousands of dollars per minute, even more during holiday periods.

With the aforementioned retail activity, we see corresponding increases in cybercrime. Threat actors use these periods of dramatically increased activity to mask their own illicit activities, much like a physical criminal would use the cloak of darkness for a robbery. For example, over the Labor Day holiday sales period this year, the retail vertical saw an 79% surge in blocked automated attack traffic year over year.

Cequence recently issued a press release around these retail findings, and published a great infographic that provides a more graphical view of these retail cybersecurity storms that retailers face.

There are no shortage of attack types that the retail industry must weather. These attacks include, but aren’t limited to:

• Account takeover
• Inventory Hoarding
• Hype/Flash Sales
• Price Scraping
• Gift Card Fraud
• Loyalty Program Abuse

Each of these attacks adversely affects site performance and availability, customer satisfaction, and your bottom line.

Since Cequence works with many large retailers, we’re in a position to see how threat actors behave toward the industry as a whole. We leverage this data to constantly improve the efficacy of our API security and bot management solutions. And while we regularly detect and prevent attacks, we also on occasion discover new vulnerabilities before they are even exploited.

Recent Food & Drug Retail Cybersecurity Vulnerability Example

Recently, a Cequence CQ Prime team member identified a critical vulnerability within a web application of one of the largest food and drug retailers in the United States. Their IT infrastructure had a number of publicly-accessible subdomains, inadvertently exposing the actuator endpoint which is used to monitor and manage the health, performance, and behavior of an application. In this case, the actuator endpoint permitted unauthorized users to access and extract sensitive data from heap dumps, offering a snapshot of active objects and potentially sensitive data such as root passwords.

Once Cequence Security identified this critical vulnerability, we followed a responsible disclosure protocol, notifying the retailer and giving them a 90-day period to verify and remediate the issue. Providing this window of time is crucial for giving organizations the opportunity to address significant vulnerabilities without exposing their systems further to risk. To frame this more clearly, this vulnerability is so serious that it could lead to severe security breaches and would likely be awarded a CVSS value of 9.8, indicating the highest level of risk.

Some Technical Details

To protect the retailer, we’re not disclosing their identity, but do want to provide a bit fuller picture to help us all learn from the incident.

The exposed actuator endpoint enables attackers to download heap dumps directly from the server. Heap dumps are essentially snapshots of all the objects in memory (or Java Virtual Machine (JVM) heap) at a certain point in time. What is revealed in heap dumps is often far more sensitive than simply API endpoints. Credentials, session tokens, and configuration details are frequently revealed which when compromised, can lead to serious business disruption.

By utilizing tools such as Visual VM, attackers can analyze these dumps to uncover sensitive information, including user credentials, session tokens, and configuration details. This data can be exploited to gain administrative access to the retailer’s AppDynamics portal (a common application performance monitoring tool), enabling malicious actors to:

1. Perform CRUD operations on all users and roles, which can lead to privileged account creation, deletion of legitimate accounts, and adversely affecting database performance
2. Create and destroy server instances, perhaps building undetected criminal shadow infrastructure, or performing acts of wanton destruction
3. Manage databases, creating or deleting them at will, casting doubt on what data is correct and legitimate, and what might be falsified
4. Introduce policies that hinder the system’s normal operations, disable security measures to gain further access, or create backdoors for future attacks

“The implications of this retail cybersecurity exposure are substantial,” said Parth Shukla, Security Engineer at Cequence. “An attacker with access to AppDynamics could potentially monitor all of this retailer’s applications, gaining insights into online orders, customer behavior, and even in-store point-of-sales data if monitored by AppDynamics. This could expose vast amounts of sensitive information and leave the entire operational landscape vulnerable to scrutiny and manipulation.”

The Impact: Why It Matters

The potential fallout from this particular vulnerability is significant. Unauthorized access to sensitive data often leads to:

1. Operational Disruption: Attackers gaining control over server instances and databases.
2. Data Breaches: Exposure of confidential information, including user credentials and session tokens that can lead to further downstream breaches and even lawsuits.
3. Reputational Damage: Loss of customer trust and confidence.
4. Financial implications: Breach notification laws often have direct financial penalties, in addition to the cost of reaching out to all affected customers, providing credit monitoring services, etc.

This vulnerability was completely preventable. Perhaps AppDynamics was misconfigured by the retailer, or maybe there was another set of events that enabled the inappropriate exposure of a sensitive endpoint. Organizations must know what endpoints exist, where they are, and which are publicly accessible, so continuous API discovery is key. Regular testing and assessments help, as do solid dev/QA/runtime processes.

Our CQ Prime threat research team is constantly on the lookout for new and interesting threats. Understanding how they work, where they’re being delivered from, the tools delivering the attack, etc. This understanding not only enriches them professionally, but makes our product offering more valuable, as their insights and learnings are constantly being added to our machine learning models and threat database. All of which to say, their work is constantly making the Cequence Unified API Protection platform an even more capable solution, benefiting all of our customers.

Cybersecurity Strategies for Protecting the Retail Business

Retailers must safeguard their electronic presence to protect both their customers, partners, and the business as a whole. Not doing so is costly on many fronts. A discovery, comply, and protect methodology is an effective framework for meeting these retail cybersecurity goals.

• Discover your APIs. You can’t protect what you’re unaware of, so it makes sense to put a system in place that continuously discovers and inventories new, unknown, and shadow APIs. Cequence Spyder is an easy way to get started.
• Make sure that your APIs follow your internal governance as well as comply with external regulations. For example, most retailers accept credit cards, and therefore must comply with PCI DSS. Having documentation for your APIs, and testing them in pre-production before going live is key. Cequence Sentinel offers API Security testing and compliance.
• Retailers must protect their applications and APIs to prevent attacks, abuse, fraud, and data loss. Because every second of downtime matters, the system of record must be capable of real-time detection and mitigation. Cequence Spartan offers industry-leading application and API protection through bot management and fraud prevention.

Want to learn more? Get started with a free, no-obligation API security assessment that provides an attacker’s view into your organization’s APIs. Or better still, book a personalized demo.

Cequence Security has been recognized as a Leader and Outperformer in the new GigaOm Radar for API Security report, highlighting our innovative approach and comprehensive protection capabilities. This recognition comes as a testament to our dedication to safeguarding digital assets in an increasingly complex software landscape. The GigaOm report specifically praises the Cequence Unified API Protection (UAP) platform for its ability to proactively discover vulnerabilities, manage security postures, and combat automated threats through advanced bot management.

As the demand for API security continues to rise, our holistic approach—combining discovery, risk assessment, and active defense—sets us apart from our competitors. We are proud to be one of only two vendors identified as an Outperformer among those evaluated in the report.

Making an informed investment decision when it comes to cybersecurity solutions can be tough. This new GigaOm Radar for API Security report examines 13 of the industry’s top API security solutions and compares the offerings against functional capabilities (table stakes, key features, and emerging features) as well as business criteria. It’s a great analysis tool designed to help security, IT, and DevSecOps leaders identify the best-fit solutions for your organization.

Why API Security Matters

It’s no coincidence that the increasing complexity of modern software architectures has correspondingly resulted in a steadily growing population of APIs that support our modern applications and services.

“The rising importance of API security cannot be overstated,” said Kirk Ryan, consulting analyst at GigaOm. “As organizations increasingly rely on APIs to power their digital ecosystems, these interfaces have become prime targets for malicious actors. What sets Cequence apart from some of its peers is its holistic approach to API protection, which combines discovery, risk assessment, and active defense mechanisms in a single, integrated platform.”

Comprehensive API Security Solutions

Cequence offers robust solutions across three key areas –discover, comply, and protect. Your Security, DevSecOps, and IT teams benefit from:

• API Attack Surface Discovery: Proactively identifies vulnerabilities and misconfigurations across the entire API landscape, ensuring a robust security posture that adapts to evolving threats.
• API Security Posture Management: Effectively discovers, catalogs and profiles all APIs for risk—including shadow and zombie APIs—providing enhanced visibility and risk management to safeguard against potential exploits.
• Bot Management and Fraud Prevention: Protect your applications and APIs and ensure the integrity of critical business operations by utilizing advanced detection and mitigation mechanisms to combat automated bot attacks and business logic abuse. Cequence delivers comprehensive protection against all automated threats including the OWASP API Security Top 10 vulnerabilities.

The Cequence UAP platform leverages sophisticated machine learning algorithms and behavioral analysis to meticulously analyze API traffic in real time, facilitating the swift identification and mitigation of potential threats natively, without having to rely on third-party infrastructure that simply wasn’t built for API security. This proactive approach not only enhances security but also empowers organizations to respond dynamically to emerging risks. With flexible SaaS, on-premises or hybrid deployment options the platform seamlessly integrates with diverse organizational infrastructures and existing security frameworks, ensuring comprehensive protection tailored to meet varied business needs.

The aforementioned complexity of the application and API landscape makes artificial intelligence (AI) and machine learning (ML) ideally suited for attackers and defenders alike. Large language models (LLM) make it easier and faster to create purpose-built bots and are likely to pose challenges that we are just starting to see in the wild. AI models already exist that claim to defeat CAPTCHAs with 100% accuracy, which will most certainly fuel the decades-old game of cat-and-mouse. The best bot management solutions have relied on ML models to detect threats and automated attacks, whether they’re part of loud, brute force-style attacks or quieter slow-and-low attacks that were previously nearly impossible to detect. Cequence is working hard to protect our customers from AI-powered attacks, as well as enabling their safe use of AI. If you’d like to learn more, check out this blog on GenAI.

Want to learn more? Get started with a free, no-obligation API security assessment that provides an attacker’s view into your organization’s APIs. Or better still, book a personalized demo.

The Digital Operational Resilience Act (DORA) is a significant regulation introduced by the European Union, set to take effect on 17 January 2025. While DORA is primarily designed to enhance the operational resilience of financial entities against ICT-related incidents, its impact extends far beyond financial institutions.

DORA establishes requirements and principles that financial entities must adhere to, focusing on outcomes and risk management practices rather than prescribing specific technical controls or technologies. This approach allows organizations to tailor their compliance efforts based on their unique risk profiles and operational needs.

However, the implications of DORA do not stop with financial institutions. The regulation also significantly affects supply chain companies, particularly those providing Information and Communication Technology (ICT) services to financial entities. DORA recognizes the critical role these third-party service providers play in the operational resilience of financial institutions and imposes specific requirements to ensure that they do not introduce undue risks. Consequently, companies that have financial institutions as customers or are viewed as part of the supply chain must also align with DORA’s requirements to avoid becoming a weak link in the chain.

Failure to comply with DORA can have severe consequences for financial entities, including substantial fines, enforcement actions, and increased regulatory oversight, with the severity depending on the breach’s impact and the organization’s size. Regulatory authorities have the power to take enforcement actions against non-compliant entities, which could include orders to cease certain activities, restrictions on business operations, or mandates to implement specific remedial measures. Additionally, entities that fail to comply may face additional oversight or stricter reporting requirements imposed by authorities, potentially increasing the regulatory burden and operational costs.

Leveraging Cequence to Achieve DORA Compliance

Security and Protection

• Comprehensive API Security: Cequence offers API security solutions that protect against threats like unauthorized access, data breaches, and API abuse. By securing APIs, Cequence helps financial entities safeguard their digital interfaces, which are often critical for their operations.
• Threat Detection and Mitigation: By providing real-time monitoring and detection of malicious activities targeting APIs, Cequence helps financial entities quickly identify and mitigate threats, thereby ensuring continuity and minimizing the impact of incidents.
• Compliance with Security Standards: Cequence’s API security solutions can be tailored to meet the specific requirements outlined in DORA, ensuring that financial entities’ APIs comply with industry standards and best practices for cybersecurity.

Incident Management and Response

• Automated Threat Response: Cequence can integrate with financial entities’ security operations to automate the detection and response to API-related incidents, reducing response times and limiting the potential damage from ICT-related incidents.
• Incident Reporting: Cequence’s tools can be configured to facilitate the reporting of significant incidents to regulatory authorities, as required by DORA. This includes providing detailed logs and analytics that help in the classification and reporting of incidents.

Risk Management and Resilience Testing

• API Risk Assessment: Cequence can assist financial entities in conducting regular risk assessments of their APIs, identifying potential vulnerabilities, and implementing measures to mitigate those risks in line with DORA’s requirements.
• Continuous Resilience Testing: Cequence provides tools for continuous testing of API security and resilience. This includes vulnerability scanning, penetration testing, and stress testing to ensure that APIs can withstand different types of attacks and disruptions.

Third-Party Risk Management

• Monitoring Third-Party APIs: Cequence offers solutions that identify, monitor, and secure APIs provided by third-party vendors, helping financial entities manage the risks associated with third-party services. This is particularly important given DORA’s emphasis on managing ICT third-party risks.
• Supply Chain Security: Cequence can help financial entities assess and secure the APIs used by their suppliers and partners, ensuring that the entire supply chain is resilient and compliant with DORA.

Security Automation and Orchestration

• Automation of Security Controls: Cequence provides automation capabilities that can help financial entities implement and maintain consistent security controls across their API environments. This reduces the likelihood of human error and ensures continuous DORA compliance.
• Orchestration of Incident Response: Cequence’s solutions can help orchestrate incident response processes across different teams and systems, ensuring that financial entities can quickly respond to and recover from ICT-related incidents.

Threat Intelligence and Information Sharing

• Threat Intelligence Integration: Cequence offers threat intelligence services that provide financial entities with up-to-date information on emerging threats targeting APIs. This enables proactive defense measures and aligns with DORA’s encouragement of information sharing among entities.
• Collaboration Platforms: Cequence can facilitate secure platforms for sharing threat intelligence and security best practices among financial entities, helping them collectively improve their resilience against common threats.

Support for Compliance and Audit Preparation

• Compliance Reporting: Cequence can assist financial entities in generating the necessary reports and documentation required for DORA compliance, including evidence of API security measures and incident response procedures.
• Audit Readiness: Cequence’s tools help financial entities prepare for audits by providing comprehensive visibility into their API security posture, ensuring that they can demonstrate compliance with DORA during regulatory assessments.

While the Digital Operational Resilience Act (DORA) is clearly aimed at strengthening the IT security of European financial entities such as banks, insurance companies and investment firms, it also clearly applies to the third-party risk that vendors and supply chain partners may represent. As financial institutions have continued to embrace technology to better serve their customers, shorten time to market, and control costs, it’s clear that having the right tools in place to monitor and protect this infrastructure is critical. Organizations must be able to discover their API attack surface, ensure compliance with internal governance and external regulations, and detect and mitigate attacks against their applications and APIs. These security pillars are no longer “nice to have”, but rather are necessary capabilities to ensure future success.

Why Trust Centers Matter

A Trust Center plays a crucial role in building and maintaining trust with customers. It provides a single source of truth for security documentation, certifications, and ongoing updates, helping businesses reassure customers that their data is in safe hands. Trust Centers streamline security review processes, reduce the need for repetitive communications, and address concerns around third-party risk management.

Key Features of the Cequence Trust Center

Cequence’s Trust Center offers several key features that highlight our commitment to security and transparency. Here’s what you can find:

1. Security Certifications and Compliance
   Our Trust Center showcases detailed information on industry certifications that Cequence holds, such as SOC 2, ISO 27001, and compliance with regulations like GDPR, CCPA, and HIPAA. These certifications demonstrate our adherence to the highest security and privacy standards, ensuring customers that their data is protected and managed responsibly.
2. Incident Reporting and Transparency
   In the event of a security incident, Cequence takes a proactive approach to communication. The Trust Center provides real-time updates on any incidents and our responses. This level of transparency assures customers that we are accountable and prepared to resolve any issues swiftly.
3. Data Governance and Access Control
   Cequence employs strict access controls and robust data governance measures to protect sensitive information. Our Trust Center explains how we manage and govern data, allowing customers to see the steps we take to secure their data against unauthorized access.
4. FAQs and Knowledge Base
   We understand that customers often have questions about security and compliance. The Trust Center includes a comprehensive knowledge base with frequently asked questions, making it easy for customers to find answers without waiting for manual responses.
5. Public and Private Documentation
   Cequence provides both public and private security documentation through the Trust Center. While certain information, such as compliance certifications, is publicly available, more sensitive documents, like penetration testing results, are shared privately with customers after they meet necessary legal agreements, such as NDAs.

Supporting Vendor Risk Management

Vendor risk management has become an essential aspect of any organization’s cybersecurity framework. Trust Centers are an invaluable tool for companies looking to simplify and automate the risk management process. Through Cequence’s Trust Center, we consolidate critical security information in one place, reducing the back-and-forth communication typically required for security reviews.

A Commitment to Continuous Improvement

At Cequence, we believe that security and compliance are ongoing processes. Our Trust Center is continually updated with the latest security certifications, audit results, and incident reports. This dedication to continuous improvement reflects our commitment to maintaining a robust security posture and staying ahead of emerging threats.

Building Customer Confidence

Trust is built on transparency. At Cequence, we recognize that our customers need assurance that their data is secure and their compliance needs are being met. The Cequence Trust Center gives customers a clear, transparent view of our cybersecurity practices, demonstrating our commitment to proactive defense and compliance adherence.

Supporting Customer Compliance Efforts

Cequence solutions also play a role for many of our customers in their own governance and compliance efforts. API security initiatives are often employed to ensure that there is no inappropriate API access to sensitive data including personally identifiable information (PII). A number of relevant regulations exist, including PCI-DSS, HIPAA, GDPR, and SOX, and new ones like the Digital Operational Resilience Act (DORA) which go into effect early next year.

Conclusion

Security and compliance are the cornerstones of trust in today’s digital business environment. Cequence understands this and has invested in creating a Trust Center that ensures transparency and accountability. Through our Trust Center, we provide customers with an easy way to access critical security and compliance information, simplifying the security review process and providing peace of mind.

Flash sales, hype sales, and online product launches – like limited-edition sneakers – generate interest, excitement, and high demand from customers, so naturally they have also become a target for cyberattacks. These events often involve high-value items, making them prime targets for malicious actors and their bot armies. Understanding application and API vulnerabilities and the need for robust security precautions is essential for businesses that rely on these types of sales.

Flash sales and limited releases rely on the excitement of scarcity, with thousands of users attempting to grab products within seconds. However, they’ve also attracted bad actors, who use bots to automate the purchasing process, giving them an unfair advantage over regular customers. Bots, often controlled by scalpers, are programmed to swarm websites, completing purchases faster than human users could, often leading to the following issues:

• Inventory issues: Bots quickly buy up desirable products, causing them to sell out within seconds and frustrating genuine customers.
• Price inflation: Scalpers buy up stock to resell on secondary markets at inflated prices, hurting brand reputation and customer loyalty.
• Infrastructure strain: Malicious bot traffic can overwhelm a website’s infrastructure, leading to site crashes, a degraded user experience, and adversely affecting marketing web site/buyer behavior statistics.
• Customer frustration and reputational damage: Waiting in a virtual line for hours only to find out your desired item is sold out can cost customers and damage the company’s reputation.
• Lost revenue: Bots can sometimes manipulate the applications and APIs – even if coded properly – to enable bad actors to steal merchandise. Downtime and lost customers also affect the bottom line.

These attacks typically exploit weaknesses in applications and their associated APIs, which are the backbone of many e-commerce platforms. They enable users to access product catalogs, initiate transactions, and interact with various services seamlessly. However, if not properly secured, APIs can become an open door for cybercriminals. Implementing proper security controls enables businesses to monitor, authenticate, and restrict traffic, ensuring that only actual customers can access critical functions.

Automated Bots Scale Attacks

In order to increase the scale of the attacks, bad actors typically employ automated bots. These bots may hide behind residential proxies, rendering useless IP-based prevention methods like Web Application Firewalls (WAFs). To be effective against today’s sophisticated and in many cases custom-coded bots, solutions need to employ machine learning and behavioral analysis to identify and separate malicious traffic and bots from good, and track them as they change tactics to evade detection. Native mitigation – actions like logging, rate limiting, deception, and blocking – is also a necessity; when you have one product detecting bots and another providing mitigation, response time suffers, and some bots may get through.

Case Study: Global Sports-Fashion Retail Company Dunks the Bots

A global sports-fashion retailer faced sophisticated, customized bot attacks that enabled attackers to bypass flash sale and product launch queues and acquire an inordinate amount of limited-edition and/or in-demand merchandise that would otherwise be available to legitimate customers. The concentrated bot attacks often caused site outages, affecting normal business as well as the flash sales themselves. Additionally, the attackers made use of the mobile application API which was more difficult to protect than the application itself and was therefore an easier target.

Prior to implementing Cequence, this retailer resorted to many suboptimal solutions including:

• Utilizing waiting rooms for both bots and legitimate buyers, causing customer friction
• Disabling their mobile applications during flash sales and forcing users to the website
• Launching flash sales and new products in the middle of the night so that any site outages created by the bot swarms would have less effect on legitimate business
• Launching far fewer flash sales than they wanted to, affecting revenue

The company’s prior bot management solution was largely based on IP reputation which attackers easily circumvented using Bulletproof or residential proxies, so they were interested in a more intelligent solution that would stop the bots without affecting legitimate business. Cequence’s behavioral analysis-based bot detection and mitigation enabled the company to detect and prevent the malicious bots and roll back their previous undesirable solutions mentioned above. Product launches are now held whenever the company desires, i.e., during regular business hours with no waiting rooms, on both the website and mobile applications, and at a much higher frequency than before.

As flash sales and high-demand product launches continue to grow in popularity, businesses must invest in robust security measures, particularly around APIs and bot management. Without them, the business risks are high. Implementing a strong API security program and a comprehensive bot management strategy ensures a fair shopping experience for legitimate customers and keeps bad actors at bay.

Contact us to learn how Cequence can help your business combat the bots that get in the way of your business using legitimate tools like flash sales.

In the API-driven world of modern enterprises, security vulnerabilities such as Broken Object Level Authorization (BOLA) represent one of the more insidious threats. These weaknesses are often exploited by attackers through bot-driven automation and can lead to data breaches and privacy violations. It’s not always convenient or even possible to immediately remediate the problem through code fixes, which must be implemented, tested, and then moved to production. A popular alternative that is effective and quick to implement is virtual patching, which protects vulnerable API endpoints without the need for immediate code changes. In a recent incident, our team at Cequence Security successfully detected and mitigated a major BOLA vulnerability using virtual patching. Here’s a detailed look at what happened, how it was detected, and how virtual patching played a pivotal role in remediation.

What are BOLA Vulnerabilities?

What exactly is a BOLA vulnerability? Broken object level authorization (BOLA) is a security vulnerability that occurs when an application or application programming interface (API) provides access to data objects based on the user’s role but fails to verify if the user is authorized to access those specific data objects.

The Danger of BOLA Vulnerabilities

BOLA vulnerabilities rank among the OWASP API Security Top 10 due to their high potential for exploitation and the direct access it gives to sensitive data. When attackers successfully exploit a BOLA vulnerability, they can retrieve sensitive user data by manipulating object identifiers, bypassing normal authorization checks. These attacks are typically carried out by bots, programmed to rapidly scrape and exfiltrate data. Left unchecked, they can result in massive data breaches and regulatory compliance violations, including penalties under GDPR, HIPAA, or PCI DSS.

The Incident: A Broken Object Level Authorization Vulnerability Unveiled

Last month at one of the largest dating sites in the world, an anomalous user session journey behavior triggered an alert in the Cequence Unified API Protection platform. The anomalous traffic was traced to a specific API that allowed unauthenticated access to certain user information – a glaring BOLA vulnerability. While Cequence was able to confirm that the vulnerability was not being actively exploited, the vulnerability remained and could be exploited at any time, which risked privacy violations and reputational damage for the company.

Detection: How Our Systems Uncovered the Anomaly

One of the core strengths of the Cequence platform is its ability to detect deviations from normal traffic behavior. By leveraging machine learning and historical baselines, the system can distinguish between ordinary traffic fluctuations and potential security threats. In this case, the Cequence ML models analyzed session patterns across the platform and flagged the sudden surge in requests to the API endpoint. These requests were tied to IP addresses from known hosting providers and residential proxies, a hallmark of bot-driven attacks. This abnormal traffic was a clear signal that something was amiss — prompting our team to take immediate action. By correlating these observations with a lack of authentication in the request headers, it became evident that attackers could take advantage of a BOLA vulnerability in this API endpoint.

Mitigation: The Role of virtual patching in Securing APIs

In order to mitigate the vulnerability as quickly as possible, Cequence recommended implementing virtual patching, a real-time, scalable remedy that secures API endpoints without requiring changes to the underlying codebase. Virtual patching provides an immediate fix to vulnerabilities by enforcing security policies within Cequence, enabling rapid protection even as developers work on permanent code-level patches. Here’s how Cequence virtual patching works:

1. Immediate Enforcement of Security Policies: Policies can be swiftly implemented to protect the API endpoints from known vulnerabilities such as the BOLA vulnerability in this example. Any API calls lacking proper authentication can be immediately blocked, cutting off attackers’ access to user data.
2. Dynamic and Adaptive Protection: One of the key benefits of virtual patching is its adaptability. As attacks evolve, so do the rules and policies that virtual patching enforces.
3. Zero Impact on Development Cycles: Virtual patching enables security measures to be applied in real time, allowing the development team to work on permanent fixes without interrupting normal operations. This makes it a perfect solution for fast-moving enterprises that rely heavily on APIs but can’t afford downtime or extended patching windows.

The Growing Importance of virtual patching in API Security

As enterprises continue to scale their digital operations, and with the advent of Generative AI applications, the number of APIs they rely on will only increase. With this expansion comes a greater need for robust, scalable security measures, and virtual patching offers a flexible, real-time remedy that fills the security gaps left by traditional patching processes. Traditional patching can be time-consuming and disruptive, especially in environments with frequent deployments or where development and operations teams work in silos. In contrast, virtual patching operates independently of development cycles, allowing for immediate protection while long-term fixes are developed in parallel.

Best Practices for Implementing virtual patching

To get the most out of virtual patching in API security, it is recommended to follow these best practices:

1. Continuous Monitoring: Always monitor API traffic for any deviations from normal behavior. Machine learning models help detect these anomalies quickly and accurately.
2. Layered Security: Use virtual patching as part of a broader, layered security approach that includes proper API governance, testing, and compliance checks to ensure comprehensive protection across the API lifecycle.
3. Tailored Security Policies: Customize virtual patching policies to address specific vulnerabilities. For example, enforcing cookie validation or rate limiting for certain API endpoints can prevent unauthorized access or data scraping attempts.
4. Collaborative Feedback: Work closely with your security and development teams to gather insights from both sides. Virtual patching allows for flexible feedback loops, enabling continuous improvement of your security policies.

In an increasingly API-dependent world, security vulnerabilities such as BOLAs continue to pose serious risks. However, with the right tools, such as virtual patching, enterprises can stay ahead of attackers and protect their digital assets in real-time. Cequence’s superior detection and mitigation capabilities ensure that your API ecosystem remains safe, no matter how quickly it grows or changes. To get started easily, get a free API security assessment and see what your attacker sees.

The Rise of the Gig Economy and GenAI

The gig economy, driven by short-term contracts and freelance work, has dramatically reshaped the modern business landscape. Popular platforms such as Uber, Lyft, and Fiverr enable seamless interactions between users, gig workers, and service providers through the power of APIs. These APIs are critical to providing real-time services, processing payments, and connecting all ecosystem players.

However, this dependency also creates new vulnerabilities. Attackers are constantly evolving, leveraging Generative AI (GenAI) to craft more sophisticated attacks, including scraping, account takeovers (ATO), and even AI-generated fake interactions. With APIs as the primary medium of interaction, securing them is paramount. In this context, API security is not just a technical requirement but a vital business necessity to maintain platform integrity, customer trust, and market competitiveness.

The Challenges with Traditional App Defense Solutions in the Age of GenAI

As gig economy businesses grow, they are increasingly vulnerable to fraud and abuse, and bots enable attackers to exploit those vulnerabilities at scale. Traditional application defense solutions, which were never designed for the modern complexities of APIs or the intelligent tactics of GenAI, fall short in several critical areas:

• Reliance on JavaScript and Mobile SDKs: Legacy app defense systems rely on embedding code into end-user applications and devices, which slows deployment and leaves platforms vulnerable to reverse engineering. Some of this code, such as CAPTCHAs, also introduces customer friction. As GenAI technology advances continue, attackers can bypass these systems by using AI-generated scripts that mimic human behavior.
• Inability to Handle Pure API Calls: Traditional solutions are designed for end-user interactions but falter in managing API-to-API communications. Gig economy platforms often involve API transactions between businesses, which are susceptible to GenAI-powered threats, such as AI-automated bots performing scraping or launching volumetric attacks.
• Ineffectiveness Against Evolving Threats: In the age of GenAI, attackers can craft highly personalized and targeted attacks. Legacy solutions are reactive, slow, and ineffective in recognizing the complex patterns and subtle behaviors that GenAI-enabled attackers can generate.

Types of Companies in the Gig Economy Facing GenAI-Driven API Threats

The gig economy is vast, encompassing various industries, each with unique API security needs. As GenAI evolves, it introduces new challenges across different sectors of the gig economy. Here’s a look at how API security is crucial for different types of gig companies:

1. Ride-Sharing and Delivery Platforms
   • Examples: Uber, Lyft, DoorDash, Postmates
   • Risk: APIs in these services facilitate real-time matching between drivers and customers. With GenAI, attackers could use advanced scraping techniques to extract pricing data, or AI-powered bots to simulate customer requests, overwhelming the platform’s systems.
2. Freelance Marketplaces
   • Examples: Upwork, Fiverr, Freelancer.com
   • Risk: AI-generated fake job postings and manipulated proposals threaten the integrity of these platforms. GenAI could also be used to automate scraping of sensitive freelancer information, enabling competitors to undercut prices or steal business
3. On-Demand Service Providers
   • Examples: TaskRabbit, Thumbtack
   • Risk: APIs manage job postings, worker profiles, and payments. GenAI-enabled bots could create fraudulent service requests, fake customer reviews, or manipulate the rating system, undermining the trust on which these platforms rely.
4. Online Staffing Agencies
   • Examples: Shiftgig, Wonolo
   • Risk: GenAI technologies could automate job application fraud or even hijack worker accounts, submitting fraudulent claims for job completions or manipulating availability slots.
5. Learning and Tutoring Platforms
   • Examples: Chegg, Wyzant
   • Risk: On these platforms, adversaries could create fake tutoring sessions, manipulate payment structures, or abuse refund systems, all through APIs that handle transactions, communications, and scheduling.
6. Digital Media and Content Creation
   • Examples: YouTube, Patreon
   • Risk: APIs that process ad revenue, subscriptions, and donations are potential targets. Attackers could create massive bot networks to siphon ad revenue or manipulate engagement metrics like views or likes.

Preparing for the Future with GenAI in Mind

API security is a strategic business concern for gig economy companies, especially in an era where GenAI can automate and accelerate cyberattacks. If these platforms do not take the necessary precautions, they risk:

• Loss of Customer Trust: AI-generated attacks can quickly erode trust between gig platforms and users. If a platform experiences a data breach or fraud due to inadequate API security, it may lose customers and gig workers alike.
• Financial Loss: Payment fraud, business logic abuse, and account takeovers facilitated by GenAI could result in massive financial losses—not only from stolen funds but also from the costs of remediating the attacks.
• Competitive Disadvantage: GenAI-powered competitors could scrape gig platforms’ proprietary data and use it to gain an edge in the market. Without proper API protection, your platform could be at a significant disadvantage.

Defending against GenAI Attacks with Cequence Unified API Protection

The Cequence Unified API Protection platform is designed to tackle both traditional and AI-powered threats, making it the ideal solution for gig economy companies facing the evolving challenges posed by GenAI. Here’s why it’s tailor-made for gig platforms:

• Frictionless, GenAI-Resistant Bot Management: Cequence requires no app instrumentation, making it quick to deploy and invisible to both attackers and developers. With the rise of GenAI, this capability is essential, as GenAI bots are adept at reverse-engineering legacy solutions.
• Real-Time Threat Mitigation: Cequence provides real-time protection, meaning gig platforms can stop GenAI-powered attacks as they happen and before they’re successful – whether it’s scraping, account takeovers, or business logic abuse.
• Machine Learning-Powered Risk Engine: Cequence’s risk engine is continuously learning and adapting to evolving threats, including those powered by GenAI. This ensures that even the most subtle AI-generated patterns of malicious activity are detected and blocked.
• Comprehensive API Security: Cequence offers API discovery, governance, compliance, security testing, and native mitigation—all within a single platform. As gig economy platforms continue to grow and evolve, the need for unified, scalable API security has never been more critical, particularly in the face of GenAI-driven attacks.

Countering GenAI-Driven Threats

With GenAI enabling more sophisticated attacks, gig economy companies must adopt comprehensive API security strategies. Here are several use cases that demonstrate the importance of API security and bot management in combating GenAI-powered fraud:

1. Preventing Competitive Scraping Powered by GenAI
   1. Use Case: On freelance platforms like Fiverr, AI-enabled bots can scrape data on pricing, profiles, and job postings at a rapid pace, enabling competitors to undercut your business.
   2. Solution: Cequence’s advanced bot management system uses machine learning to detect abnormal scraping patterns and block them in real-time, even when GenAI tries to mimic human behavior.
2. Stopping Account Takeovers in a GenAI-Driven World
   1. Use Case: GenAI can be used to launch sophisticated credential-stuffing attacks, attempting millions of login combinations to take over gig worker accounts on platforms like Upwork.
   2. Solution: Cequence leverages entity behavior analytics to recognize suspicious login attempts and stop account takeover attempts before they can succeed.
3. Mitigating AI-Enhanced Payment Fraud
   1. Use Case: Payment systems on gig platforms are a prime target for AI-driven attacks. For instance, an attacker using GenAI could mimic payment behaviors and manipulate API endpoints to steal funds.
   2. Solution: Cequence continuously monitors payment behaviors for anomalies, using machine learning to detect and block fraudulent activities initiated by GenAI bots.
4. Blocking Business Logic Abuse Through AI Automation
   1. Use Case: GenAI can abuse API functionality by automating repetitive tasks, such as triggering refund requests or creating fake bookings on platforms like Taskrabbit.
   2. Solution: Cequence identifies abnormal usage patterns and stops AI-automated business logic abuse, safeguarding the platform’s operations.
5. Protecting Against Fraudulent Job Postings and AI-Created Interactions
   1. Use Case: AI-generated job postings can flood platforms like Thumbtack with fake tasks, overloading systems and frustrating legitimate users.
   2. Solution: Cequence detects and mitigates automated fraudulent interactions in real time, allowing only genuine requests to pass through.

Secure Your Gig Economy Business Today

The gig economy is thriving, but with this growth comes an increasing risk of API abuse, particularly from GenAI-powered attackers. The Cequence Unified API Protection platform offers a comprehensive, scalable solution designed to address these evolving threats. Whether you need to prevent scraping, stop account takeovers, or block AI-automated fraud, Cequence ensures your gig economy business is secure in today’s GenAI-driven world.

Don’t wait for an attack – schedule a demo today and learn how our API security and bot management solutions can protect your API ecosystem from the threats of today and tomorrow.

Travel and hospitality companies are entering one of the busiest times of the year, with peak seasons like vacations and holidays bringing a surge in traveler activity. Unfortunately, this increase in traffic also attracts cybercriminals, who exploit the high volume of online activity to launch attacks. For travelers, this means being extra cautious with personal information, while travel and hospitality companies must enhance their security measures to protect customer data and maintain trust. Here’s a detailed look at our recent travel and hospitality cybersecurity research into the top 10 hospitality and travel companies and what can be done to stay secure.

Growing Hospitality and Travel Cybersecurity Threats

As travel peaks, cyber threats tend to escalate. Our research confirms that malicious actors often use the increased online traffic during these busy seasons as a cover for their attacks. The data shows a clear correlation between higher traffic volumes and a rise in DDoS attacks.

Key Findings from Our Analysis

We examined the public-facing API security posture of the top 10 travel and hospitality companies using Cequence API Spyder. Our findings reveal several critical issues:

Prevalent Vulnerabilities

• Every company analyzed had serious, public-facing vulnerabilities.
• Four of these companies were responsible for 91% of the serious vulnerabilities, many of which could enable Man-in-the-Middle (MitM) attacks.
• Cloud Management Challenges

Companies showed liberal use of multiple hosting providers, ranging from 5 to 21 different providers. This “cloud sprawl” can complicate the management and security of cloud infrastructure.

Unintentionally Public Servers

8 out of 10 companies had public-facing non-production or internal application servers, with one company having over 300 such servers. These servers are sometimes the result of development or QA activity, are often unmonitored, and can be an easy entry point for attackers.

Top Performers and Areas for Improvement

Fewest Vulnerabilities:

• Gold: Skyscanner
• Silver: Kayak
• Bronze: Orbitz

Fewest Public Servers:

• Gold: Tie – Orbitz & Travelocity
• Silver: Kayak
• Bronze: Skyscanner

The Impact of DDoS Attacks

Our data shows that during the winter travel holiday season, starting in October, we typically see a sharp increase in DDoS attacks. November 2023 saw the highest number of DDoS attacks in the travel industry for the entire year, with attacks reaching up to 1.03 Gbps and lasting as long as 7.43 hours.

Cequence API Spyder is SaaS-based discovery tool that provides an attacker’s view into an organization’s public-facing resources to identify external API hosts, unauthorized hosting providers, and API-specific security issues.

Governance and Compliance: Preparing for PCI DSS v4.0

With PCI DSS v4.0 coming into full effect on April 1, 2025, travel and hospitality companies must ensure they are compliant. This standard is critical for the protection of credit card information, and non-compliance can result in significant penalties and reputational damage.

Steps to Enhance Security

To address these vulnerabilities and protect against cyber threats, travel and hospitality companies should:

• Continuously monitor public-facing applications and APIs
• Strengthen API security by addressing public-facing vulnerabilities.
• Manage cloud infrastructure more effectively to prevent cloud sprawl.
• Regularly review and secure public-facing non-production servers to avoid unauthorized access.
• For travelers, maintaining awareness of potential cyber threats and employing strong travel cybersecurity practices is essential to protect personal and financial information.

Coverage and Recognition

Our research into the cybersecurity landscape of the top travel and hospitality companies has garnered significant attention. We are proud to have been featured in several prominent media outlets, including:

• Travel Pulse and MSN: Cybercriminals Capitalizing on Travel Industry’s Peak Season
• Dark Reading: Top Travel Sites Have Some First-Class Security Issues to Clean Up
• Security Magazine: Malicious actors are leveraging peak travel and vacation times
• SecurityWeek: Travel websites exposed to attacks
• Help Net Security: Cybercriminals capitalize on travel industry’s peak season
• Tech Day: Cybercriminals target top travel sites during peak season

We extend a special thank you to our friends at Vercara (part of DigiCert) for their invaluable contribution. Their DNS and DDoS data was crucial in supporting our research and providing deeper insights into the hospitality and travel cybersecurity challenges facing their industry.

For more information on securing your travel business, download our infographic and explore our Unified API Protection platform.

All technological disruptions of the past three decades have exhibited a similar trait wherein security took a backseat to innovation, and generative AI (GenAI) has been no exception. While enterprises and consumers are rushing to embrace this new disruptive technology, security is simply not top of mind for most of them. As such, there are few inherent security controls built into today’s GenAI systems.

APIs are the primary method of communication with and between GenAI systems. As such, any conversation about GenAI and security must focus on API security. This conversation is not as straightforward as it might seem at first blush as there are multiple perspectives:

GenAI systems abusing other systems:

• Enterprises need to prevent resource over usage and IP theft from GenAI scraping bots
• GenAI systems can be utilized to launch more complex attacks faster than ever

GenAI systems abused by bad actors:

• GenAI systems need to be protected from abuse and monitored for sensitive data leakage
• Enterprises need to control GenAI use in their organization for cost or other reasons

The OWASP community has defined the top 10 threats for deploying and managing Large Language Models (LLM) and GenAI with the OWASP LLM Top 10. As with all OWASP Top 10 lists, it is an excellent starting point, but most organizations will need to go further in their security efforts.

Cequence makes extensive use of machine learning and GenAI in its products, using it to detect and track sophisticated attacks even as they evolve and re-tool, to autonomously create API security tests, and provide security for the various GenAI use cases described above.

Protection from GenAI:

1. Unapproved data scraping/IP theft – GenAI companies scrape data from public websites at a pace never before seen. There have been numerous reports that many GenAI scraping bots do not honor robots.txt files or “allow to scrape” lists. This can lead to increased infrastructure costs as well as potential customer friction and leaks of sensitive or competitive information.
   • Cequence can prevent excessive scraping of data by GenAI systems and regulate their behavior based on enterprise policies. Cequence identifies AI scraping bots and can natively take various mitigation actions as determined by the customer including logging, rate limiting, or blocking.
2. GenAI systems can be manipulated to launch attacks on other networks. In such cases, they act as jump hosts for the attackers. Exacerbating this issue is the fact that LLMs are generally considered benign and are subject to less scrutiny and fewer security controls. Read our blog about how hackers can use ChatGPT to launch automated attacks.
   • Cequence can stop fraud and abuse from GenAI systems based on their pattern of behavior with third-party systems. Through its Threat and Entity Behavior Analytics, Cequence detects anomalous behavior and determines whether it is malicious, at which point action (such as blocking) is enacted.
   • Cequence can monitor user interactions to GenAI systems to flag or stop attempts to manipulate them for abuse on third-party systems.

Protection for GenAI:

1. Sensitive data leakage – When training or using either external or self-hosted GenAI systems, sensitive data can leak outside an organization.
   • Cequence flags all forms of sensitive data being sent to or received from GenAI systems. This includes model training, model output, user queries, etc.
2. Excessive usage and metering – Excessive usage of GenAI systems can lead to excessive spend and a “denial of wallet” situation. Excessive usage could be triggered as a result of a misconfiguration, human error, application error, or malicious intent.
   • Cequence can monitor usage of GenAI systems and meter the usage through rules and policies.
3. OWASP LLM Top 10 – The OWASP foundation has created a list of top 10 risks for Large Language Models including GenAI systems. The list includes attacks such as prompt engineering, insecure handling, and training data poisoning.
   • The Cequence API security testing tool includes a battery of tests designed around the OWASP LLM Top 10. In August 2024, Cequence announced the industry’s first API security testing suite for GenAI applications.

Generative AI has great potential to change how we work and conduct business, and the clarity of that potential has accelerated adoption as well as revealed a dramatically increased attack surface. As organizations find new ways to make use of GenAI, it’s critical that security isn’t an afterthought. A holistic approach to application and API security combined with a security solution capable of addressing the use cases described above can ensure that GenAI is a net positive for your business. For more information, see our Securing GenAI page, or if you’re ready to talk, book a demo with us.

Protecting Hibbett’s Future (and Past) with API Security

The mark of many successful businesses is longevity, and Hibbett certainly fits that description. They have been around longer than many, if not most, retailers in the U.S. Headquartered in Birmingham, Alabama and established in 1945, the retailer has successfully distinguished itself from others by building a wide network of convenient locations in smaller cities that aren’t typically served by the larger brand stores, paired with personalized customer service, and of course, comprehensive access to coveted footwear, apparel, and equipment from the nation’s top brands. In the digital era, Hibbett has recognized the importance of robust API security to safeguard their digital assets and ensure seamless customer experiences across their platforms.

Lee Morris, Hibbett’s Senior Director of Security and Infrastructure Architecture, has worked for Hibbett for over 30 years and sees safe, secure technology use as a cornerstone of helping ensure their bright future. In fact, a key part of Hibbett’s success has been innovation. Even though the brand has always been about human connection, they have embraced a web presence, for example. Today, in addition to their storied local presence of physical stores, customers also enjoy the convenience of ordering products from the company’s website (hibbett.com).

Other innovations include leveraging the cloud as part of their infrastructure, and seeing cybersecurity as a function to further, rather than hinder, the business. Security is no longer the department of ‘no’,” said Morris. “With all of the powerful technology solutions we have in place, we are now recognized as a business enabler.”

A hybrid IT infrastructure takes advantage of SaaS products as a key tool. Working with Oracle Cloud. Incorporating Azure Identity Services. The list goes on. And they all depend on APIs. “Hibbett has gone from just a few API processes moving data between a couple of applications, to an environment where almost everything we do is through API communications,” said Stephen Scandrett, Senior Security Engineer at Hibbett Sports.

Application and API Security – Core Requirements

Knowing that a thorough understanding of their API attack surface was crucial to building a solid, long-term foundation for their efforts, API discovery was at the top of their requirements list. Clear visibility and protection of all internal and external APIs would feed into other efforts. Of course, Hibbett needed to be able to deploy and manage the solution without disproportionately consuming valuable IT and security resources. And, given the importance of their web presence, Hibbett knew that both the customer experience and the security of their web applications were paramount, so protection from automated attacks would be necessary.

Why Cequence Security?

Like many organizations, Hibbett began their search by taking advantage of Gartner Peer Insights data to identify the top API security companies. They wanted to make sure that they were not only working with great technology, but leading customer support and service.

Of course, the Hibbett team had technology priorities like robust API discovery and testing and protecting their customer-facing web applications from attack with a leading bot management solution. In the end, Hibbett chose the Cequence Unified API Protection platform, because “Cequence was the only solution that met all of our criteria,” said Morris, and “…Cequence had very positive customer reviews — not only for its API security products and capabilities, but for its high level of customer service as well.”

In the end, the Cequence solution proved to be easy to deploy, requiring no changes to Hibbett’s on-premises, cloud, or SaaS infrastructure.

Seeing into the Future

Not only has Hibbett gained the visibility they were looking for across their APIs, but they also rest easy knowing that their web applications are protected from threats and attacks. Interfacing electronically with partners has also come with Hibbett’s success, and of course, this also happens across APIs, so security plays an important role here as well. The Cequence solution is helping the Hibbett team contribute to the company’s success in an outsized way, automating threat detection capabilities while enabling comprehensive inventory management, compliance, and API protection across all online and in-store brands helps ensure continued success in market.

To learn more about Hibbett’s use of Cequence, see their case study and press release.

Cequence recently protected multiple major telecommunications companies, each a global leader with over 100 million customers, from a series of six high-profile Broken Object Level Authorization (BOLA) API attacks. Most of these companies use Google’s Apigee API Gateway and rely on Cequence for advanced threat detection and prevention. Cequence successfully blocked over 22 million malicious requests at one of these telecom companies, preventing significant financial loss and safeguarding sensitive customer data. This blog delves deeper into the details of this BOLA attack.

What is a BOLA attack?

BOLA attacks focus on vulnerable authentication mechanisms of applications and APIs and enable attackers to access objects they otherwise would not have access to by manipulating object IDs. Objects attackers manipulate can include things like phone numbers, email addresses, first names, and more. By interacting with a vulnerable API and adjusting these objects (such as changing a digit in the phone number), the attacker may be able to perform an account takeover (ATO) or other costly attack. Learn more about BOLA attacks.

The Anatomy of the Attack

One of the world’s largest telecoms faced an unprecedented attack, with over 22 million requests bombarding six different APIs. The attackers aimed to blend their malicious traffic with legitimate API requests, making detection difficult. This attack was meticulously designed to exploit API endpoints, particularly those involved in device trade-ins (e.g., phones, tablets), by manipulating International Mobile Equipment Identity (IMEI) numbers to submit fraudulent trade-in orders.

Clean Proxies: The Attackers’ Cloak of Invisibility

A key tactic employed by the attackers was the use of clean proxies with residential IP addresses of the targets’ primary business country, previously unassociated with malicious activities. This approach allowed the malicious traffic to seamlessly blend with legitimate user requests, bypassing traditional IP-based defenses. The use of these proxies exemplified the sophistication of the attack, highlighting the inadequacy of conventional security measures that rely solely on IP reputation databases.

IMEI Number Manipulation: The Core of the Attack

The attackers systematically generated and validated IMEI numbers, exploiting vulnerabilities in the device trade-in systems. By identifying valid IMEI numbers, they could fraudulently manipulate orders to claim higher trade-in values for less valuable devices. This posed significant financial risks and threatened the integrity of the telecom’s trade-in program. Detecting and mitigating such an attack required advanced tools capable of deep packet inspection (DPI) and behavioral analysis, which Cequence provided.

Temporal Patterns: Mimicking Legitimate User Behavior

The bot activity was concentrated on weekdays between 9:00 a.m. and 5:00 p.m., mimicking legitimate user behavior. This tactic further complicated detection efforts, as traditional anomaly detection systems, which rely on identifying unusual traffic spikes, were less likely to flag this activity. The attackers’ ability to disguise their actions within normal business hours emphasized the need for more sophisticated detection mechanisms.

Cequence’s Response: A Multi-Layered Defense Strategy

Initial Detection: Leveraging Advanced Analytics

Cequence’s state-of-the art bot management solution played a crucial role in identifying the BOLA attack. Advanced analytics capabilities allowed it to detect abnormal traffic patterns associated with the 22 million malicious requests. Unlike traditional systems that might only flag large volumes of requests, Cequence delved deeper, identifying systematic IMEI testing and the use of clean proxies. By performing deep packet inspection and analyzing traffic at a granular level, Cequence flagged the suspicious activity early, enabling a swift response.

Session Identifiers and Bearer Tokens: Tracing the Attack’s Footprint

To trace the attack back to its source, the Cequence team analyzed session identifiers and bearer tokens. These tools allowed the team to track the bots’ movement across various APIs, detecting when the same tokens were reused in multiple requests – a clear indicator of automated activity. This analysis was pivotal in identifying and isolating the malicious traffic.

Behavioral Analysis: Identifying and Isolating Malicious Patterns

Behavioral analysis was instrumental in the successful response. By examining the timing, frequency, and nature of the requests, the security team differentiated between legitimate user behavior and bot activities. Specific patterns, such as systematic IMEI testing and temporal alignment with business hours, were identified as key indicators of the attack. These insights enabled the development of targeted countermeasures.

Real-time Defense: Blocking the Attack Without Disrupting Service

Armed with a comprehensive understanding of the attack, Cequence implemented precise countermeasures in the form of rules and policies to protect the company’s network without disrupting legitimate users. Cequence utilized header injection to monitor API traffic in real time, adding custom headers to HTTP requests and responses. This allowed for detailed tracking of suspicious activities without altering the end-user experience. Stricter blocking policies were also enforced, focusing on specific malicious behaviors, such as the use of clean proxies and IMEI manipulation. These targeted measures effectively neutralized the BOLA attack while ensuring uninterrupted service for legitimate users.

How Cequence Can Protect Your APIs

As application and API attacks continue to evolve, so too must the security measures designed to protect them. Cequence’s multi-layered defense strategy – leveraging comprehensive collection, advanced analytics, and behavioral analysis using a combination of product and managed services – proved crucial in mitigating this sophisticated attack on some of the world’s largest telecom organizations.

Comprehensive API Protection for Telecoms: Cequence provides a holistic approach to safeguarding telecommunications APIs, addressing both known and emerging threats. With our deep understanding of the telecom domain, including critical identifiers like IMEI (International Mobile Equipment Identity), MSISDN (Mobile Station International Subscriber Directory Number), and CPNI (Customer Proprietary Network Information), our solutions are precisely tailored to protect these sensitive assets from sophisticated attack vectors.

Real-Time Threat Detection and Mitigation in Telecom Networks: Our advanced tools are designed for real-time monitoring and analysis of telecom-specific API traffic, ensuring immediate detection and response to suspicious activities. By preventing unauthorized access to IMEI databases, MSISDN manipulation, and safeguarding CPNI, Cequence minimizes the risk of data breaches, financial losses, and regulatory non-compliance.

Tailored Security Solutions for Telecommunication Infrastructure: Cequence delivers customizable security policies that seamlessly integrate with existing telecom infrastructure, including APIs associated with device trade-ins, customer service portals, and billing systems. Our solutions are built to handle the unique challenges of large-scale, complex telecom environments, ensuring continuous and secure operations.

Expertise in Tackling Complex Telecom-Specific Attack Scenarios: With extensive experience in managing large-scale attacks across the telecommunications sector, our team is equipped to deploy multi-layered defenses against threats targeting critical telecom assets. We understand the complexities involved in protecting APIs linked to IMEI and MSISDN validation, billing systems, and customer data, and we apply our expertise to defend against even the most sophisticated BOLA attacks.

While our recent successes in protecting some of the world’s largest telecommunications companies showcase our deep domain expertise, the Cequence solution is industry agnostic. We bring the same level of precision and effectiveness to application and API security across various sectors, including retail, financial institutions, travel and hospitality, government organizations, and more. Our comprehensive approach ensures that your APIs are safeguarded from advanced threats, no matter your industry.

To see how Cequence can fortify your API landscape, sign up for a free, no-commitment API security assessment.

Gift cards and loyalty programs are used by retailers to increase customer traffic, build brand awareness, and gain new customers. However, they also attract the attention of fraudsters who exploit these systems, causing substantial financial losses and undermining customer trust. This blog explores the nature of gift card and loyalty program abuse and how proper cybersecurity measures – specifically API security and bot management – can mitigate these risks.

What is Gift Card and Loyalty Program Abuse and Fraud?

Gift card and loyalty program (or reward program) abuse and fraud typically involves unauthorized access to card numbers, account takeover, and/or balance theft. Attackers employ various attack techniques on relevant applications and their APIs (login, card processing, balance check, etc.) to perform carding attacks (testing stolen card details), account takeover, and balance theft. Attackers employ business logic abuse to try and get applications and APIs to do things they weren’t designed for, or simply brute force attacks that flood web applications and APIs with traffic. These attacks are often multi-faceted, involving several tactics and techniques, which makes identifying and preventing them difficult.

Impacts of Gift Card and Loyalty Program Abuse and Fraud

Gift card and loyalty program abuse and fraud are high priorities because they can directly cost businesses money while at the same time eroding customer confidence. If a customer attempts to make a purchase with a gift card only to find that their gift card, perhaps received as a gift for their birthday or other holiday, is empty, they would be understandably frustrated. The impact of these kinds of fraud can include:

• Loss of customer confidence due to stolen gift card funds or loyalty points
• Loss of revenue from goods obtained through fraudulent gift cards or loyalty points
• Increased infrastructure costs sustained from bot attack traffic volume
• Increased customer service costs related to fielding customer requests related to the fraud
• Increased cybersecurity personnel costs to track, mitigate, and monitor the attacks
• Potential fines for non-compliance with PCI DSS or other relevant regulations

Preventing Gift Card and Loyalty Program Abuse and Fraud Attacks

As with most types of cyberattacks and online fraud, a muti-faceted strategy is best employed to protect the business and its customers. Using Cequence’s Discover, Comply, and Protect framework provides a holistic protection plan:

Discover

In order to protect your applications and their APIs, you need to uncover what APIs exist, and where they are located. Utilizing both an outside-in and inside-out approach, Cequence discovers internal, external, and third-party APIs ensuring organizations know where all of their APIs are and that they’re alerted when new APIs are deployed. Cequence provides a free assessment to show the attacker’s view of your network, and you can try it here.

Comply

Once you have a proper catalog of your APIs, you want to ensure that they are documented, tested, and assessed for risk. Cequence inventories all APIs, highlighting those without documentation. Cequence also provides API security testing to identify and remediate vulnerabilities either in the CI/CD pipeline or at runtime.

Protect

There are two critical parts to protecting against these kinds of attacks – detection and prevention. Identifying and monitoring the attacks is difficult due to the highly varied and frequent evolution of the attacker’s tactics. Cequence’s behavioral fingerprinting goes far beyond simple IP addresses as an identifier and includes the tools, infrastructure, and credentials used by the attacker to identify them and monitor them even as they change tactics to avoid detection.

Once the attacks are identified, you need some way to stop them and prevent them in the future. Most solutions require some sort of CAPTCHA or other method to “prove you’re human,” but that method requires changes to application code, doesn’t support APIs which can be attacked directly, and perhaps most importantly, causes customer friction. Cequence takes a network-based approach that provides native mitigation without any application changes, and offers mitigation options including logging, rate limiting, deception, and blocking.

Case Study: Large Fashion Retailer Stops Gift Card Fraud

A U.S.-based fashion retailer came to Cequence with a significant bot and gift card fraud problem. Their existing Web Application Firewall (WAF) was not scaling to meet the attack volume. Attackers were using the retailer’s systems to validate stolen credit cards, purchase gift cards, and then purchasing products with the fraudulent gift cards, directly costing the company money. They deployed Cequence, which accurately identified malicious traffic, ensured legitimate customer traffic would not be affected by any mitigation efforts, and blocked the fraudulent attacks – all without requiring application modification. Estimated cost savings were upward of $100 per customer account.

For additional perspective, read the “Testing Your Loyalty” article by Cequence’s Andy Mills in Retail Technology Magazine.

Cequence can help your business combat gift card and loyalty program abuse and fraud. Contact us to discuss your situation and how Cequence can help.

API Security: A 2024 Initiative for All Organizations

In the rapidly evolving digital landscape, API security has emerged as a top priority for organizations of all sizes. Protecting your APIs is not just about defense; it’s about staying ahead of potential threats and ensuring the seamless operation of your applications. That’s why we’re excited to announce the kickoff of our new series of API Bites Bootcamps.

Join Us for an Educational API Security Bootcamp

We’re thrilled to host an exclusive bootcamp led by our API Security experts. This session is designed to equip you with the knowledge and tools to defend your APIs from attackers while uncovering and addressing unknown API threats. You will learn how to identify APIs in your environment, test them for OWASP API Security Top 10 risks, and generate AI-driven scripts to test vulnerabilities and abuse business logic. Additionally, you’ll gain skills to identify attacks through behavior analysis and create effective mitigations to filter out malicious traffic.

Coming to a City Near You

Our API Bites Security Bootcamps will be held in various cities, making it convenient for you to join us wherever you are.

Secure Your Spot Now

Don’t miss out on this invaluable opportunity to enhance your API security skills. Join us for this bootcamp and gain the expertise needed to stay ahead of potential threats. Secure your spot now and take a proactive step towards safeguarding your digital assets.

Stay ahead, stay secure, and join the API Bites Bootcamp today!

Most organizations do not have an accurate estimate of their API footprints – and why would they? With the rate at which APIs are getting churned out or updated, it’s a significant challenge for an InfoSec organization or a SOC team to be aware of, let alone up to date on, all the APIs that they are responsible to protect.

While every organization would love a process-driven approach to API lifecycle management where each API is meticulously tested in dev, testing, and staging environments before being deployed to production, the reality is far different. Not only are new APIs being squirted into externally accessible locations without the expected/requisite amount of due diligence, but older APIs that *should* be deprecated are active far longer than they need to be.

While building a comprehensive runtime inventory of your APIs is not as hard as it used to be, it does require a systematic approach to discovering your APIs, cataloging them, and then delving into the specifics of what’s authorized vs. a rogue or shadow API.

The Cost and Complexity of Deploying API Observability

Independent of how APIs are discovered – agent-based, third-party integrations, eBPF – there is cost and complexity associated with deploying API observability. Network and application teams are loath to deploying “yet another tool” – there are legitimate concerns about applications needing to be instrumented (most vendors require this before they can start to discover APIs), deployments being spun up and perceived risk around latency, uptime, etc. Just as importantly, some organizations believe they are taking adequate measures to safeguard their APIs with their existing toolsets – why fix something that isn’t broken? (till such time that they start to see attacks on their APIs, the most popular attack vector today)

Zero-Knowledge API Discovery as a First Step

It is in this context that zero-knowledge API discovery becomes an important first step in the API Protection lifecycle. Without having to install or configure anything on-premises, security teams are afforded visibility into their publicly-accessible attack surface. And while this might be the tip of the iceberg as compared to the organization’s total attack surface, it reveals enough data to build the case for a more comprehensive API security program. After all, if an attacker can discover (and potentially exploit) APIs without any specific knowledge of your environment, maybe the business-as-usual approach isn’t good enough. At Cequence, we see this all the time with new prospects – after all, if you are seeing API attacks despite fronting them with Edge infrastructure like CDNs, WAFs, or API Gateways, clearly attackers have figured out a way past your initial line of defense.

So why doesn’t every organization sign up for API attack surface discovery? After all, attack surface discovery is a well-understood and commonly deployed construct. It’s because API discovery, much like testing, requires context – What IS an API? What constitutes an API issue? Which findings are truly relevant? The answer to each of these questions is not as simple or as straightforward as it might seem. Nor does it stay consistent from one organization to another. There is no common deployment pattern within an organization; let alone one that is shared across multiple organizations. How APIs are designed and deployed is inherently dependent on the development teams that build and deploy them.

The False Positive Challenge in Zero-Knowledge Discovery

As such zero-knowledge API discovery is inherently at risk of triggering false positives – how can you discover my APIs if you don’t know what design principles I used to develop and deploy them? And InfoSec or AppDev teams that are already overburdened with other responsibilities are weary of adding to their own workloads, especially if they must weed out reams of incorrect information before they find something of value.

Cequence’s Configurable Approach to High-Efficacy Discovery

It is against this backdrop that we are now offering Cequence customers the ability to both create and customize the multitude of currently available discovery and qualification algorithms. Whether it’s API hosts, endpoints, findings, or associated network components, Cequence now allows users to configure the algorithms that determine these detection/classification criteria such that they trigger with the maximum efficacy and help provide the most accurate picture of their APIs, and where/how they are deployed. Armed with this information, security teams can not only make the case for a more holistic security posture, but also make it easier to build and catalog their run-time inventory. Whether it’s load balancers, hosting providers, or edge deployments, Cequence will help you identify your API hotspots. And with the plethora of integrations available for these network components, it will make it easier for you to go from wondering what public attack surface you must complete to building comprehensive visibility as quickly as possible.

That’s a wrap for Black Hat 2024! We had a great show and met many of you at the booth or on the show floor. I hope you were able to come by, watched a session by Jason Kent, Hacker in Residence at Cequence, or Parth Shukla, Security Engineer at Cequence, and maybe even entered to win the PlayStation 5 and Meta Quest VR headset we were giving away!

At the show, Cequence announced API security testing for Large Language Model (LLM) applications against the OWASP LLM Top 10, among other things, which was covered by CSO Online, HelpNetSecurity, MSSP Alert, and more.

Cequence-Vercara LinkedIn Live Session

We had a dynamic LinkedIn Live session with Varun Kohli, Cequence CMO, and Randy D’Souza from Vercara. They discussed our new partnership and the latest trends in API security, focusing on how organizations can tackle evolving threats, especially with Generative AI and LLMs. If you missed it live, you can check out the recording (14 mins).

Cequence Announcements

As always, we had some big announcements for the show. These additions to our Unified API Protection (UAP) platform demonstrate our industry-leading innovation in API security and bot management.

• First API Security Testing Suite for Generative AI: A suite to test LLM applications against OWASP LLM Top 10 threats.
• Enhanced AI Bot Detection: Automatic detection and blocking of AI bot activity.
• Cequence Flow Graph: A new feature to visualize and manage API traffic in real time.
• Expanded API Discovery: New integrations for better visibility of third-party APIs.
• Edge-Based Traffic Processing: Improved efficiency and privacy with edge processing.

For more details, please see our press release, or contact our sales team.

Let’s Keep it Going!

It’s always a good time at Black Hat in the balmy (108º both days!) desert heat of Las Vegas. Big thanks to all the attendees and Cequence staff for making it another successful event, and we hope to see you all at next year’s Black Hat or another event between now and then. Or, if you’re ready to talk sooner, reach out! Book a call with our sales team – we’d love to talk to you about your particular needs and how Cequence can help.

Cequence is excited to announce the latest release of our Unified API Protection (UAP) platform, version 7.3. This release has big new features and updates to existing capabilities, so let’s take a tour. The major feature categories include:

• New Summary Dashboard
• New API Inventory Page
• New Integrations
• New ML-based Threat Classification
• Automated AI Bot Detection and Mitigation
• API Gateway and Infrastructure Attack Surface Discovery
• New Cequence User Community Forum

New Summary Dashboard

Our new summary dashboard provides a comprehensive overview of your API environment. It highlights critical discovery, compliance, and threat metrics including:

• Number of API hosts discovered compared to the total monitored hosts
• Inventory of internal, external, and third-party APIs
• Total API risk issues detected, including run-time risks and build-time compliance test failures
• Statistics on malicious traffic, detailing threat types and sources

This dashboard simplifies monitoring for technical personnel and decision-makers, ensuring key insights are easily accessible.

New API Inventory Page

The new API Inventory page offers improved usability for security teams and their common workflows. Key features include:

• A simple, tabular view of the entire API inventory, with filtering options by API type and attributes
• Customizable views of APIs categorized as internal, external, or third-party
• Generation of API specifications for undocumented APIs
• Management of shadow APIs and API compliance drift
• Summary of risk findings, including sensitive data exposure

The new API Endpoint Details page reveals API usage statistics and payload analysis, including parameter discovery, aiding in compliance and security evaluations.

Powerful New Integrations

Cequence integrates with your existing security and networking infrastructure to support API discovery and added convenience. New integrations include:

• Outbound Network Technologies: Cequence is the first API security vendor to introduce integrations with outbound network technologies, enabling the discovery of API callouts from customer-owned applications, surfacing third-party API suppliers and potential security risks
• F5 High-Speed Logging (HSL): Integration with F5 gateways using HSL to discover and protect APIs without additional TLS terminations
• Citrix ADC Content Inspection: Leverages Citrix mirroring technology to integrate with Citrix ADC gateways using Citrix content inspection capabilities
• WSO2 API Gateway: Inline and passive integrations for API discovery and protection
• Serverless Application Integrations: Native support for AWS App Runner, Azure Container Apps, and GCP Cloud Run, enhancing discovery and protection of APIs within containerized applications

Advanced ML-Based Threat Classification

Another feature unique to Cequence, our ML-based threat classification automatically categorizes mitigated API threats based on endpoint, source, and behavior patterns. This capability can also profile industry-specific threats such as:

• Telecom: CPNI enumeration, Device port-in fraud
• Retail: Inventory abuse, Shopping cart abuse
• Financial Services: Credit application fraud, Payment fraud

This ML-based classification automatically learns and profiles API attacks including, but not limited to:

• Account takeover
• Fake account creation
• CPNI enumeration
• Account management abuse
• Inventory scalping
• Flash sale abuse
• Loyalty rewards abuse

Automated AI Bot Detection and Mitigation

In response to the surge in AI bot activities, Cequence UAP 7.3 introduces automatic identification of AI bot activity. Security teams can now easily detect and mitigate unwanted AI bot interactions with configurable policies. Our continuously updated list of global AI bots ensures your defenses remain current without manual updates.

Expanded Attack Surface Detection

API Spyder now includes automatic discovery of API gateways and infrastructure components, identifying potential shadow API deployments. This feature discovers and identifies gateways from providers including MuleSoft, Apigee, and Envoy, including those deployed on cloud providers such as AWS and Azure. The detection algorithms can be customized or built from scratch by the customer to ensure the highest accuracy. Cequence is the only API security vendor that provides this level of functionality without requiring any network or software changes.

Additional Platform Enhancements

• Global Domain Crawling: Expanded to include EMEA/UAE regions, with proxy support for comprehensive global coverage
• OWASP API Security Top 10 2023: Default rules updated to the latest standards, with customizable configurations
• Data Extraction Search: Enables searching directly from the UAP Data Extraction page

New Cequence User Community Forum & Helpdesk

Last but not least, we’re excited to unveil our new user community forum at Cequence Helpdesk Portal. This platform offers:

• Modern design and streamlined navigation
• Enhanced documentation access
• Improved user experience
• Community engagement for sharing best practices and insights
• Cequence Certified Administrator training courses

Stay tuned for more updates! If you’re an existing customer, contact your Customer Success manager for more details. If you’re not yet a customer, we’d love to chat! Book a personalized demo here.

Digital Transformation and Expanded AI Attack Surfaces

A key trend that we continue to see amongst our customers is digital transformation – transforming legacy and monolithic applications into decentralized, predominantly API-first applications that are distributed across multiple data centers, potentially across multiple cloud providers. That’s why organizations have a much bigger API attack surface today than they ever had with monolithic applications. Further, with the surging popularity of Artificial Intelligence (AI), organizations are modifying and creating applications that make direct use of AI, and they consistently do so through the use of APIs.

What you might not know is that Cequence also has a powerful Artificial Intelligence (AI) story of our own to share, and today’s announcement builds on that further.

So, what’s the AI angle here? Unveiling an Organization’s AI Risk Landscape in Modern Applications

Many of these digitally transformed applications are now taking advantage of AI, using either native AI technologies or relying on external AI technologies from vendors like OpenAI and Anthropic.

Today, Cequence helps organizations discover how many of their applications are AI-enabled in this manner, using external AI frameworks. Armed with this knowledge, organizations can now be armed with an idea of what their supplier risk is like. They learn which third-party AI suppliers they are dependent on, as well as get an idea of the compliance posture related to these AI workloads.

Managing Risks Across External AI Frameworks

Much of the AI communications from these applications to those external AI vendors happens over APIs, with data being exchanged between the two parties. Organizations want to know where their data is going, and to the extent it’s running off into the arms of an AI provider, that it’s an approved provider. Increasingly, we’ll see AI usage being allowed, but only through approved AI interactions or AI engines. Much like consolidating your approved/authorized hosting providers.

Further, organizations want to ensure that no sensitive data flows from these applications to an external organization, approved provider or not. And if it does, they want to be able to ensure that it is residing in a secure location with that third party.

Cequence enables organizations to discover all their applications that are using AI, especially from external sources. By integrating with existing network infrastructure, we can easily discover all the APIs and workloads within the organization that are interacting with external AI frameworks.

Identifying AI Attack Surface and Defending Against AI Data Leakage

Further, we are unique in that we have an external API attack surface discovery product that allows organizations to discover applications and API hosts in their environment that seem to be hosted on AI frameworks. For example, if they have an application that is hosted on Hugging Face, a popular machine learning (ML) and data science platform and community, we can automatically detect that and reveal the related API hosts that comprise their AI exposure surface.

Cequence is unique in being able to articulate this outside-in perspective. Our software tells an organization what their AI exposure to external AI frameworks like OpenAI and Claude is, as well as the AI attack surface stemming from the AI apps they’ve built themselves in service of various business use cases.

Second, once these AI workloads are discovered, we examine the communication that happens between the application workloads and the third parties, like the third-party AI frameworks. We analyze the content that is being exchanged, and we can detect sensitive data such as PII or payment information like that specified in the Payment Card Industry Data Security Standard (PCI DSS).

Compliance and Governance in AI Integration

In fact, PCI DSS v4.0 requirement 6.3.2 requires organizations to be able to audit and list all their third-party dependencies. Cequence helps organizations achieve compliance with PCI DSS v4.0 by automatically discovering all the third-party frameworks and the communication that is happening between them.

Cequence also leverages AI for defense. We are a Machine Learning (ML) AI vendor ourselves, using ML technologies to counter attackers by detecting the sophisticated ML-based attacks being staged against our customers’ applications. Cequence utilizes AI technologies that detects these sophisticated attacks, fingerprints the attacker’s behavior and tracks them even as they evolve their attack, and stops attacks in real time.

Go Forward Armed with Knowledge

We applaud forward-thinking organizations leveraging new tools like AI. However, it’s equally important to make sure that its utilization is understood, purposeful, and doesn’t run afoul of any relevant Governance, Risk, and Compliance (GRC) requirements. By employing API discovery of AI applications and APIs, ensuring their compliance with internal governance and external regulations, and making sure that attacks are swiftly detected and mitigated, AI can be a powerful technology to propel organizations forward.

As a leading API security vendor, Cequence helps organizations discover the internal, external, and third-party APIs in use amongst their applications, helping bring APIs into compliance with security best practices as well as protect them from malicious actors who may be targeting these APIs for data exfiltration, fraud, or other malicious purposes.

Want to learn more? Get started with a free, no-obligation API security assessment that provides an attacker’s view into your organization’s APIs. Or better still, book a personalized demo.

This article is the fifth in a series of five covering key API security topics and provides some answers to common questions we often get when talking to potential customers. The series will cover the following topics:

• API Discovery
• API Posture Management
• Attack Protection
• API Security Testing
• Attack Detection and Threat Hunting

API security needs are specific to individual organizations and their particular market or industry, and the Cequence Unified API Protection platform was developed with that in mind – it’s highly flexible, customizable, and built to grow with your business.

This article focuses on attack detection and threat hunting, which is a foundational component of the Cequence Unified API Protection platform. Attack detection and threat hunting is greatly simplified with Cequence compared to competitors that rely on data lakes to perform offline, delayed threat hunting. Cequence’s inline or passive deployment options not only enable the platform to identify and mitigate threats in real time but also offer opportunities for near real-time threat hunting for truly novel attacks. Cequence is able to either mitigate natively (in the case of inline deployment) or pass the attacker identifiers off to a third party, such as a WAF, for mitigation (in the case of passive deployment). Mitigation options include logging, rate limiting, deception, and blocking.

The following are some common requirements that we’ve heard voiced by potential customers:

Explorable Transaction Data Lake

Cequence stores anonymized customer data for short-term for real-time analysis, and supports long-term data retention (e.g., data lake) as an add-on SKU. Cequence’s ability to detect and mitigate threats in real time obviates most of the need for a data lake. Other vendors require a data lake to do their analysis and detection, delayed though it may be. Once threats are detected in the vendor’s data lake, they must then rely on a third party (such as a WAF) for mitigation or blocking. Cequence’s real time capabilities are much more efficient, so long term data storage is rarely needed for threat hunting and analysis.

Correlate and End-To-End Connect All Application API Transactions

Cequence includes a graphic capability that graphically visualizes end-to-end API flows with an attractive, easy-to-understand interface. This capability enhances security team visibility by distinguishing between normal and malicious traffic, enabling personnel to quickly identify and take immediate action on any malicious activity with a single-click in a fully integrated way without relying on third party products such as a WAF.

Deep API Transaction Context for API Incident Response and Threat Hunting

Cequence offers native real-time threat detection and protection without relying on a third-party tool such as a WAF. Cequence has taken a very different approach to API attack mitigation using multi-dimensional machine learning (ML) techniques to analyze user behavior without requiring any client-side or application integration or instrumentation. Cequence analyzes behavioral intent across web, mobile, and API traffic, detecting legitimate behavior without relying solely on IP addresses, which can change or be spoofed. Conversely, attack traffic is identified by its behavior as well, which is continuously determined and learned by the ML models. This approach actively “fingerprints” incoming requests based on the similarity of their behavioral traits, as analyzed by the ML models. Additionally, the open platform allows customers to import security intelligence and export it into third-party systems like SIEMs, anti-fraud tools, firewalls, and IDS/IPS systems.

Capture And Store Good, Suspicious, And Bad API Traffic for Analysis

Cequence not only captures and stores good, bad, and suspicious API traffic, but also fingerprints it using behavioral fingerprinting, providing the ability to track attacks as attackers retool. Traffic is stored by default for a short term, and optionally indefinitely in a data lake.

Some of the other areas of attack detection and threat hunting where Cequence excels:

There are certainly other facets of attack detection and threat hunting, but these are some of the topics we hear about most frequently, check out the other articles in this series.

This article is the fourth in a series of five covering key API security topics and provides some answers to common questions we often get when talking to potential customers. The series will cover the following topics:

• API Discovery
• API Posture Management
• Attack Protection
• API Security Testing
• Attack Detection and Threat Hunting

API security needs are specific to individual organizations and their particular market or industry, and the Cequence Unified API Protection platform was developed with that in mind – it’s highly flexible, customizable, and built to grow with your business.

This article focuses on API security testing performed in development, in production, or standalone, identifying vulnerabilities, coding errors, and other issues that could be exploited. API security testing is part of API Sentinel, a core product in the Cequence Unified API Protection platform.

The following are some common requirements that we’ve heard voiced by potential customers:

Flag API Endpoint Configurations Not Matching Industry Best Practices

Cequence identifies API endpoint configurations that deviate from industry best practices both while APIs are in development and once in production. Cequence can automatically generate API specs specific to the organization and assesses compliance with common industry frameworks such as OWASP API Security Top 10, the OWASP Automated Top 10, PCI DSS 4.0, etc.

Flag API Endpoint Configurations Not Matching Company Policies

Cequence identifies API endpoint configurations that deviate from an organization’s internal governance and best practices both while APIs are in development and in production. Cequence can automatically generate API specs specific to the organization in the event specifications don’t exist.

Zero-Config API Test Configuration

Cequence “Intelligent Mode” automates the generation of API security test plans using OpenAPI specs or Postman collections, which are then exportable and suitable for integration into the CI/CD pipeline, or for Cequence to test the API directly. For APIs that do not have any existing specifications, Cequence can dynamically generate specifications based on the runtime traffic observed for the production API. This is vastly superior to manual approaches to generate test plans, which are error-prone and require developers to be security-savvy about security test cases that they need to associate with their APIs.

API Input Testing by Generating Inputs from Known Bad Payloads

Cequence supports both OpenAPI specifications and Postman collections as sources of API collections. While the OpenAPI Specification usually does not contain bad payloads, Postman is used frequently by development and QA teams to test for functionality, regression, and exception handling. As such, Cequence does offer the ability to auto-create and configure test plans from known bad payloads. This comes in handy when testing for OWASP Top 10 risks like BOLA, BOPLA, BFLA, etc. where not only can Cequence create the test plan, but automatically create the appropriate authentication profiles (both good and bad) to ensure adequate coverage and effectiveness while simplifying the usability around API security testing.

White Box Security Testing

Cequence prides itself on not being a “black box” and providing the most open and transparent solution on the market. Cequence’s security testing capability can be utilized either in the CI/CD pipeline or in deployment.

Autonomous Test Creation

Cequence offers autonomous test creation, which generates API specs without human involvement. Users answer a series of interactive questions, and the Cequence product determines the right set of security requirements and develops tailor-made test plans specific to each API application. This approach avoids manual, error-prone processes to develop a proper security test plan that often would take weeks or more to complete.

Some of the other areas of API security testing where Cequence excels:

There are certainly other facets of API security testing, but these are some of the topics we hear about most frequently, check out the other articles in this series.

This article is the third in a series of five covering key API security topics and provides some answers to common questions we often get when talking to potential customers. The series will cover the following topics:

• API Discovery
• API Posture Management
• Attack Protection
• API Security Testing
• Attack Detection and Threat Hunting

API security needs are specific to individual organizations and their particular market or industry, and the Cequence Unified API Protection platform was developed with that in mind – it’s highly flexible, customizable, and built to grow with your business.

This article focuses on application and API attack protection, which is a foundational component of the Cequence Unified API Protection platform. Cequence’s inline or passive deployment options offer the ability to detect attacks and either mitigate natively (in the case of inline deployment) or pass the attacker identifiers off to a third party, such as a WAF, for mitigation (in the case of passive deployment). Mitigation options include blocking, rate limiting, header injection, and deceptive responses. The following are some common requirements that we’ve heard voiced by potential customers:

Detect And Block Newly-Identified CVEs

Cequence can detect and mitigate newly-identified CVEs, natively, and in real time. Other vendors that rely on a data lake for attack identification and analysis are necessarily delayed in these objectives. Once their out-of-band analysis is complete, they require a third-party solution (such as a WAF) to perform the blocking. Inherent WAF limitations such as their inability to block high-volume attacks and their dependence on easily-changed and easily-spoofed IP addresses make them a suboptimal choice for API security.

Detection Of Low & Slow (Long-Lived, Hidden) Attacks

Cequence was designed from inception to identify and block “low and slow” attacks in real time, which are low volume attacks carried out over a longer period of time and at lower volume than standard attacks in hopes of avoiding detection. Cequence’s behavioral fingerprinting analyzes unique combinations of characteristics such as tools, infrastructure, and credentials to identify and track attacks, no matter their speed. Cequence’s inline detection and native blocking capabilities enable instant, real-time response, unlike vendors that rely on a data lake and delayed analysis.

Automatically Track the Threat Level Of Each User

Cequence can automatically identify threat actors by various attributes – usernames, sessions, fingerprints, IP addresses, and customer fields​. These fields can be keyed on and pivoted as needed to track and report on threat actors and determine the threat or risk level. Cequence also has a capability called Attack Feature Detection (AFD) that automatically, in real time, identifies attacks and develops a mitigation policy with no human intervention. All that’s left is for the Cequence customer to review the policy and enact it in order to block the attacks immediately. Other vendors typically track a single attribute such as username or IP address, lacking the ability to identify attacks in real time (due to reliance on data lakes) or automatically craft mitigation policies.

Pre-Attack Threat Actor Identification

Cequence can identify threat actors before an attack occurs through various attributes – usernames, sessions, fingerprints, IP addresses, and customer fields​. Known attackers will be identified and tracked, and any attempted attacks will be prevented. Additionally, Cequence can determine that a session originated from a malicious IP. Other vendors can only identify based on a single criterion such as username, severely limiting the attackers that can be identified either prior to, during, or after an attack. Some vendors are unable to determine that attacks originate from malicious IPs.

Identify Active Data Exfiltration Per API, Services, Users

Cequence can identify active data exfiltration per API, per service, and per user by keying on various attributes such as usernames, sessions, fingerprints, IP addresses, and even custom fields. Custom fields designated by the customer such as credit cards numbers, IMEI, or SSN can be used to identify sensitive data transacted by APIs. Other vendors that rely on a data lake for attack identification and analysis are necessarily delayed in these objectives. Once their out-of-band analysis is complete, they require a third-party solution (such as a WAF) to perform the blocking. WAFs inherent limitations such as their inability to block high-volume attacks and being dependent on easily-changed and easily-spoofed IP addresses make them a suboptimal choice for API security.

Enforce Blocking By Direct Call To 3rd-Party Control Points

Cequence is the only API security vendor with native blocking capabilities that does not require a third-party product, such as a WAF, to enact blocking. Cequence also can take advantage of existing third-party products, such as WAFs or API gateways, for additional mitigation options if desired. Other vendors that do not perform native mitigation and blocking and instead rely on third-party products face inherent limitations such as the inability to block high-volume attacks and dependence on easily-changed and easily-spoofed IP addresses, making them a suboptimal choice for API security.

Session Integrity Validation

Cequence includes Session Stitching, which tracks a user’s session throughout their journey within the customer’s API and application infrastructure. Example sessions include a user interacting with their bank account or a user in a purchase sequence. Other vendors require each application to be instrumented in order to track user journeys. Since all applications cannot be instrumented, such as those that do not support JavaScript or mobile SDKs, user journey tracking from these vendors will be incomplete.

ML-Based Multi-Dimensional and Temporal Fraud Detection

Cequence uses machine learning algorithms to identify, correlate, and track threat actors and their activity despite their use of evasive tactics and retooling. Hundreds of out of the box rules and ML models, additional customer-specific rules, and the ability to incorporate customer models through its open system ensure comprehensive detection. Cequence’s network-based deployment enables it to see all API traffic, and its behavioral fingerprinting capability enables it to detect malicious behavior – even if it appears legitimate – by analyzing multiple criteria. Other vendors that only use a data lake for attack identification and analysis are necessarily delayed in these objectives.

Agent-Based (Language-Specific, In-Line)

It is a well-known fact, that security teams and developers alike, hate agents on their pristine revenue-generating applications. Cequence has no need to deploy or integrate agents. Cequence deploys at the network level, ensuring the greatest possible coverage of API and application traffic, unlike other solutions which require each application to be instrumented. Instrumenting each application is a significant hurdle – not only from the initial integration effort, but also from an ongoing maintenance standpoint. Every time the agent or the application is updated there’s more potential for conflict, so additional testing/QA must be done. Additionally, many applications cannot be instrumented due to language or proxy dependencies. Cequence can be deployed inline or passively, making it easy to get started and prove its effectiveness, and is language and proxy independent.

Some of the other areas of attack protection where Cequence excels:

There are certainly other facets of application and API attack protection, but these are some of the topics we hear about most frequently, check out the other articles in this series.

This article is the second in a series of five covering key API security topics and provides some answers to common questions we often get when talking to potential customers. The series will cover the following topics:

• API Discovery
• API Posture Management
• Attack Protection
• API Security Testing
• Attack Detection and Threat Hunting

API security needs are specific to individual organizations and their particular market or industry, and the Cequence Unified API Protection platform was developed with that in mind – it’s highly flexible, customizable, and built to grow with your business.

This article focuses on API posture management, which encompasses API discovery, monitoring, testing, and compliance. Proper API posture management includes assessing the organization’s APIs for a broad range of risks that can lead to compliance or governance issues, data loss, and business disruption. API posture management is the primary purpose of API Sentinel, a foundational component of the Cequence Unified API Protection platform. API Sentinel performs many key API posture management functions, including:

• API discovery & inventory
• Generation of API definitions/specs
• API risk identification & classification
• Sensitive data exposure detection and prevention
• Support for common risk frameworks such as OWASP
• API security testing

The following are some common requirements that we’ve heard voiced by potential customers:

Discover And Visualize API Dependencies

Cequence includes a graphical tool that provides actionable visualization of end-to-end API flows with an attractive, easy-to-understand interface. This capability enhances security team visibility by identifying good and bad flows and their associated volumes, , enabling personnel to quickly understand and take immediate action on any malicious activity. Unlike competitive solutions, Cequence offers single click, native mitigation for malicious traffic including blocking, rate limiting, header injection, and deceptive responses.

Sensitive Data Classification into Sets (Including Customized)

Cequence protects Fortune and Global 500 organizations across multiple industries including retail, telecommunications, and financial services, and customers including 2 of the top 3 telecoms, the largest credit card and mutual fund companies, some of the largest fashion and beauty retailers, one of the world’s largest mining companies. Cequence classifies sensitive data as needed and can be customized to meet the needs of the organization beyond standard data such as U.S. Social Security Numbers (SSN) but also vertical-specific sensitive information, e.g., credit cards numbers, IMEI, and CPNI.

Discovery Of Sensitive Data Flows

Cequence offers a Sensitive Data Exposure dashboard to quickly identify and remediate APIs and endpoints using sensitive data based on predefined (e.g., credit card numbers, social security numbers, Stacktrace codes, etc.) and customizable data patterns. Context-aware sensitive data detection using a Natural Language Processing (NLP) machine learning technique complements predefined patterns and reduces false positives by identifying sensitive data exposure using contextual clues, e.g., presence of keywords close to the actual detected value.

The results are graphically displayed in the dashboard with details such as the API source or response codes leaking the data, the pattern found, and the underlying IP address details. Notifications can be sent to development teams for rapid remediation using predefined alerts for tools such as Slack, PagerDuty, or email. Read more about Sensitive Data Exposure.

Flag Shadow, Zombie, And Orphaned Endpoints

Cequence automatically discovers and identifies shadow, zombie, and orphaned endpoints. These can include unused or dormant APIs that aren’t transacting data as well as active APIs that don’t have associated specifications. Read more about our API Discovery and Risk Classification.

API Posture Change Detection and Alerting

Cequence offers continuous monitoring of the organization’s API security posture, assessing a broad range of risks that can lead to compliance or governance issues, data loss, and business disruption. As API risk posture changes, these risk events are highlighted in the UI and exportable for additional actions.

Some of the other areas of API posture management where Cequence excels:

There are certainly other facets of API posture management, but these are some of the topics we hear about most frequently, check out the other articles in this series.

This article is the first in a series of five covering key API security topics and provides some answers to common questions we often get when talking to potential customers. This series will cover the following topics:

• API Discovery
• API Posture Management
• Attack Protection
• API Security Testing
• Attack Detection and Threat Hunting

API security needs are specific to individual customers and their particular market or industry, and Cequence has built a solution with that in mind – it’s highly flexible, customizable, and built to grow with your business.

This article focuses on API discovery, which is usually the first step in the API security process. Understanding what APIs are deployed, which ones are in use, where they are, and what information they’re transacting is key to ensuring their security. API discovery is a core competency of the Cequence Unified API Protection platform; it discovers internal, external, third-party, managed, unmanaged, zombie, and shadow APIs and maintains a continuously updated inventory.

The following are some common requirements that we’ve heard voiced by potential customers:

Discover & Monitor Internal API Endpoints (East-West APIs)

Cequence’s network-based discovery capability identifies internal API endpoints – North-South (connecting to external systems and third parties) and East-West (connecting internal traffic and processes), creating an API inventory that is continuously updated. In fact, Cequence discovers internal, external, and third-party APIs. For more information about Cequence’s discovery capability, please see Cequence’s API Discovery and Risk Classification.

See Into mTLS-Encrypted API Traffic without Decrypting

The extended Berkeley Packet Filter (eBPF) is a technology that enables, among other things, high-speed inspection of encrypted traffic without terminating the TLS connection. Cequence’s eBPF implementation allows for the analysis of mTLS-encrypted traffic without needing to perform any additional TLS terminations, enabling quick, low-latency, and secure integrations.

Support for SOAP APIs

Cequence supports a number of different API formats including REST, GraphQL, and SOAP. Cequence discovers Simple Object Access Protocol (SOAP) APIs and examines the XML payload of each SOAP API in the standardized SOAP format. Cequence also includes threat rules and policies for SOAP API calls. Cequence currently supports SOAP v1.1 and v1.2.

Discovery and Tracking of Third-Party APIs and Sensitive Data Use

Third-party APIs are increasingly prevalent in modern applications, and it’s important to be able to discover, inventory, and track each one. By integrating with existing infrastructure such as firewalls and gateways, or through the use of eBPF, Cequence is able to identify third-party APIs at these common egress points.

Some of the other areas of API discovery where Cequence excels:

There are certainly other facets of API discovery, but these are some of the common topics, check out the other articles in this series.

Application Programming Interfaces (APIs) facilitate seamless communication and data exchange between various software components, forming the connective tissue between modern enterprise applications. With the increasing dependence on applications and APIs, robust security measures are essential. The extended Berkeley Packet Filter (eBPF) is a promising technology for API security and traffic inspection. This blog explores how eBPF enhances API security, its limitations, and how to achieve comprehensive API protection.

The Current Application and API Landscape

Recent studies indicate that Node.js is the most popular language for containerized environments, while Java continues to dominate non-containerized settings. Of course, Python, Go, Ruby, C++, and .NET are still in common use. An API security solution suitable for the current diversity in programming languages and deployment environments necessarily must be adaptable to the heterogeneous technology stacks in use in enterprise environments.

API Discovery and Traffic Analysis in API Security

A successful API security program relies on a solution with the ability to discover and inspect API traffic. API discovery involves identifying, understanding, and building a continuous inventory of all APIs – internal, external, and third-party – within an organization, including details such as endpoints, supported methods, parameters, and authentication mechanisms. Capturing HTTP traffic is straightforward, but decrypting HTTPS traffic presents additional challenges in order to maintain security and low latency. Decrypting HTTPS traffic often requires interception at the proxy/load balancer level or within the application itself.

Introducing eBPF for API Security

eBPF, or extended Berkeley Packet Filter, is a powerful technology integrated into the Linux kernel that allows programs to execute safely within kernel space without modifying the kernel source code or loading kernel modules. This makes it a highly attractive option for efficient monitoring, networking, and security in Linux systems. One significant advantage of eBPF with regard to API security is its ability to inspect TLS/HTTPS traffic without terminating the TLS connection.

Challenges and Potential Problems with eBPF in API Security

Despite its potential, eBPF is severely limited in the environments in which it can operate and what applications it can protect. As with many things, the devil’s in the details:

1. Implementation Restrictions

• Node.js Applications: eBPF is incompatible with Node.js due to the removal of USDT (User Statically Defined Tracing) probes, challenges posed by JIT compilation, and a lack of active maintainers for eBPF support.
• Java Applications: eBPF cannot work with the Java Virtual Machine (JVM) because it creates an abstraction layer that hinders eBPF’s interaction with the application. Java’s custom TLS implementation and JIT compilation further complicate the situation.
• Statically Linked Libraries: eBPF is ineffective with applications using statically linked SSL libraries, such as Envoy and Istio, due to the absence of dynamic symbols and predefined attachment points.
• Other Language-Specific Challenges: While Python, Go, and Ruby applications generally support eBPF-based TLS capture, C++ and .NET applications offer only partial support depending on their specific SSL library implementation.

2. Operational Limitations

• Use of eBPF for blocking API attacks poses risks of instability, incompatibility, and negative performance.
• The maintenance of hooking techniques requires ongoing updates with new SSL libraries, and monitoring functions can break without notice. This problem increases in scope as the API footprint grows.

Application and Proxy Support for eBPF

Given the limitations outlined above, the following is a support matrix for inspecting TLS traffic with eBPF:

Application Support Matrix

Proxy Support Matrix

Beyond Edge Cases – More Comprehensive Approaches to API Security

While eBPF is a promising technology, considering the limitations outlined above, organizations should adopt a multidimensional approach to API security:

Agent-based Integration

This method involves instrumenting applications in order to access TLS traffic.

• Pros:
  • Can be integrated into the software development lifecycle (SDLC).
• Cons:
  • Can impact performance as it must be run on the same device as the application.
  • Only protects individually-instrumented applications; broad coverage requires significant development effort.
  • Application functionality can be impacted, even in monitoring mode.

Network-based Agentless Integration

Similar to a WAF in operation, this method offers the broadest API and application coverage. Integration at the network edge, either as a reverse proxy or integration with the existing API gateway, load balancer, or CDN, enables comprehensive inspection of traffic before it reaches the application.

• Pros:
  • Stops attacks before they reach the application.
  • Broad coverage protects an organization’s entire suite of applications.
  • Easy to deploy and manage centrally.
• Cons:
  • Requires alternate approaches to inspect encrypted traffic.

Use the Right Tool for the Job

eBPF offers promising capabilities for highly-specific API security edge cases, particularly in Linux environments and with certain programming languages. eBPF is clearly not a “hammer” to pound every “nail.” The heterogeneous nature of enterprise application environments demands a multifaceted approach to API security to maximize comprehensive API and application coverage.

Organizations should evaluate their specific technological stack, infrastructure, security requirements, and operational constraints when designing their API security program. A network-based agentless approach provides the broadest coverage and enables organizations to address the vast majority of API security needs. It provides near-complete freedom with regard to operating systems, programming languages, and architectures, enabling organizations to quickly and easily reach their API security goals.

Platforms such as Cequence’s Unified API Protection offer a multi-phased approach to discovery, compliance, governance, and protection, supporting all applications, traffic types (encrypted and unencrypted), operating systems, and environments.

Contact us to discuss your organization’s cybersecurity needs and how Cequence can help.

What Happened?

Today, a significant global IT outage is broadly affecting diverse industries including aviation, banking, medical, technology, retail, and media due to a faulty content update published by security vendor CrowdStrike.

Worldwide, thousands of computers running Microsoft Windows and CrowdStrike’s Falcon security software now show the Blue Screen of Death (BSOD) after receiving an automatic CrowdStrike update. Having reported over 24,000 customers in their last earnings report, it’s certainly possible that there are hundreds of thousands of affected CrowdStrike systems out there. Let’s be clear: CrowdStrike is a highly reputable vendor. If this can happen to them and their customers, it shows how vulnerable our IT environments can be.

Full disclosure – Cequence operations have not been affected in any way and we continue to protect our customer’s applications and APIs without any disruption due to this outage.

What is the Impact?

As of publication, this incident is still ongoing. For example, major airlines are unable to operate because so many of their computers run Windows and CrowdStrike. Many of their key systems now are only capable of showing the BSOD. It bears repeating that this only affects Windows machines running CrowdStrike as the security component.

When a Windows machine experiences the Blue Screen of Death it is just that, the Operating System will not boot up the machine normally, the screen turns blue, and it displays an error message explaining it cannot run. Usually when this happens, an experienced and technical user would boot into “safe mode” and dig up the offending DLL (Dynamic Link Library – it connects files to the things they need to run) and remove or replace it. This means that every affected machine now needs a human to physically stop by and correct things. A BSOD cannot be fixed with a recall update or a roll-forward update. Nothing can be sent to the machine remotely, slowing recovery efforts immensely. Also, many IT teams are now outsourced to virtual centers, and cannot physically get to the computers they are paid to support and fix.

What Can Organizations Learn from It?

If you weren’t impacted by this, what can you take away? Well, I have been focusing on how centralized systems are causing huge problems when they break. Earlier this year, healthcare organizations couldn’t process payments because an API attack took an organization that brokers their transactions offline. Understanding where one’s centralized services might be and knowing what to do if that goes down is important from a business resumption standpoint but also from an understanding of real operational risk.

Additionally, this came because an automatic update was pushed and automatically deployed. Patching is important, very important, and needs to have some care and thought put into it. Early in my career I was called to another office building because someone pushed a patch that broke the login screen for every computer. 24 deskside techs deployed with 3.5” discs in hand had to visit each machine and reboot to a batch file that we could use to update the login screen. The goal of IT is to enable business, sometimes these types of things can really drag it down.

Closing Thoughts

So how do you avoid this happening in your own organization? Here’s some suggestions:

• Start with understanding where your centralized services are and understand where these things are getting their directives. If it is a cloud-based software agent, it could potentially have malware, bugs, or other issues, so auto deploy shouldn’t be the default first step.
• IT teams should validate anything that comes in, making sure it doesn’t break a proprietary or legacy system and then authorize the auto deploy to a sample group of machines. If there are no issues, then everyone gets it. This assumes a small IT team. If you have hundreds of desk-side support personnel, blast away. Most organizations don’t have enough IT “hands on keyboard” type folks to survive a problem like this.
• Adopting emerging technology is fine, as long as the appropriate backup and restoration systems are in place to assure business continuity.

CrowdStrike has a suggested fix, and their CEO reported the problem has been identified. The fix is basically, boot the machine into safe mode, delete a DLL and reboot. Hands on every machine. This is a great example of the kinds of tabletop exercises organizations should be doing. Unfortunately, today’s event isn’t a practice run.

To relate this event to API security and bot management, which is Cequence’s core business, one of our fundamental principles has been to protect as many applications and APIs as possible without requiring significant changes to the customer applications or infrastructure. Software and networks are highly dynamic, so the more effective a solution can be despite those changes, the better. Resilience in the face of unexpected change is a requirement for cybersecurity that won’t result in business continuity failures. We fully support the organizations impacted by this outage, CrowdStrike, the overall cybersecurity community, and are here to help in any way we can.

Update 20 Jul 2024: CrowdStrike – Technical Details: Falcon Content Update for Windows Hosts, Microsoft – Helping our customers through the CrowdStrike outage

Cequence integrates with F5’s High Speed Logging (HSL) solution, providing another zero-latency passive deployment option. This integration enables Cequence to receive and process network traffic directly from the F5 appliance in order to discover and assess APIs and identify attacks.

One of the Cequence Unified API Protection platform’s strengths from a customer perspective is its flexible deployment options. Not only can customers choose from SaaS, on-premises, or hybrid deployments to match their existing architecture, but they can also deploy Cequence inline or passively. Inline deployment provides options for native threat mitigation such as blocking, rate limiting, header injection, and deception, while a passive deployment provides an exceptionally quick way to get up and running and discover all APIs, their associated security risks, and active security threats.

F5 High Speed Logging

The F5 BIG-IP platform typically has visibility into all application traffic, making it an ideal way to securely share traffic with Cequence for analysis. The integration is performed through a Cequence Bridge which connects the F5 deployment to the Cequence Unified API Protection platform. The Cequence Bridge reads the TLS-encrypted F5 HSL traffic and transforms it for use in the Cequence platform, where APIs are discovered and assessed for compliance and sensitive data exposure, and attacks can be identified. Cequence natively integrates with the F5 BIG-IP platform and supports mutual TLS authentication, so no further TLS termination is required.

Benefits of Leveraging This F5 HSL Integration

Benefits of leveraging the F5 HSL integration for a Cequence deployment include:

• Leveraging native F5 HSL avoids any latency or performance implications
• Native integration with F5 BIG-IP platform including support for mutual TLS authentication ensures no additional TLS termination is required
• No adverse impact to end user experience
• Low-friction way for organizations to deploy Cequence in F5 environments

In addition to the High Speed Logging integration, Cequence natively integrates with the F5 BIG-IP platform to route application traffic to a passive or inline Cequence deployment for API discovery and risk analysis. For more information, see the integration guide.

Book a Demo

Want to learn more? Reach out to us for a personalized demo, or get started on your own with a free, no obligation API security assessment that gives you an attacker’s view into your organization’s APIs.

Protect What Connects with Cequence Application and API Security Solutions at Black Hat 2024

We are thrilled to announce that Cequence Security will be returning to Black Hat USA 2024 showcasing the latest in API security and bot management solutions. Held at the Mandalay Convention Center in Las Vegas on August 7-8, Black Hat is one of the premier events for cybersecurity professionals, bringing together security experts, practitioners, developers, and executives from around the world to share the latest advancements and trends in information security.

Cequence Security at Black Hat

At Cequence Security, our mission is to protect what connects you. We are excited to showcase our latest advancements in application and API security at Black Hat 2024. Visit us at Booth 2614 to see live demonstrations and hear from our security experts about the latest API trends and threats, and how that relates to great application protection. Our team will be on hand to provide insights into how Cequence Security helps organizations discover and defend their applications and APIs from known, unknown, and unmitigated risks.

Why Visit Our Booth?

Customers trust Cequence Security to enhance their visibility and protection while reducing costs, minimizing fraud, preventing business abuse, and safeguarding against data losses and non-compliance. By investing in Cequence Security, organizations can significantly improve their security posture.

Exciting Happenings at Booth 2614

• Live Demos: Experience our cutting-edge application and API security solutions firsthand.
• Expert Talks: Gain insights from our security experts on the latest trends, threats, and attacks putting apps and APIs at risk.
• Prizes and Giveaways: Become a fan of Cequence and enter for a chance to win a Sony PlayStation 5. Plus, participate in our scratch-and-win game for a shot at cool prizes.

Join Us at Black Hat 2024

We look forward to meeting you at Black Hat this August! Make sure to stop by Booth 2614 to learn more about how Cequence Security can help protect what connects you and to take advantage of our exciting giveaways. Don’t miss this opportunity to connect with our team, see our solutions in action, and walk away with some great prizes.

See you in Las Vegas!

At Cequence Security, our journey has always been driven by a deep commitment to our team. We believe that a company’s culture isn’t just about words on a website or slogans on a wall—it’s about how our people feel, especially when the weekend draws to a close. It’s about trust, curiosity, drive, humor, and heart. These aren’t just values we speak of; they’re the guiding principles that shape every aspect of our organization.

In being named among Inc.’s Best Workplaces for 2024, Cequence has reaffirmed its commitment to fostering an exceptional workplace culture. From our dedication to customer satisfaction to our passionate collaboration, Cequence stands out in the cybersecurity landscape. As we dig into the heart of Cequence’s workplace ethos, it becomes clear that our commitment to fostering an exceptional workplace culture is deeply rooted in our core values.

Heart: In our hearts, we believe in helping one another, putting family first, and showing gratitude for each other’s efforts. Our unique employee benefits reflect the love we have for our team, and our empathy and compassion create a supportive environment where everyone can thrive. Community engagement, inclusive practices, and celebrating both professional and personal milestones are at the core of who we are. Mentorship and personal growth aren’t just encouraged; they’re woven into the fabric of our company. And above all, we believe in honesty—in our interactions, in our commitments, and in our communication.

Humor: Laughter is the spice of life, and at Cequence, we embrace it fully. We laugh at ourselves, we bond as a team, and we create a positive work environment where humor is not just welcomed but encouraged. From conflict resolution to boosting engagement, humor is a powerful tool that helps us navigate challenges and celebrate successes together.

Drive: Our drive fuels everything we do. We work towards common goals with proactive, resourceful, and adaptable mindsets. We empower each other to flourish, commit to excellence, and embrace change with open arms. At Cequence, drive isn’t just about ambition; it’s about resilience, determination, and a relentless pursuit of greatness.

Curiosity: Curiosity is the engine of innovation, and at Cequence, we’re always hungry for knowledge. We believe in continuous learning, tapping into diverse perspectives, and questioning the status quo. Our culture of exploration and experimentation encourages intelligent risk-taking and fosters a spirit of creativity and discovery.

Trust: Trust is the bedrock of our organization. We believe in transparency, consistency, and accountability. We honor our commitments, communicate openly, and support each other with unwavering respect. At Cequence, trust isn’t just earned; it’s given freely, received graciously, and cherished deeply.

As we celebrate this incredible achievement, we’re reminded that our success is measured not just in accolades, but in the bonds we share, the challenges we overcome, and the victories we achieve together. Our culture isn’t just something we talk about—it’s something we live and breathe every day. As we look to the future, we’re excited to continue building on the foundation of heart, humor, drive, curiosity, and trust that sets us apart as one of the best workplaces in the nation!

Cequence helps some of the world’s largest, most important organizations protect themselves from evolving threats, data breaches, and other business disruptions. As threats continue to evolve, so must software designed to prevent those unwanted outcomes. Cequence today announced several significant machine learning-based enhancements to its Unified API Protection platform including improved API discovery, API security testing, and a significant advancement in automated threat detection and response. These improvements also help future-proof organizations against the complexities of API security and bot management in the face of AI-driven attacks and data leakage, which we expect to see as a major factor in the future.

The new capabilities and improvements announced today are available today and fall into three main categories:

• Automated threat detection and mitigation
• Customized API discovery
• Bespoke API security testing

Automated Threat Detection and Mitigation

This exciting new machine learning feature reduces the mean time to response (MTTR) to an attack by up to 90%. Mean time to response is understood to be the time from the discovery of an attack to the mitigation of the attack. Until now, API security products might detect an attack, but it was up to the security analyst to develop a rule or policy to mitigate the attack and then activate the policy. Now, Cequence offers the unique ability to identify anomalous or malicious traffic patterns and automatically generate mitigation policies for immediate action. Analysts simply review the policy and determine whether or not to implement it for mitigation. Cequence offers several mitigation options including blocking, rate-limiting, deception, and logging.

Customized API Discovery

API Spyder now automatically detects API hosts managed by API gateways including Mulesoft, Apigee, and AWS, providing detail on those APIs without requiring additional deployment or configuration. API definitions can be tailored to match the specific styles, usage, and requirements for an organization, thus increasing the accuracy of categorization and protection. Additionally, discovery algorithms can be tailored by customers, tuning them to the specific styles and formats relevant for that organization.

Bespoke API Security Testing

Cequence’s API security testing capabilities have been enhanced for greater customization specific to the user’s business. Test cases can be customized on a per-application basis with customized assertions that govern pass/fail criteria so testing can better reflect how applications are used in the reality. Traffic profilers per API group can also be customized within test cases to vary threat scenarios and improve resilience, feeding into tailor-made test plans.

Additionally, test plans can now be configured with authentication profiles for multiple user personas and privileges to enable thorough authentication validation testing.

The AI Attack Future

We know that attackers are beginning to harness AI to launch attacks that are harder to detect and quickly evolve, so we’re also investing significant time and effort into applying our existing technology to help protect customers against AI-driven attacks and tactics. If you’d like to learn more about the new capabilities in the Cequence Unified API Protection platform, please reach out and contact us or request a demo.

Cybercrime Christmas is here again in the form of the most excellent Verizon 2024 Data Breach Investigations Report (DBIR). If you’re into well-researched cybersecurity crime information, this annual report is for you. It’s a massive undertaking, and we’re all indebted to Verizon for making this happen each year. As in previous years, there’s a ton in this report. Of note, APIs occupy a bit more space in this year’s DBIR than they have in the past, and we welcome the acknowledgement of this important attack vector. Cequence Security is proud to be the only API security vendor contributing threat intelligence to this important research.

All About Credentials

All breaches start with a “way in”. In other words, how do the attackers initiate their breach into an organization. The Verizon DBIR points out that while email phishing finished solidly in second place, web applications occupy first and third place, for credentials and exploit vulnerability respectively¹. So, making sure that you’ve got rock-solid threat detection and mitigation happening is key. After all, even if your organization is great at patching, and most are not, having a system in place to detect and block attacks while your app remains unpatched is key.

As noted above, phishing continues to be on the rise, helping fuel the criminal availability of end-user credentials. Of course, credential stuffing is a common tactic used in automated attacks. As the report notes, “Credential stuffing is Brute force’s more hip cousin.” In credential stuffing, the attacker is attempting to use credentials that are already known to be valid somewhere, rather than trying to use computing power to systemically “guess” at credential values. And given people’s propensity to re-use credentials, this ends up working at a high enough percentage level to keep it on the attacker’s hit parade. There’s no shortage of marketplaces for this illicit credential information, either. If you know where to look, for about $10 you can buy a thousand fresh credentials.

Verizon states, “If your organization has a high number of customers, especially consumer-facing web applications and application programming interfaces (APIs), you should consider instituting robust protections before attackers use a tool and a free list of proxies to attempt combinations they found in a chat site.”²

MOVEit or Lose It

Unsurprisingly, the zero-day MOVEit vulnerability and associated attacks loomed heavily in the Verizon DBIR. The Verizon team was able to identify “1,567 breach notifications that related to MOVEit by a combination of (very vague) breach descriptions and the timing of the breach itself.”³ This SQL injection vulnerability in Progress Software’s MOVEit file transfer app affected thousands of organizations around the world (including my bank, according to the disclosure letter I received). A patch was issued, but the gap between patch availability and deployment left a big window for attackers to steal data or otherwise wreak havoc.

We wrote a blog about the MOVEit vulnerability last year, noting that the first step in a situation like this is to know what you have. The MOVEit vulnerability was exploited via its API, so a solution like the Cequence Unified API Protection platform would enable an organization to identify MOVEit instances for either monitoring or deactivation.

Then, while waiting for a patch to be issued or tested internally before deployment, it would be ideal to have a solution that could identify and mitigate attacks in real time. Cequence does this by fingerprinting traffic and identifying anomalies. Once the traffic is fingerprinted, policies can be enacted to ensure attacks don’t succeed.

Take Action

Make no mistake, stolen credentials are criminal currency that will be used in a variety of attacks, and new vulnerabilities like MOVEit will continue to appear, so it’s critical to have solutions in place that will let you know where you are exposed and protect you in the time between zero day and patching. We’d love to talk with you in more detail about your specific situation. Or, let’s arrange a demo so you can see for yourself.

Last, if you haven’t already, please read the Verizon 2024 Data Breach Investigations Report for yourself. It’s well-written, easy to read, and there’s lots to learn from.

References

¹ Verizon 2024 Data Breach Investigations Report, Results and analysis, p. 12.

² Verizon 2024 Data Breach Investigations Report, Incident Classification Patterns, p. 44.

³ Verizon 2024 Data Breach Investigations Report, Results and analysis, p. 21.

Today, we’ll spend some time talking about integrating Cequence solutions with the Broadcom Layer7 API Gateway. Broadcom API Gateway, previously known as Layer7 API Gateway, is an enterprise-grade solution designed to provide centralized management and security for API infrastructures. It acts as a proxy between clients and back-end services.

Cequence Security offers customers numerous ways to integrate with and make use of the infrastructure that they already have. In the last quarter, for example, we’ve added integrations for CA/Broadcom, Akana, and Akamai that allow each of these products to act as a traffic source to the Cequence Unified API Protection platform.

Broadcom API Gateway Integration

Cequence now supports and integrates with the Broadcom Layer7 API Gateway using the Cequence Broadcom API Gateway Policy Plugin. Broadcom Layer7 API Gateways are extensible, scalable, high-performance gateways to connect your most important data and applications across any combination of cloud, container, or on-premises environments. Layer7 API Gateways are available as a standalone solution or as part of Layer7 API Management. With this new Cequence integration, installed as a Layer7 API Gateway Global Policy Fragment, customers can asynchronously forward all request and response transaction metadata via REST API to the Cequence Unified API Protection platform, making them available for analysis by API Spartan and API Sentinel.

Cequence monitors and analyzes metadata which often includes but is not limited to:

1. API endpoints accessed
2. Request and response information
3. Source and destination IP addresses
4. API call timestamps
5. API response times and status codes
6. Patterns of API usage
7. Other headers and parameters

The integration of the Cequence Broadcom API Gateway Plugin with a Broadcom API Gateway can be deployed as an appliance. It can also be used for integration with Broadcom gateway deployed as a docker container or in Kubernetes. Integration is accomplished using the Broadcom Layer7 Policy Manager. Integration steps include configuring the Broadcom Layer7 Gateway to use the Cequence Broadcom Layer7 Gateway Plugin. The configuration will also include obtaining authentication credentials to your Cequence UAP control platform and modifying network ingress appropriately to allow for the transmission of transaction data.

How to Leverage the Cequence Unified API Protection Platform with this Integration

With this integration with the Broadcom Layer7 API Gateway, customers can leverage the Cequence Unified API Protection platform to protect their applications against security threats, particularly those targeting their API infrastructures:

1. Protection Against Automated Attacks: The platform offers robust detection and mitigation controls against bot attacks, including credential stuffing, account takeover, data scraping, and denial-of-service attacks.
2. Application Vulnerability Detection: It can identify potential vulnerabilities in your APIs and applications, such as attempts to exploit weaknesses in your application’s logic.
3. Advanced Analytics and Machine Learning: It uses artificial intelligence and machine learning to understand normal API behavior, enabling it to identify anomalies and potentially malicious activities.
4. Zero-Day Attack Prevention: The use of sophisticated machine learning models allows Cequence to identify and prevent Zero-Day attacks.
5. Visibility and Control: The Cequence Unified API Protection platform provides complete visibility into API traffic, offering granular control over what can access your API resources.
6. Compliance Assistance: By securing API endpoints and protecting sensitive customer data, the platform can help organizations meet compliance with various data protection regulations.
7. Easy Integration: The platform fits easily into existing security infrastructure, offering a seamless way to enhance application security.
8. Scalability: The Cequence platform is built to scale and thus can support organizations as their API usage and number of endpoints grow.

By offering these protections, the Cequence Unified API Protection platform ensures organizations can securely conduct digital business and protect customers’ sensitive data from breaches.

Imagine your financial institution sends you an email that says you need to check something related to your account and the email contains a handy link to help you resolve the issue. You click on the link and the bank site loads, you login with your credentials and notice nothing out of place. Even though everything looked normal, an attacker has actually just intercepted your username and password. This is an example of an iframe injection attack, one of several iframe security risks.

What is an iframe Injection Attack?

Iframe is short for inline frame and is used to embed content from another webpage or site into the current page seamlessly. However, iframes can be very dangerous if they are used by malicious attackers to inject calls for malicious iframes into the URL itself or secretly insert malicious code on the page. The result of this may be that when you visited your bank website and clicked into the username and password boxes to enter your credentials, you were actually typing in the malicious iframe injected by the attacker. Think of it like a card skimmer at a gas station, as criminals put a fake card reader over the real one in order to steal credit card numbers.

How iframes Can Be Exploited by Hackers

Why does this happen? Well, mostly because the web browser does what it’s told. It doesn’t ask the user “do you want me to do this to keep you safe?” it simply receives code from the website or the attacker’s website, and renders/runs the code. This means that in order to stop this you have to instrument the website to instruct the browser to ignore rendering that malicious script. The website needs to define explicitly where the safe iframes can come from, while rejecting others. This is done using several different methods, though most involve headers to instruct the browser.

Preventing iframe Attacks

The X-Frame-Options HTTP response header can be used to instruct a browser whether or not it should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>. This header can be part of the server response or can be set on a web application firewall (WAF) for all web responses to contain.

There are several options within Content Security Policy declarations made to the user’s browser that will direct further security decisions to be made by the browser. Things like Frame Ancestors statements, Frame Src (Source) and Frame Sandboxing can protect users from anything malicious that someone might attempt to inject into the page.

Even something as simple as having the legitimate frame always being on top with a “top=self” statement will create a browser directive to not load frames above that page.

Many of the iframe problems that exist have been solved in the past but as web issues are wont to do, sometimes history repeats itself and we end up with old problems resurfacing. Utilizing a WAF to set all security controls in the event they are forgotten in the app is a great way to defeat many of these types of attacks.

Strengthen Your Defenses with API Protection

While iframe attacks are not directly an API security issue, they’re important web application attacks and can be solved with a properly-configured WAF such as from our partner Vercara. Adding Unified API Protection to the mix will not only protect against API-specific attacks but also intercept any API attack loads before they get to the WAF, enabling it to be more efficient.

Want to learn more? Get started with a free, no obligation API security assessment that gives you an attacker’s view into your organization’s APIs – and the next step in your web application and API security journey.

Made popular by television talk-show host David Letterman, an avid application security enthusiast and obsessive list maker, top 10 security lists have driven many organizations’ security programs, giving them a framework for a particular security initiative. In some cases, the lists have been used with tunnel vision, resulting in security gaps. While the OWASP Web Application and API Security Top 10 lists are the most common and well-known security lists, OWASP has a wide range of lists that may be applicable to your organization. Regardless of what list you may choose to use for your security initiative, these lists are ranked as top 10s because they describe the most severe threats. This means that these lists should be used as a starting point and organizations should always look beyond the top 10 lists to find the other many hundreds of threats their organization may be subject to.

Who or What is OWASP?

OWASP stands for the Open Web Application Security Project, a nonprofit foundation that works to improve the security of software. The major thrust of OWASP comes down to projects run by groups of individuals that are part of OWASP chapters worldwide. OWASP is a large, global organization of dedicated professionals who volunteer their time and talents to make software more secure. Each OWASP Top 10 list represents a project.

What is the OWASP Web Application Security Top 10?

The oldest of the OWASP Top 10 lists is the Web Application Security Top 10 and it is designed to address the 10 most critical web application security concerns. Much of this list focusses on protecting the types of applications that interact with via a web browser. The list contains protections for client side privacy and security as well as the web application platform.

If you use online banking, or have bought goods and services from an online retailer, then you have benefitted from the OWASP Top 10 effort. The Web Application Top 10 list is thought to be the initial standard for protecting security for each of these industry platforms. In an effort to improve security for credit cards, the Payment Card Industry (PCI) dictates that any application accepting or using credit cards must not have any OWASP Web Application Top 10 vulnerabilities.

What are the OWASP Top 10 vulnerabilities? As shown in the list below, they represent problems that are common within web applications that often result in a security incident or data breach. The data determining which vulnerabilities make the list and their associated order is derived from the previous three years of breach data and input from application security experts. While the list is updated every few years, make no mistake, the current 2021 list remains relevant today. Outside of improving application security testing processes and procedures to find and fix vulnerabilities before they are exposed, the OWASP Web Application Threats are commonly addressed by Web Application Firewalls.

OWASP Web Application Security Top 10

• A01:2021 Broken Access Control
• A02:2021 Cryptographic Failures
• A03:2021 Injection
• A04:2021 Insecure Design
• A05:2021 Security Misconfiguration
• A06:2021 Vulnerable and Outdated Components
• A07:2021 Identification and Authentication Failures
• A08:2021 Software and Data Integrity Failures
• A09:2021 Security Logging and Monitoring Failures
• A10:2021 Server-Side Request Forgery

What is the OWASP API Security Top Ten?

While many web applications have long used APIs as the backend, you should not assume your APIs fully covered if you focus solely on the OWASP Web Application Top 10. As previously mentioned, the original list is for web applications specifically applications that are utilized via a browser. The OWASP API Security Top 10 covers applications that use APIs to move data around or are the interface for the application data, such as a mobile application. From the folks at OWASP, “API Security focuses on strategies and solutions to understand and mitigate the unique vulnerabilities and security risks of Application Programming Interfaces (APIs).”

Many of the security incidents in the last two years have leveraged API-specific vulnerabilities that were discovered by looking at normal application flow via a reverse proxy or a similar process. These applications didn’t have web pages to go to, the APIs were embedded within consumer electronics, like in the case of a Peloton fitness bike or are a consumer application for use with mobile, like in the case of Brew Dog.

What are the API vulnerabilities within the OWASP API Security Top 10 list? The list extends beyond the web application variants to include things like authentication and authorization flaws, mismanagement of the application, problems with allowing automated attacks on the platform, etc. Organizations that are moving down an API-first methodology, but still have web applications should use both of these lists as starting points for their security and compliance initiatives.

OWASP API Security Top 10 List

• API1:2023 Broken Object Level Authorization
• API2:2023 Broken Authentication
• API3: 2023 Broken Object Property Level Authorization
• API4: 2023 Unrestricted Resource Consumption
• API5: 2023 Broken Function Level Authorization
• API6: 2023 Unrestricted Access to Sensitive Business Flows
• API7: 2023 Server Side Request Forgery
• API8: 2023 Security Misconfiguration
• API9: 2023 Improper Inventory Management
• API10: 2023 Unsafe Consumption of APIs

Learn more about OWASP 2023

API10+: Extending Beyond OWASP API Security Top 10

A singular focus on addressing the OWASP Top 10 lists is a good start, but complete API protection will be illusive unless you have a complete understanding of how APIs – both correctly coded and those with errors – can be attacked. This includes how a risk is discovered, the tactics, tools, and procedures attackers use to exploit it, and how attackers will react to resistance. This means not only making sure that your APIs are not susceptible to the OWASP API Security Top Ten as a starting point, but also to look at what can be defined as API10+, a category that encompasses the many different ways attackers target perfectly coded APIs that either do not cleanly fall into any of the OWASP API Security Top 10 threats or use a combination of them to achieve their goal. As documented in the API Protection Report, First Half 2022, the CQ Prime Threat Research blocked roughly 3.6 billion malicious requests, making API10+ the second largest API security threat mitigated during this timeframe.

What is the OWASP Automated Threat Handbook?

OWASP accurately states that “Web applications are subjected to unwanted automated usage – day in, day out. Often these events relate to misuse of inherent valid functionality, rather than the attempted exploitation of unmitigated vulnerabilities.” The OWASP Automated Threat Handbook (OAT), was created to help drive the adoption a common language framework for different groups (e.g., DevOps, architects, business owners, security engineers, purchasers and suppliers/vendors) across all industries to use when discussing web application threats. Organizations should use this list as a complement to the Web Application and API Security Top 10 lists.

Other OWASP Top 10 Lists to Consider

• The OWASP Mobile Top 10: Started in 2015 and revamped since then, this list is comprised of vulnerabilities in the actual mobile application as opposed to the backend application servers. As we all have mobile devices and increasingly count on the applications installed on them, this list is important. The latest revision to this list, 2024 is now available. The items on the list sound extremely scary, including items such as insecure data storage and insecure communication, so any organization focused on developing mobile-side application should use this list as an extension to the web and API-specific lists.
• The OWASP Kubernetes Top 10: The newest Top 10 for Applications is driven by the adoption of Kubernetes as application infrastructure and covers the vulnerabilities that can impact the servers as well as the applications. The Kubernetes Top 10 is about prioritizing risk in the Kubernetes ecosystem and should be considered if your organization is using Kubernetes.
• The OWASP Top 10 Proactive Controls: The question often comes up “why are developers putting vulnerabilities in their software” and the use of proactive controls steps toward solving that issue. Developers, like anyone that makes a mistake, don’t put vulnerabilities in software on purpose. Developers are just trying to get their jobs done as efficiently as they can. In order to code securely, one must understand where to apply security concepts. For instance, an authentication routine may now have a better and more secure way to handle passwords. When updating software, calling this new library might be needed in order to add this security feature. How would a developer know this is possible or that it exists? This is the job of proactive controls. Reviewing libraries for better security features as well as possibly better frameworks, is important and up towards the top of the list. As one develops the next feature set, the next enhancement, reviewing the controls allows for a step where one can ask the question “is there a more secure way to do this?”

As a longtime member of the OWASP community and a passionate application security advocate, I believe that the industry is at risk of relying too heavily on the top 10 lists. Whenever possible, I recommend that security teams who are just getting started with an application (or API) security initiative look to OWASP as a mechanism to get started. The nature of top 10 lists is that they may be a great starting point to help you address some of your risks. But remaining risks, even those not found on a list, need to be identified and addressed in order to avoid compliance violations, data loss, and business disruption.

Cequence Security and the OWASP Lists

Cequence Security believes in taking a holistic approach to defending against API-related risks with a market-defining solution that addresses every phase of the API protection lifecycle. The Cequence Security Unified API Protection platform is the only offering that protects your organization from every type of attack on the OWASP API Security Top 10, OWASP Web Application Security Top 10 and OWASP Automated Threat list.

Schedule your personalized demo today.

Cequence Security is thrilled to announce our participation at this year’s RSA Conference, Booth 2033, where we’ll showcase our innovative bot management and API security solutions.

The RSA Conference, a global summit for security innovators, returns to San Francisco’s Moscone Center from May 6-9. This event is a melting pot for those looking to exchange ideas and advancements in cybersecurity.

Why Visit Cequence Security at RSA Conference?

Our mission is to protect the vital connections your business depends on. With APIs playing a crucial role in today’s digital infrastructure, securing them against threats is more important than ever. Here’s what we have planned for you at Booth 2033:

• Live Demos: Experience the Cequence Unified API Protection platform in action and see how it can shield your business from threats.
• Expert Insights: Get up-to-date on the latest in API security and bot management from our knowledgeable team.
• Special Sessions: Join us on Tuesday and Wednesday for special sessions on the latest topics in API security and bot management.
• Exclusive Swag: Pick up a unique, artist-customized laptop sleeve and more!
• Win Big: Try your luck to win a Breville Barista Touch™ espresso machine and play our scratch and win game to win additional prizes.

Join Us at RSA Conference 2024 and discover our advanced bot management and API security solutions

RSA Conference 2024 is more than an event; it’s a chance to engage with the future of cybersecurity. Visit us at Booth 2033 to learn how Cequence Security can fortify your API defenses, meet our experts, and walk away with some great swag. See you in San Francisco!

For more details and to connect with us ahead of the event, visit Cequence Security at RSA Conference 2024.

In January of this year, Cequence announced our partnership with Vercara, a leading provider of cloud-based security services. The partnership was motivated in no small part by the fact that Web Application Firewalls (WAFs) simply weren’t designed to handle the task of securing APIs. While WAFs and API gateways provide core application protection, they cannot address the complete spectrum of API security requirements which includes discovering all your APIs, detecting their inherent risks, and defending against associated threats.

The rise in API-related security incidents underscores the necessity for robust discovery, compliance, and protection mechanisms. Since APIs act as gateways to sensitive data and core business functionalities, a single breach can have far-reaching consequences. Data theft, unauthorized access, customer dissatisfaction, and system disruptions are among the potential outcomes, highlighting the need for a comprehensive approach to API security.

Here’s a good primer that walks through why organizations need API security even if they have a WAF and API Gateway.

Fast forward to this past week where Vercara formally announced its UltraAPI™ product line, powered by Cequence Security, the world’s leading API Security and Bot Management company. The UltraAPI suite protects applications and APIs by providing discovery, compliance, and protection across all internal and external APIs to defend organizations against attacks, business logic abuse, and fraud.

The swift pace at which APIs are developed and deployed often outstrips the attention paid to securing them, leading to vulnerabilities that can be exploited by cyber attackers. This scenario presents a critical challenge: ensuring that an organization’s expanding API use does not equate to increased security risks.

You may have heard the phrase, “shift left, shield right”. By shifting left, organizations try to identify and mitigate risks early in the development process as the APIs are created. Shielding right focuses on protecting applications and APIs after deployment, in production, supporting business-critical applications. Both, of course, are absolute necessities, and the UltraAPI platform covers the gamut.

Consisting of three flexible SaaS solutions – UltraAPI Discover, UltraAPI Comply, and UltraAPI Bot Manager – that can be purchased individually or as a comprehensive platform, Vercara’s UltraAPI suite embraces the breadth hat “shift left, shield right” infers.

• UltraAPI Discover: API attack surface discovery management that continuously works to provide an attacker’s view of an organization’s externally accessible APIs.
• UltraAPI Comply: Security posture management that provides a complete inventory of active APIs, identifying security risks, and alerting organizations to those that pose the greatest threat.
• UltraAPI Bot Manager: Attack detection that prevents sophisticated automated application and API attacks and business logic abuse, leveraging machine learning and analytics to uncover, track, and block malicious behavior.

By integrating UltraAPI with Vercara’s other cloud-based solutions, such as UltraWAF and UltraDDos Protect, businesses can achieve a comprehensive security posture that encompasses both web applications and APIs. This holistic approach is vital in an era where cyber threats are constantly evolving and becoming more complex.

The adoption of comprehensive API security solutions like UltraAPI is not just about mitigating risks; it’s about enabling businesses to leverage the full potential of their applications and APIs without compromising on security. As the digital landscape continues to evolve, the importance of such solutions will only grow, underscoring the need for continued innovation and vigilance in API security.

Citizens JMP, a prestigious investment firm specializing in technology sectors, recently honored Cequence by recognizing us as one of the hottest privately held cybersecurity companies as part of its Cyber 66 list. This recognition highlights Cequence’s dedication to innovation and commitment to delivering solutions that effectively address the constantly evolving challenges of API security and bot management.

Citizens JMP’s equity research team covering the cybersecurity sector compiles the Citizens JMP Cyber 66 list through an annual evaluation process. Companies are evaluated on criteria including innovation, market potential, customer adoption and growth trajectory. Additionally, companies are assessed based on their unique contributions to cybersecurity with the goal of identifying the most promising and impactful companies.

At Cequence, we pride ourselves on being pioneers in API security and bot management. As our world becomes more interconnected, APIs continue to proliferate across various industries. However, with this widespread adoption comes an increased risk of API-related threats. The Cequence Unified API Protection (UAP) platform offers comprehensive defense against API threats, from proactive discovery to real-time threat detection and mitigation.

Trevor Walsh, a cybersecurity research analyst at Citizens JMP, commended Cequence’s innovative approach to API protection and our rapid growth in a critical market. His comments emphasized the importance of our UAP solution in effectively addressing the API security challenges facing organizations today. He noted that Cequence’s inclusion in the Cyber 66 report reflected our exceptional performance and leadership in the cybersecurity landscape.

Cequence believes that APIs are not only the connective tissue between applications both within and between organizations but are also foundational building blocks of future innovations. This understanding is one of the driving forces behind Cequence UAP. Through the integration of technologies such as AI and LLMs (Large Language Models), the Cequence platform leads the way in innovations that save customers time and improve API security.

The Cequence UAP platform includes API Spyder for proactive API discovery, API Sentinel for security posture management, and API Spartan for bot management and fraud prevention. The platform is designed for rapid and flexible deployment, and can be implemented on-premises, in the cloud, or as a SaaS solution in as little as 15 minutes.

Are you confident in the security of your APIs? Our personalized assessment provides a complete understanding of your API security posture. Try our free, no obligation security assessment and see what attackers see of your API attack surface. You can also join our community of security enthusiasts and industry professionals by following Cequence on LinkedIn for company and product updates, industry insights, and API security trends.

Key Takeaways:

• ChatGPT makes automated attacks much easier to carry out. LLMs like ChatGPT can generate code for attackers to deploy in seconds, with no hacking background required.
• IP blocking won’t cut it anymore. Today’s defense solutions must have multi-dimensional behavioral fingerprinting to identify attackers even as they retool to evade detection.

Basic API Interrogation

During my time here at Cequence, I have been impressed with the attackers we face. Often, they have almost nothing to go on and must figure out how each piece of their attack is going to work. Sometimes it is finding an odd endpoint and trying things over and over to figure out its behavior. Sometimes it is finding a chatty endpoint that gives out information that can be used later. The use case often dictates the attack, but the adversaries are incredibly creative no matter their goal.

For instance, let’s take an example API that might have some kind of (in this case, fake) data in it. Let’s say it’s located at api.example.com/customers/1 , and looks like this:

{“addresses”:[{“customer_id”:4814278,”province”:”NY”,”city”:”North Aidaberg”,”id”:4303169,”zip”:”26026-4407″,”country”:”USA”,”phone”:”+1-702-911-198″,”company”:”Morissette, O’Kon and Lehner”,”first_name”:”Guy”,”last_name”:”Feeney”,”address”:”2155 Gottlieb Ranch”,”default”:true},{“city”:”Erdmanberg”,”company”:”Cartwright, Kassulke and Klocko”,”default”:false,”customer_id”:2889055,”first_name”:”Wava”,”last_name”:”Macejkovic”,”country”:”USA”,”province”:”AK”,”zip”:”88424-6779″,”phone”:”+1-072-114-431″,”address”:”4329 Kohler Brooks”,”id”:2448155},{“address”:”318 Arvilla Track”,”phone”:”+1-536-437-557″,”last_name”:”Waelchi”,”customer_id”:5231730,”first_name”:”Bridie”,”company”:”Luettgen LLC”,”city”:”East Trever”,”id”:8959647,”default”:false,”province”:”MS”,”country”:”Canada”,”zip”:”55172-6265″}],”created_at”:”Sun Jan 23 2022 18:09:54 GMT+0000 (Coordinated Universal Time)”,”currency”:”CAD”,”email”:”Zoie89@hotmail.com”,”email_marketing_consent”:true,”first_name”:”Vanessa”,”id”:8403691,”last_name”:”Hoeger”,”last_order_id”:5267658,”note”:null,”orders_count”:93,”payment_methods”:[{“credit_card”:”6771-8937-1225-3194″,”cvv”:”281″},{“credit_card”:”5442-1205-9896-6528″,”cvv”:”141″},{“cvv”:”527″,”credit_card”:”6771-8942-7163-0081″}],”phone”:”+1-151-053-629″,”sms_marketing_consent”:false,”total_spent”:118.49,”updated_at”:”Mon Mar 04 2024 23:00:01 GMT+0000 (Coordinated Universal Time)”,”verified_email”:false}

If I change the request to api.example.com/customers/2 I get the following fake data:

{“addresses”:[{“country”:”Canada”,”last_name”:”Sipes”,”company”:”Streich – Breitenberg”,”address”:”63245 Feil Falls”,”id”:3964521,”zip”:”82884-8785″,”customer_id”:2196088,”phone”:”+1-055-402-015″,”default”:true,”city”:”South Darien”,”province”:”MS”,”first_name”:”Forrest”},{“phone”:”+1-212-661-130″,”last_name”:”Howell”,”address”:”8725 Botsford Island”,”default”:false,”country”:”Canada”,”first_name”:”Carmela”,”customer_id”:5356604,”company”:”Stiedemann LLC”,”province”:”OR”,”city”:”Port Harmony”,”id”:2710863,”zip”:”15655-1994″},{“address”:”5557 Amy Common”,”customer_id”:4607468,”default”:true,”city”:”North Madilyn”,”last_name”:”Bayer”,”id”:3308673,”phone”:”+1-847-981-210″,”province”:”MS”,”zip”:”30655″,”country”:”Canada”,”first_name”:”Ambrose”,”company”:”Feest – Hodkiewicz”}],”created_at”:”Tue Sep 05 2023 18:29:33 GMT+0000 (Coordinated Universal Time)”,”currency”:”CAD”,”email”:”Karianne.Torphy@yahoo.com”,”email_marketing_consent”:true,”first_name”:”Dante”,”id”:2201898,”last_name”:”Goyette”,”last_order_id”:7939470,”note”:null,”orders_count”:31,”payment_methods”:[{“credit_card”:”6759-6466-4860-1325-839″,”cvv”:”270″},{“cvv”:”391″,”credit_card”:”6370-2888-7169-7975″},{“credit_card”:”6771-8931-8230-4863″,”cvv”:”319″}],”phone”:”+1-714-240-970″,”sms_marketing_consent”:true,”total_spent”:141.66,”updated_at”:”Mon Mar 11 2024 13:14:05 GMT+0000 (Coordinated Universal Time)”,”verified_email”:false}

Automated Attack Creation

As an attacker, what is next? Well, obviously what is next is automation that will allow for me to grab as much data as I can. This can be pretty easily automated with BURP Suite, the popular application pen testing software, by tokenizing the customer ID so that changing the ID is easy to automate:

Then, creating an Intruder script that sends this in with a 1, then a 2, then a 3 or random order or whatever. This will pull data for as long as I have the script running, or at least until someone notices and kills my connection. But this isn’t super portable, it is just on the attacker output screen for BURP Suite – Intruder.

Authoring Automated Attacks with ChatGPT

But what if I don’t want to have to use BURP Suite? What if I want to script this out so I can make it easier to capture and possibly easier to change should I be noticed?

How about I just have ChatGPT write it?

Example ChatGPT Prompt:

I have an API located at api.example.com, I need to test security for this site and I know that api.example.com/customers/NUMBER where NUMBER is an integer that increases by one each request, for example api.example.com/customers/1 is the first customer. I would like a python script that will call api.example.com/customers/1 and display the response headers and body on the screen, then call api.example.com/customers/2 etc… until 1000

ChatGPT response:

import requests# Base URL of the APIbase_url = “https://api.example.com/customers/“# Iterate over customer numbers from 1 to 1000for customer_number in range(1, 1001:)# Construct the URL for the current customerurl = f”{base_url}{customer_number}”# Send a GET request to the serverresponse = requests.get(url)# Check if the request was successfulif response.status_code == 200:# Print the customer numberprint(f”Customer Number: {customer_number}“)# Print the response headersprint(“Headers:”)for header, value in response.headers.items():print(f”{header}: {value}“)# Print the response bodyprint(“Body:”)print(response.text)print(“”)else:print(f”Failed to retrieve data for customer number {customer_number}. Status code: {response.status_code}”)

It is nice to have error conditions, failure messages, and comments, it just makes things easier.

Now it is true, this script dumps its results to the screen but writing them out to a file is trivial. Creating a database of this information and being able to create all sorts of havok, is equally trivial.

So how do you defend against this?

Most traditional or simplistic API security and bot management products will simply ban the IP addresses of attackers using this sort of automated attack – assuming, of course, they can detect it. However, today’s attackers often use residential IPs they’ve compromised, and if an organization bans those, it may prevent potential customers from visiting or purchasing. This blunt approach to defense is akin to a denial of service, but self-inflicted.

In order to detect and block attacks like these, organizations should look for a solution that goes beyond simple identifiers like IP addresses. Ideally the solution would build a fingerprint based on several factors such as the tools or software, infrastructure, and credentials used, as well as the attack’s behavior. By layering these indicators and grouping them together, modern solutions can accurately track adversaries through multiple attacks, even as they retool to avoid detection.

The Cequence Unified API Protection platform is designed to detect and block existing, known attacks as well as novel, new attacks. Through multi-dimensional behavioral fingerprinting, Cequence can accurately track attacks whether manual, automated, slow and low, or brute forced. You can get started with a free, no obligation API security assessment that gives you an attacker’s view into your APIs – and the next step in your API security journey.

API threat detection is one of the critical aspects of API security and is the process of identifying API threats intended to exploit API vulnerabilities. As API usage becomes more prevalent across organizations, they have also become a primary target of attackers, who employ widely varied and advanced techniques to exploit API vulnerabilities. Insufficient protection against such API threats can lead to data breaches that expose sensitive data, fraud, and other abuse that can cause business disruption, not to mention increased infrastructure and personnel costs.

API Threat Detection Should be a Core Security Competency

Throughout the growth of the internet, organizations have improved their ability to detect application threats and attacks. Those threats have not diminished, and in fact they continue to evolve, and application threat detection and defense must necessarily evolve in response. But as organizations’ internet presence has grown, so has the attack surface, in no small part due to the proliferation of APIs that connect applications together, the front end to the back end, organizations to partners, and more.

APIs are now core to organizations’ network strategy and should be core to the security strategy as well. The fact is that many of the most common attacks either can be focused on the API as well as the application or are designed specifically for APIs, but most solutions designed to protect the applications don’t adequately protect the APIs. Automated account takeovers (ATO), fake account creation, gift and loyalty card fraud – these can all be a threat to APIs and must be identified, prioritized, and mitigated.

How Can Organizations Choose the Right API Threat Detection Solution?

There are a few important things to look for when choosing the right API threat detection solution. Organizations should also consider factors such as additional available services, support, and ease of deployment, but for the purposes of this article we’ll focus on criteria specific to API threat detection.

API Discovery and Inventory

A common problem faced by today’s organizations is “API sprawl,” which can occur when separate teams develop products with different standards, for example. In order to adequately protect APIs and detect threats accurately, organizations must have an up-to-date inventory of their APIs, including production, third-party, and even so-called shadow APIs. Shadow APIs are APIs that aren’t documented or supported and therefore usually not monitored or audited, making them more likely to be vulnerable. Organizations should look for a solution that includes API discovery and inventory, enabling them to reduce or eliminate APIs not under IT control.

Intelligent API Detection

An effective API threat detection solution is capable of identifying threats based on their behavior, not an easily spoofed identifier such as IP address. This criterion immediately separates the effective from the legacy solutions, greatly simplifying the buying decision. Additionally, while it’s important to support standardized frameworks like OWASP, the solution should also go further and identify other commonly known threats as well as unknown threats. The ability to identify threats by behavior greatly improves a solution’s ability to identify threats never seen before.

Built-in Mitigation and Blocking

Most API security solutions are merely detection mechanisms, much like early vulnerability management solutions that produced pages and pages of problems to solve but left the actual problem solving to the buyer. The best API threat detection and defense solutions today offer various mitigation options including native blocking. While web application firewalls (WAFs) and similar products have their place in the security strategy, handling mitigation and blocking for the entire application and API infrastructure is not what they were designed for. We’ve expanded on this idea in a recent blog, Why do I Need API Security if I Have a WAF and API Gateway? The ideal solution has mitigation options such as logging, blocking, rate limiting, geo-fencing and deception, a technique that misleads attackers into believing that their attacks have been successful.

Explore Cequence Unified API Protection

The Cequence Unified API Protection UAP platform meets all these criteria in a single platform. Based on three core pillars, discovery, compliance, and protection, the UAP platform provides a comprehensive solution for API threat detection and defense. If you’d like to learn more, Cequence offers a free API security assessment with no obligation that gives you an attacker’s view into your APIs and the next step in your API security journey.

Business logic abuse is a common attack technique directed at web and mobile applications as well as their APIs. These attacks appear as valid interactions because the attacker is exploiting intended app or API functionality, which also enables them to bypass traditional security solutions without detection. These attacks can be automated and massively scaled through bots, potentially leading to data loss, theft, or fraud.

What are Business Logic Vulnerabilities?

The business logic of applications and APIs defines and enforces a set of rules and limitations during application design and functionality development. This logic attempts to ensure that users – or bots acting as users – can only use the app or API in a manner in which it was designed and cannot perform activities that can negatively impact the application or infrastructure.

Applications and APIs empowered with even the best authentication and controls, functioning seamlessly and as expected, can have design and process flaws exploitable by attackers. In addition, developers can’t always predict how the users will interact with the application, leaving the door open for attackers to use behavioral flaws to detrimental consequences.

A business logic vulnerability results from business logic errors in the application or API, which are then exploited by criminals to launch business logic abuse attacks, appearing to be legitimate or even syntactically correct. It is this perceived legitimacy that enables these attacks to pass through existing security infrastructure without detection.

Application and API testing is critical to uncover these vulnerabilities, but legacy testing tools such as Dynamic Application Security Testing (DAST) cannot discover all logical flaws. As previously mentioned, existing security infrastructure might not be able to prevent such attacks because of the apparent legitimacy of these attacks.

Business Logic Abuse Examples

Business logic attacks can surface anywhere a user or automated tool can interact with a given application or API. Attackers will attempt to manipulate the business logic of the application into producing the results the criminal desires. Some examples of business logic abuse include:

• Access control – attackers may manipulate URLs, session tokens, cookies, or hidden fields to gain advanced privileges and access sensitive data or functionality.
• Input validation – bots may attempt to repeatedly sign up, login, or execute purchases in order to validate credentials, access unauthorized data, or commit fraud.
• Session management – flaws in session tokens or poor handling of session data could lead to hijacked sessions and privilege escalation.
• Business constraint exploitation – attackers may try to bypass built-in constraints to business logic by reviewing points of entry such as form fields and coming up with inputs that the developers may not have planned for. For example, bypassing the purchasing workflow could allow an attacker to purchase a product without paying.

These examples could occur in virtually any online business website. In addition, the larger and more sophisticated a website is, the more likely it is to have business logic flaws simply due to the complexities of the site.

Impacts of Business Logic Abuse

Business logic abuse is a critical security challenge because even well-coded apps and APIs can fall prey to such attacks. These APIs might be hardened against OWASP API Security Top 10 threats and the organization may have granular visibility into their APIs and usage, but they still could be susceptible to business logic abuse. Attackers looking for ingress points into apps and APIs zero in on business logic as the weakest link in an otherwise bug-free app or API and will leverage bots to automate massively scale their processes and tactics. Effective bot management is essential to reducing this automated abuse and maintaining secure, predictable application behavior. Impacts of business logic abuse include:

• Increased infrastructure costs incurred handling the increased traffic volume resulting from bot attacks
• Loss of revenue from stolen goods
• Loss of user confidence due to missing out on limited quantity sales or stolen loyalty points
• Increased personnel costs resulting from the additional headcount required for cybersecurity monitoring and response

Preventing Business Logic Abuse Attacks

Business logic abuse attacks are very different from standard vulnerabilities and are much harder to detect. What’s needed is a solution that can see all the traffic to a given application or API and is able to detect anomalies based on multiple behavioral-based criteria. Solutions that require per-app instrumentation through JavaScript or SDKs will necessarily not cover all applications, and attackers are too savvy to be detected based on any single criterion. The Cequence Unified Application Protection platform requires no app modification and utilizes multi-dimensional machine learning to detect malicious intent. Cequence incorporates four pillars of threat detection, including tools, infrastructure, credentials, and behavior to accurately identify business logic abuse attacks and prevent them natively.

We’d love to talk to you about how Cequence can help your business avoid business logic abuse. You can get started free with an API security assessment, or contact us for a live demo.

Today is International Women’s Day, a day dedicated to celebrating the achievements of women worldwide and advocating for gender equality. As we prepare to mark this significant occasion, we are reminded of this year’s theme: “Inspire Inclusion.” This resonates deeply within the cybersecurity industry, prompting us to reflect on the progress made and the work that still lies ahead in fostering a more inclusive and diverse environment. We strive to amplify the voices and contributions of women in our field, recognizing their invaluable role in shaping the future and working to inspire inclusion in cybersecurity.

Women in Cybersecurity are Breaking Barriers and Leading Change

In recent years, the representation of women in cybersecurity has steadily increased, yet significant disparities persist. Women comprise only a fraction of our industry’s workforce, with estimates ranging from 20% to 25%. By 2025, Cybercrime Ventures predicts that women will make up 30% of the cybersecurity workforce.

Despite this imbalance, women continue to make remarkable strides, breaking barriers and driving innovation in this rapidly evolving field. At Cequence Security, the voices and contributions of our female colleagues hold immense value. Their perspectives, achievements, and aspirations serve as powerful reminders of the impact of diversity and inclusion in cybersecurity within our company.

Let’s take a moment to spotlight a selection of remarkable women at Cequence Security whose skills and contributions have truly made a difference. Through their dedication and expertise, they have not only elevated our company but also inspired those around them. Here are some of the insightful quotes they’ve shared, encapsulating their wisdom and experiences.

Sandhiya Sivaraman, Operations Manager, Engineering
“To the women who inspire change, defy stereotypes, and challenge the status quo, your strength knows no bounds.”

Reverie Hara, Sr. Manager, Revenue Marketing
“The question isn’t who’s going to let me; it’s who’s going to stop me.” — Ayn Rand

“Feminism isn’t about making women strong. Women are already strong. It’s about changing the way the world perceives that strength.” — GD Anderson

Kyla Gifford, HR & Payroll Specialist
“Every woman’s success should be an inspiration to another. We’re strongest when we cheer each other on.” — Serena Williams

K.D. Quintino, Sr. Manager, HR & Payroll
“I just love bossy women. I could be around them all day. To me, bossy is not a pejorative term at all. It means somebody’s passionate and engaged and ambitious and doesn’t mind leading.” — Amy Poehler

Jenner Benton, Regional Sales Manager
“In the midst of chaos, there is also opportunity.” — Sun Tzu

Jina Min, Director, Field Marketing & Events
“There is no limit to what we as women can accomplish.” — Michelle Obama

Colleen Baker, Sr. Manager Branding, Graphics, UX
“Women belong in all places where decisions are being made.” — Ruth Bader Ginsburg

Embracing Diversity and Inclusion

As we commemorate International Women’s Day, let us reaffirm our commitment to fostering a culture of diversity and inclusion in cybersecurity within our organization and across the community. By championing the voices and contributions of women, we not only enrich our industry but also pave the way for a more equitable and empowered future.

Together, we can inspire inclusion, celebrate diversity, and empower women to thrive in cybersecurity and beyond!

Open Banking Has Accelerated the Use of APIs – and the Need for API Security

The landscape of open banking is rapidly evolving, fueled in no small part by the EU’s Revised Payment Services Directive (PSD2) aimed at enhancing authentication and regulating third-party access to financial data. Yet, despite its noble intentions, the journey towards widespread adoption has been fraught with challenges, notably the proliferation of APIs and the resulting fragmentation in the market. As APIs have surged to the forefront, API security remains a top concern for financial organizations.

Recent statistics from the Open Banking Impact Report reveal a surge in open banking usage, with one in nine U.K. citizens now embracing the concept. However, while payment volumes have doubled, provider adoption hasn’t matched the pace anticipated. The European Commission’s report on the application and impact of PSD2 sheds light on this disparity, highlighting concerns over API variability and functionality.

The Role of APIs in Open Banking and PSD2 Compliance

APIs form the backbone of open banking, enabling secure access to backend data required by financial services. However, the report’s findings paint a disconcerting picture, citing significant discrepancies in API standards across banks. These inconsistencies hinder interoperability, forcing third-party providers to navigate a complex web of connections, thus impeding innovation and efficiency.

Moreover, the emergence of so-called “premium APIs” further complicates matters. Premium APIs are private APIs that banks can sell to their corporate customers and provide additional access to data beyond standard APIs. However, this threatens to create a two-tier system that undermines the standardization envisaged by PSD2, since premium APIs may not be regulated by PSD2. The absence of a unified API standard has led to concerns about unfair competition and data security.

Challenges of API Fragmentation and Security in Open Banking

While the concept of a global API standard garners support from a majority, qualitative interviews suggest apprehension among stakeholders. Some fear stifled innovation and commercial constraints, advocating instead for a more market-driven approach.

Nevertheless, the prevailing sentiment underscores the urgent need for regulatory intervention to address API sprawl and API security in order to restore confidence in the open banking ecosystem.

Incentivizing banks to invest in robust API infrastructure is paramount to fostering security and innovation. Current regulations lack sufficient incentives for banks, leading to suboptimal implementations and access restrictions. The imbalance in investment and access privileges underscores the necessity for regulatory reform and enforcement.

As European regulators contemplate the future of PSD2, stakeholders must brace for stricter regulations and heightened scrutiny. Addressing API sprawl and promoting standardized practices will be pivotal in realizing the full potential of open banking while safeguarding consumer interests.

While the journey towards open banking holds immense promise, it is imperative to address the challenges of API sprawl to ensure a secure, efficient, and inclusive financial ecosystem.

How to Address API Security in Open Banking: the Future

We’ve previously written about open banking and associated challenges with API security in the U.S. here. Regardless of what the future holds with open banking, it’s clear that a focus on API security is needed. Financial services organizations will need to know what APIs they have in use, ensure that those APIs are compliant with API specs and are clear of known vulnerabilities, and that they’re protected from attacks. The Cequence Unified API Protection platform is the only solution that unites discovery, compliance, and protection across all internal and external APIs to defend against attacks, targeted abuse, and fraud. Learn more and get started for free with an API security assessment.

What is App Instrumentation?

A simple Google search will reveal that app instrumentation is nothing more than embedding sensors within applications so their runtime behavior is observable. In the context of cybersecurity, this can help protect them from attacks. In actual fact, this “protection” is really “measuring” or “detecting”, i.e., sensing that an attack may be happening, then reporting that information back to some other system. Knowing that an application is being attacked is useful, no? In theory, this is useful, however one must understand how this instrumentation comes into being, and the associated costs levied for using it.

For the purposes of our discussion, we’ll talk about a fictitious organization that has a number of applications that they would like to protect from attack. Today, in light of digital transformation (or simplistically, moving to the cloud) these applications have become foundational elements to most organizations, providing an interface between the organization and its customers and partners. These applications drive revenue, affect brand reputation, and impact customer satisfaction. So to call them mission critical would not be an overstatement.

How are Applications Instrumented?

Given the importance of these applications, our example organization has sought out a cybersecurity vendor to help protect them from attack. This vendor uses a common technique that requires each application needing protection to be modified to install instrumentation. The process for implementing an app requires the app development team to individually modify each application, adding some code from the vendor that can detect attacks and provide some telemetry data about said attack. Most vendors offer JavaScript or a mobile SDK to facilitate this. Easy, right?

Instrumentation Implications

Let’s follow the process of instrumenting our application and talk through some of the downstream implications.

Development

The development team’s number one priority is creating needed features and functionality with the fewest code defects possible in a given timeframe. So, asking them to include someone else’s code in their application is seldom met with enthusiasm. And, even if they are willing to do so, this takes time, not only to add the code, but also time for a proper QA cycle. And time is something no development time has an abundance of. Last, every minute an application goes without protection is an additional minute that the organization is at risk.

For the purposes of our exploration today, let’s assume you manage to talk/coerce your dev team into spending the time needed to do this. Now you need to evaluate the performance hit that the application will suffer. After all, the application process is now burdened with the overhead of inspecting all inbound requests. Will your team perform some sort of before/after testing? The newly modified application is now doing some level of analysis and reporting back telemetry. There are CPU, memory, and perhaps storage impacts that must be considered.

Web application deployment is fairly straightforward, and once done, you’re able to begin collecting data. In the case of mobile applications however, once the app is modified, you’ll need to get your end users to update their devices with your new version.

Compliance

More and more organizations are taking a hard look at open source and third-party code. Does the third-party code we’re incorporating comply with our organizations API specifications and requirements? Is there a software bill of materials (SBOM) for the code so we can pass audit? Increasingly, enterprises want an SBOM for any third-party code they consume, as it is a key building block in software security and software supply chain risk management.

Performance

Will end users be able to perceive any performance change to your application? Under the best of circumstances, perhaps not. We know that as applications slow down, dissatisfaction goes up. The key thing to understand is that when an application comes under an automated attack, the application will slow down, as it now must process traffic volumes that are almost guaranteed to surpass its design envelope. It might crash, or the user interface might simply become unwieldy, causing the user to abandon what they were doing (like making a purchase). So now we have a dissatisfied customer, and potentially a tarnished brand.

Why make your application process bad traffic? Instrumenting an app leads to customer dissatisfaction as your app gets slower processing bad traffic.

Conversely, offloading bad traffic from an application that’s been suffering under the load typically improves its performance immediately.

Cost

Most cloud vendors charge for compute instances and storage (and you typically pay for all reserved compute and the entire storage volume, regardless of how much capacity you actually use). So, high volumes of bad traffic going to an application disproportionately consume CPU cycles and disk, directly increasing cloud costs.

What about the revenue loss that happens when application users become frustrated and fail to convert? Maybe they come back and try again later. Maybe they don’t.

Of course, we must also consider the outcomes of a successful bot attack. Are the attackers simply shutting down your e-commerce site, or have they stolen PII that, once discovered, will force your organization to provide credit monitoring services and suffer the subsequent brand damage hit.

Last, depending on the nature of the attack, there can be compliance and regulatory findings with financial implications. Fines are only going up, across industries.

Coverage

It’s obvious when you think about it, but even when you successfully modify your apps to achieve some level of protection, you’re only protecting the specific apps that you modify. None of your other apps will get any protection until you modify them as well. And, critically, you typically can’t modify your non-web or mobile apps that are purely leveraged through APIs. Many applications today are actually “faceless” back-office API applications.

Explore a No Instrumentation Approach with Cequence

It’s certainly easy for a vendor to say, “Just add our JavaScript to your app”, but that’s disingenuous. The implications of doing so run long and deep. There’s time, compliance, performance, cost, and coverage implications to consider when you instrument applications. Take advantage of Cequence’s expertise – and our no instrumentation approach – we’d love to talk with you in more detail about your specific situation. Or, let’s arrange a demo so you can see for yourself.

The web and mobile applications that your employees and customers use are glued together by application programming interfaces (APIs). The collaboration app on your phone “talks” to your collaboration system via APIs, allowing you to see who is online and message them. Your productivity, marketing automation, CRM, and project tracking apps are all API-based. As organizations expand their use of microservices and create new cloud-native applications, API usage continues to explode. In fact, every one of the over 142 billion app downloads are API-based. Gartner warns that by 2024, API abuses and related data breaches will nearly double.

APIs – Loved by Developers and Attackers Alike

In an analysis of 10s of billions (yes, with a ‘B’!) of application requests, researchers at Cequence Security have found that APIs are the #1 target for malicious use, further validated by some recent stats. Consider:

• 70% of app requests are via automated requests to APIs
• 53% of orgs are impacted by three or more API attacks per month
• We saw a 50% increase in bot attacks in the 2nd half of 2023 (in retail alone!)

Designed for machine-to-machine interaction, APIs are the tool of choice for developers because each API includes all necessary commands, payload, and data to produce engaging user interactions. And therein lies the risk, the widespread use and the all-inclusive nature of APIs introduces a range of security challenges:

• Unknown attack surface: Most organizations are unaware of how many shadow, hidden, deprecated, and third-party APIs they have, leaving many unprotected.
• New exploit opportunities: Developer errors, lack of best practices, or improper training can lead to vulnerabilities easily exploited by bad actors.
• Breaches and disruption from automated attacks: APIs enable high speed communication often to back-end systems making them prime targets for automated attacks and business logic abuse, even when perfectly coded.

Where WAFs and API Gateways Fall Short

With API security ranked as a top priority in 2023 for enterprises and security leaders worldwide, many organizations will look first at their existing web application firewalls and/or API gateways to protect their APIs. Despite their very real utility and legitimate use cases, here’s why their original design principles and feature sets make them an incomplete choice for providing proper API Security:

• Web application firewalls (WAF): Originally designed to address PCI section 6.6 requirements, WAFs use signatures to detect known vulnerabilities as described in the OWASP Web Application Top 10 Threats list. WAFs will struggle to find and block attacks that appear legitimate, and they are unable to address the visibility, inventory tracking, risk assessment, and threat prevention requirements necessary to protect APIs.
  Even when a WAF is used as an enforcement mechanism to block offending IP addresses, the reality is that most WAFs have very real limits as to how many IPs they can block. Typical bot attacks use of hundreds of thousands of unique IP addresses, and even the most robust WAFs cannot handle more than 10,000 IP addresses. Exceeding this limit can actually cause a WAF to catastrophically fail, leaving applications unprotected.
• API gateways: Designed to help organizations aggregate and manage APIs providing access control and basic security functions such as rate limiting and IP block lists. API gateways are reactive in nature, requiring developers to register the APIs to be managed. Often deployed within the infrastructure, at a department level, or in a cloud environment, API gateways are inadequate tools for gaining complete visibility, inventory tracking, risk assessment, common security policy enforcement, and the threat prevention necessary to protect APIs.
• WAFs and API gateways don’t get any of the context that API activity provides. They can’t understand business logic or how it might be abused, nor can they identify sensitive data being inappropriately shared or what security risk it represents.

While WAFs and API gateways do provide a level of protection, they were not designed to address the complete spectrum of API security requirements which includes discovering all your APIs, detecting the inherent risks, and defending against the associated threats.

Third-party mitigation tools that ingest attack information from other tools (such as API security tools that rely on passive analysis and are not able to natively mitigate issues) have latency between when the attack is identified and when that information is received by the third-party mitigation tool for blocking. By design, it’s a reactive approach and at least some of the attack traffic has already made it to the target application, which could result in a breach or poor performance by the application as it absorbs the attack.

Stronger API Security Posture with the Cequence Unified API Protection Solution

Made up of API Spyder, API Security, and Bot Management, the Cequence Unified API Protection (UAP) solution complements the security capabilities found in WAFs and API gateways with the most complete set of API security features available. It’s the only solution that unifies API discovery, compliance, and application protection with the following capabilities:

• Continuous API Discovery and Visibility: The UAP integrates with a broad range of infrastructure components, including API gateways, proxies, load balancers, and ingress controllers to deliver an end-to-end view into public-facing and internal APIs including shadow, third-party, and managed. Cequence is the only solution that allows you to choose between either an inline or an API-based integration model enabling you to either pull or push API metrics for ongoing risk assessment and threat analysis.
• API Risk Assessment: Pre-defined and custom risk assessment rules help development and security teams uncover sensitive data usage errors and authentication misconfigurations that can lead to governance violations and system compromise. A specification comparison uncovers APIs that fail to conform to published OpenAPI specifications. In addition, the UAP can automatically generate OpenAPI specifications for any existing APIs. Flexible alerting capabilities allow you to initiate update requests to the development team via Slack, PagerDuty, email, and other tools.
• API Threat Detection: The UAP uses an agentless approach that requires no app instrumentation or modification to detect and track automated attacks and business logic abuse on APIs, even as attackers re-tool to evade prevention efforts. Our patented ML-based analytics engine detects the most sophisticated API attacks using a threat repository comprised of billions of threat behaviors, malicious IP addresses, and third-party intelligence. Our CQ Prime threat research team continually curates the repository, translating relevant learnings into additional pre-defined rules that make their way into the Cequence products. Today, there are hundreds of such rules that deliver out-of-the box detection efficacy rates in the 98% accuracy range, enabling full protection to be achieved within 48 hours.
• Natively Mitigate Threats in Real Time: The Cequence Unified API Protection solution is the only solution on the market that natively mitigates attacks in real time, eliminating the delay and limited response options caused by reliance on third-party tools to take action. Response options include blocking, logging, rate limiting, header injection, and deception, a technique that allows you to mislead and deceive the bad actor into believing that their attacks have been successful.

Summary

Organizations are rapidly adopting an API-first development methodology because of the power, flexibility, and efficiency APIs deliver. The apps we use every day are all based on APIs, connecting back to compute resources located elsewhere — the cloud, the data center, or both. Unfortunately, threat actors love APIs for the same reasons that developers do. APIs are susceptible to a range of automated attacks and vulnerability exploits that can lead to data loss and system compromise. WAFs are important  – but to fully protect existing and future APIs, organizations need to implement a forward-looking API security solution that complements the capabilities found in WAFs and API gateways. Organizations need to implement an API security solution that unifies runtime API visibility, security risk monitoring, and patented behavioral fingerprinting technology to consistently detect and protect against ever-evolving online attacks.

Cequence Unified API ProtectionWeb Application FirewallsAPI GatewaysAPI Discovery & InventoryManaged API discoveryYesLimitedYesUnmanaged (shadow) API discoveryYesNoNoAPI usage analysisYesNoYesAssign/track API by ownerYesNoLimitedAPI Risk Assessment & CategorizationData governanceYesNoneNoneWeak/missing authenticationYesNoneNoneAPI specification conformanceYesNoneNoneCustom risk criteriaYesNoneNoneThreat DetectionThreat database of billion+ recordsYesNoNoVulnerabilitiesYesYesYesAutomated attacksYesLimitedLimitedBusiness logic abuseYesLimitedNoneMitigationNative, real-time responseYesYesYesBlock on IP addressYesYesYesBlock on Behavioral FingerprintYesNoNoResponse Options BlockYesYesYesLogYesYesYesRate limitYesYesYesHeader InjectionYesYesYesDeceptionYesNoNoAPI Development and Management API Design & Development for DevelopersNoNoYesAPI Management and GovernanceNoNoYesDeveloper PortalNoNoYesMonetizationNoNoYesWeb Application Protection Features DDoS ProtectionNoYesNoOWASP Web Top 10 Protection using customizable rules and threat signaturesNoYesNoContent-delivery Networks (CDNs)NoYesNo

Cequence Unified API Protection solution capabilities compared with WAFs and API gateways.

Understand Your Risk with Cequence

Get a free API security assessment and discover the APIs not being covered by your existing WAF or API gateway.

Every year around Valentine’s day, romance scams seem to rear their ugly heads. As more and more of our lives are online, it’s easier to meet people and get to know them without ever meeting in person. However, internet friendships and romances are also ripe for scammers and grifters looking to separate you from your money without regard to your feelings. And with the advent of AI, the thieves’ job just got a whole lot easier.

You may think that romance scams don’t affect a lot of people, or doesn’t net the scammers a lot of money, but when the heart gets involved, things can get out of control. In 2022, the FTC reported losses due to romance scams were upwards of $1.3 billion, with a median loss of $4,4001. Of course, that’s not to mention the pain and anguish caused by the deceit itself.

Some of these scams are 1 on 1 and manual for the attacker, but increasingly they’re automating their attacks to cast a wide net and catch as many unsuspecting victims, and their wallets, as possible. They’re leveraging publicly available web and mobile app APIs and using automated tools like bots, and with the advent of AI, they can reach even more potential victims with less effort. Through these tools and tactics, they can create fake accounts en masse as well as steal existing accounts through account takeover (ATO) attacks.

Cequence analyzed traffic and attack data across multiple customers in the dating and media vertical throughout 2023 that shows just how pervasive these attacks can be.

Are you looking for love, but also want to protect yourself? You can’t always be perfectly vigilant – everyone is a potential target for scammers – but there are some guidelines you can follow to reduce the likelihood of falling prey yourself.

Look for red flags:

	You never meet in person, but things are moving fast.		Slow down and try to authenticate their claims by searching for past activity online.
	They claim to work overseas or make repeated excuses for being unavailable to meet.		Search or ask others online if they are being told similar fabrications.
	You’re asked to send a gift or provide money to help them with a sudden ‘emergency.’		Stop. NEVER send money, gifts, or buy tickets on behalf of someone you’ve never met. It’s now time to consider filing a fraud report.

Dating app and website companies can also do their part to protect their users from scams. Cequence’s customers and their users are already protected – API Spartan, part of the Cequence Unified API Protection platform, detects API attacks and blocks them natively in real time. API Spartan protects organizations from the full range of bot attacks, including those often found in romance scams.

Here are the top five things to look for in a bot management solution to protect businesses against scams like fake account creation, account takeovers and more:

1. No Application Modification – Easy to deploy without agents, JavaScript, or SDKs.
2. Broad Use Case Coverage – Protects mobile apps, web applications, and cloud- and microservices-based infrastructure.
3. Rapid Time to Value – Effective immediately without requiring extensive configuration.
4. Retooling Resiliency – Sustains protection even as attackers change their methods.
5. Plays Well with Others – Works and integrates with your existing infrastructure.

Check out (and share!) our Valentine’s Day infographic.

Give us a try – get started with a free API security assessment of your public-facing APIs.

Free API Security Assessment

In the rapidly evolving landscape of cloud native infrastructure, APIs stand as crucial conduits, powering everything from online shopping to mobile applications. However, this increased connectivity introduces significant security risks, with APIs often operating without sufficient oversight. Many of the recent data breaches making headlines were due to APIs that were improperly secured.

As digital transformation is propelled by the shift towards cloud-native applications and microservices, the complexity and volume of APIs expand, exacerbating security challenges. This “Wild West” of APIs, difficult to track and secure, raises pressing questions for security leaders about the extent, risks, and current security status of their API landscapes.

Cequence Unified API Protection (UAP)

The Cequence Unified API Protection (UAP) platform enables organizations to answer the three most important questions about their APIs:

• How many APIs do I have and where are they in my infrastructure?
• What risks do they introduce?
• Am I protected from attacks on my applications and APIs?

The UAP platform is an ideal solution for defending cloud-native systems against attacks, targeted abuse, and fraud.

Protecting Your Digital Workloads on HPE GreenLake

Cequence and HPE have partnered to deliver unified API protection for HPE GreenLake customers, protecting their APIs as well as supporting Cequence deployment on HPE GreenLake Private Cloud Enterprise (PCE) instances. HPE GreenLake is a leading enterprise platform optimized for private cloud deployments in customer data centers which naturally rely heavily on APIs for inter-application communication. These APIs are often ephemeral, created and eliminated as needed. This can create a very large number of APIs in cloud-native environments that must be protected by a solution designed for massive scale.

Cequence is the first API security vendor on the HPE GreenLake Marketplace, and has been validated on HPE GreenLake PCE, and customers can rest assured that their APIs are protected throughout the complete API lifecycle.

Partnership Benefits

• Seamless deployment on HPE GreenLake infrastructure
• Continuous compliance monitoring and real-time attack mitigation of HPE GreenLake workloads
• Build secure applications on HPE GreenLake

The partnership between Cequence and HPE enables customers to take advantage of the power and flexibility of HPE GreenLake while ensuring their API infrastructure is protected throughout the API security lifecycle with Cequence Unified API Protection.

Interested in learning more? Check out the press release or schedule a call with our team to discuss your needs and how we can help.

Here at Cequence we have covered the ups and downs of API specs throughout the years. Discussions on what they are, who is (and regrettably isn’t) using them, and why they are important have been the subject of several blog posts on our site and around the web. We’ve discussed the OpenAPI Specification (OAS) and the different parts of the framework in the Cequence blog. Our goal is to demystify API specifications and help everyone get to a common understanding. These articles should help you understand the “what” of the OpenAPI specification. This isn’t the only format for API specification files, but it is the most widely used.

Common API Specification Terms

To complicate this topic slightly we also need to think about the three different terms that are used: API documentation, API specification, and API definition. The team over at Swagger has a great article about this topic that we’ll summarize here. API documentation is the reference manual for the API that is meant for people to read and understand how to work with the API. API specifications are written to explain to humans how the API functions and what specific output to expect. API definitions are machine-consumable and explain how the API functions and what to expect out of it in machine-readable format. Specification and definition are the two terms most likely to be used interchangeably, even though they are meant for different audiences. The most important thing to remember is that each of them is meant to help humans and machines understand how to use the API and what its functions are supposed to be.

Who Are API Specifications For?

As we move to the “who” of API specifications, it is generally thought that development teams and software engineers are the most likely groups that will need them, and you’d be correct. However, as APIs continue to be used more and more, teams like information security and security operations also need to know what is happening with their organization’s applications. Protecting sensitive data from leaking via an API is difficult if the teams aren’t sure where that sensitive data is in the application.

Why Do You Need API Specifications?

By some accounts, up to 64% of organizations do not have total coverage of their applications documented in a specification, which can leave organizations with major hurdles. In the 2023 Postman State of the API Report, development teams listed the lack of specifications as one of the obstacles to consuming APIs. 52% of respondents said lack of documentation was the biggest problem. Other top barriers included difficulty discovering APIs (32%). This shows that there is still an acute need for development teams but is even worse for security teams who may not have access to the documentation at all.

These statistics should make it much easier to understand the “why” of API specifications. In a blog post last year we discussed ten must-have things for an API security solution and specifications ranked number four on that list. Having a specification will help validate runtime behavior of the API and shine a bright light on the shadow APIs that we all hear about. When thinking about shadow APIs, how would a security analyst even know it was shadow if they don’t have a specification to tell them what the API is supposed to do in the first place? The difficulty stems from an age-old problem for development teams where the documentation is usually the last step in the process and the easiest to skip when time runs out. Some teams are moving to a schema-first approach to API development to shortcut the issues with lack of documentation. What are security teams to do when that isn’t the case for their organization? documentation is usually the last step in the process and the easiest to skip when time runs out. Some teams are moving to a schema-first approach to API development to short cut the issues with lack of documentation. What are security teams to do when that isn’t the case for their organization?

Cequence API Sentinel: An API Specification Compliance Solution

With Cequence API Sentinel, security can begin to solve that lack of documentation problem by taking the first step and creating their own API specification files from runtime traffic. As you’ll see below, I’ll take us from discovered data to full specification with accompanying API definition right from the console. Discovered APIs can be used to create an OAS 3.0 structured API Definition. Once generated this API Definition will be available under Applications: API Definitions to view, download, and update.

In the API Sentinel dashboard, we start with the Discovered endpoints in the inventory dashboard.

The inventory dashboard is where we will see all of the applications observed by the platform. The discovered section is the place where all transactions not identified by an API specification are located.

The next step is to open the filter panel and make sure that you have traffic for the endpoints that are being discovered.

API Sentinel uses runtime traffic to help us build out the API specification in the design wizard.

Now when we drill into the discovered applications, we will see the paths to the endpoints of interest. I want to build a spec for the books application, so I’ll select it and click on the Generate API Definition button.

There is a lot of data here that can be interesting to an analyst but for now we want to make sure that we know what this API is doing and document what we are seeing.

Now that we have the generation wizard running, we are going to fill in the spec details. If you know the service name, application owner, and host details you can fill them in here. The wizard will grab as much as possible during generation. If not, the SOC can start by using their own information. The only required field is Name.

This was for the book API so that is the name that I used.

The next step is to lock in the API path. There were four endpoints found in discovered here but not all four are a part of the books application. I fill in the Base path and then click the Lock Base path option.

Once that lock is set you’ll see that the last endpoint is now excluded.

The next step in the process is to set the type of authentication the platform should expect to see. There are three types supported in the wizard today, http, apiKey, oauth2. If there were authentication events observed in the traffic those would be listed here. If they aren’t or if you aren’t sure you can leave this section blank and continue.

An important note here: lack of authentication is a hit on OWASP top ten as API2. API Sentinel will help teams discover and find these unauthenticated endpoints.

Moving on to the next step in the wizard allows you to set any paths or parameters for the application.

Like in other sections, the wizard will set types and other items that have been observed. When you don’t have the details for the full application, this section can be skipped as well.

Finally, we get a preview of the spec that will be consumed in API Sentinel as a definition. We are also given the opportunity to add this to an existing group of definition files for our other applications. In this case, the books application is a standalone API and I can finish by clicking the Add button.

With that completed the books application will now move from discovered to published and if there are any changes in the future, I’ll be able to catch those pesky shadow APIs and act accordingly.

Want to Learn More?

Get started easily with a free API Security Assessment from Cequence. It’s easy, and there’s no obligation.

Free API Security Assessment

API security continues to elevate in terms of awareness and importance in both government and commercial sectors. Organizations need to ensure that their APIs are secure, protected from attacks, abuse, fraud, and data losses. With a multitude of vendors offering products under the umbrella of API security it can be confusing for organizations trying to determine which is represents the best fit for them. Where does one start?

Cequence firmly believes that all aspects of API security must be accounted for – broadly articulated as API discovery, compliance, and protection. You can’t protect what you cannot see, so visibility is a requirement for assessing risk. Knowing which APIs fail to comply with internal standards and industry best practices is key. And of course, not only detecting threats but actively mitigating them at scale is crucial. KuppingerCole’s recently published assessment of the Cequence Security Unified API Protection solution notes:

“Providing comprehensive protection against the broad range of API-specific threats and doing it consistently throughout the whole lifecycle of an API is complex and requires a comprehensive, platform approach, with multiple security solutions operating in a tightly integrated manner that makes them more than just the sum of individual components.”
— Alexei Balaganski, KuppingerCole

The word “platform” gets used, even overused, by vendors describing their offering. Cequence firmly believes that the word matters. Products that are merely sold together do not constitute a platform. There must be a 1 + 1 = 3 aspect. Together, the products must deliver more than they do on their own, and the Cequence Unified API Protection (UAP) platform does exactly that, sharing API inventory between solutions, with common policies, rules, filters, and risk indicators. Of course, this is delivered within a consistent user interface, resulting in rapid time to value when adding additional modules.

“Although Cequence Security has offered a substantial portfolio of API security products before, transitioning from the product suite towards the platform approach signifies the company’s ability to offer an integrated solution for security risks and challenges of protecting APIs at every phase of their lifecycle.”
— Alexei Balaganski, KuppingerCole

The report highlights the strengths of Cequence Security’s UAP platform, including API attack surface discovery, automated API inventory, real-time risk assessment, generative AI, NLP-based capabilities, threat detection, and inline blocking.

About KuppingerCole

KuppingerCole, founded in 2004, is a global industry analyst firm specializing in identity and access management, governance, fraud, risk and cybersecurity. This year’s KuppingerCole Leadership Compass evaluated 20 API security and management solutions to help security and development leaders identify and select solutions that will have the greatest impact on their cybersecurity programs.

As business infrastructure grows, it necessarily becomes more diverse and heterogeneous. Relatively simple on-premises environments have exploded into an ever-growing range of applications and architectures including cloud, hybrid, multi-cloud, monolithic, microservices, and serverless. The need to innovate and provide exceptional customer experiences in fields such as ecommerce, Big Data, IoT, AI, and cloud computing is driving the adoption of these dynamic environments. APIs are essential infrastructure connectors across these environments.

Typical Enterprise Infrastructures

Most modern large enterprise application architectures include some or all of the following types of infrastructures:

1. Monolithic Architectures: Traditional and unified, where an application is developed as a single unit.
2. Microservices Architectures: Autonomous, loosely coupled services can be deployed independently. It prioritizes business capabilities and allows for quick, reliable, and sustainable application delivery.
3. Serverless Architectures: Backend services are provided based on usage, eliminating the need for fixed server management, often available on cloud computing platforms.
4. Legacy Applications: Outdated yet crucial systems integral to the business.

Today’s Enterprises Embrace Heterogeneous Infrastructure

Heterogeneous infrastructure environments represent a fusion of various technology stacks, including both legacy, traditional, and modern software applications. Enterprises gravitate towards such environments for several reasons:

• Utilization of the best tools for specific needs
• Enhanced agility and speed in product development
• Prioritizing security, cost, and performance
• Attracting and retaining technical talent in a competitive market

Inherent API Security Challenges

Embracing the benefits of system diversity options also brings significant challenges, particularly in API security. The complex nature of these environments requires meticulous management and heightened coordination across functional teams. Securing the numerous APIs exposed by these varied systems has traditionally required adopting multiple vendor solutions and integrations to ensure full API security coverage.

A Unified API Protection Platform for Heterogeneous Environments

The Cequence Unified API Protection (UAP) platform is ideal for heterogeneous infrastructures, offering API protection across varied applications and architectures without the need for integrations or instrumentation with existing applications as required by other products.

Cequence UAP provides robust API security regardless of the application architecture, be it monolithic, microservices, serverless, or legacy applications. The infrastructure-agnostic nature of the platform proves vital in heterogenous environments, where a one-size-fits-all approach is a hinderance to business growth. Cequence UAP simplifies security operations by eliminating the need for multiple API security tools or complex API security deployments, significantly reducing the risk of inconsistent security implementations.

Cequence UAP Deployment Advantages

The Cequence Unified API Protection platform offers a range of deployment advantages, each catering to the diverse needs of modern enterprises:

• Rapid and Uniform Integration: Cequence simplifies deployment by using an inline proxy as its data plane component. This allows for native threat mitigation and ensures seamless and uniform integration across systems. It eliminates the need for code-specific server-side or client-side agents commonly found in products requiring JavaScript or mobile SDKs. It eliminates the need for code-specific server-side or client-side agents or JavaScript or mobile SDKs commonly found in competing products. This approach streamlines deployment, minimizing the impact on system architecture and freeing development teams from additional quality assurance and implementation burdens.
• Flexible Deployment: Cequence offers a wide range of deployment options, providing both active protection with inline threat mitigation and passive monitoring capabilities. It provides integration options with CDN edge workers, API Gateway modules, and microservices sidecars as an alternative to the platform’s in-line proxy deployment for its data plane.
• SaaS and self-hosted options: Whether you prefer SaaS or on-premises (self-hosted) deployment, Cequence caters to both, providing protection for APIs across SaaS, data centers, cloud, hybrid setups, legacy applications, and modern architectures. This deployment flexibility accommodates the most demanding compliance and business requirements.
• Centralized management: Implementing Cequence enables organizations to avoid the complexity of managing multiple point products by different vendors. The Cequence UAP platform offers centralized management and policy enforcement across all protected APIs, simplifying the API security landscape in diverse environments and ensures seamless scalability in line with the growth of an organization’s API ecosystems.

Free API Security Assessment

See what attackers see with a free API Security Assessment from Cequence. It’s easy to get started, and there’s no obligation.

Free API Security Assessment

As we bid farewell to an eventful year, we are excited to recap the strides we’ve made in enhancing our products to further strengthen your API security. In 2023, we’ve focused on the key themes that directly impact you:

• Usability Improvements and Eliminating Friction: Your experience with our products matters, and we’ve dedicated efforts to make them more user-friendly and streamlined.
• Product Innovation: We’re thrilled to introduce cutting-edge features, including the new API Security Testing module and the integration of Generative AI capabilities.
• Operational Efficiency: Our commitment to operational excellence led to the release of many new capabilities, including Zero-code Security Automation with integrations to hundreds of third-party apps, improved dashboard functionality, and advanced threat detection powered by programmable pivots.

Notably, our emphasis on integrations has expanded our capabilities, offering passive integrations for leading API gateways, CDNs, service meshes, and proxies. We also became the first API Security vendor to launch our offering on the HPE GreenLake Marketplace.

These advancements have been made possible by your invaluable feedback. Thank you for entrusting us with your security needs – we look forward to continued innovation and collaboration in the coming year.

What’s New:

API Spyder

• Improved operational efficiency of security teams with customizable discovery and classification algorithms that offer enhanced API discovery control.
• Usability improvements track discovery information across hundreds or even thousands of domains owned by an organization with out-of-the-box reporting.

API Sentinel

• The new API Sentinel Security Testing module allows security and app-dev teams to instantly test their pre-production APIs using the sample risk criteria and compliance rules evaluated for their production APIs.
• Significant summary dashboard usability improvements and out-of-the-box report generation, providing organizations instant visibility across their API inventory.
• Improved operational efficiency of security and app-dev teams with addition of alerting to third-party apps like Jira and Slack and the ability to create test plans in minutes, customize them, and run them without depending on developer toolchains.

API Spartan (formerly known as Bot Defense)

• New Fraud Prevention module enables organizations to detect and stop online fraud targeting their APIs.
• Improved SOC teams’ operational efficiency with enhanced threat protection capabilities that automatically update policies based on dynamically learnt criteria and attack confidence scores.

With these enhancements, Cequence has established itself as the market leader in API security, uniquely enabling organizations to discover their entire API attack surface, inventory all external and internal APIs, and natively mitigate the threats and attacks targeting their APIs.

Looking forward, we’re well into our partnership with the Microsoft Copilot team that was announced in November, 2023. Cequence is the first and only vendor creating an API security-specific plugin for Copilot. This is super exciting, this plugin will supplement Microsoft’s global threat intelligence comprising 65 trillion daily signals with Cequence’s unique API security threat intelligence, enabling customers to investigate and remediate API security incidents much faster.

Last week’s announcement brought the exciting news that Cequence was recognized in the prestigious 2024 Best Places to Work Awards by Built In. This recognition underscores our unwavering commitment to building a workplace culture that esteems innovation, collaboration, and the well-being of our remarkable team.

Acknowledging Cequence’s exceptional workplace environment, employee satisfaction, and dedication to creating a positive and inclusive atmosphere, Built In—a leading technology recruitment platform—reinforces our ongoing efforts to provide an environment where every team member feels valued and empowered.

What Makes Cequence a Best Place to Work?

• LIFFT Culture Champions Collaboration, Innovation, and Customer-Centric Management:
  • Our culture focuses on five key values: Lead with speed, Innovation, Fearless execution, Focus on customers, and Teamwork.
• Team Contribution is Encouraged at All Levels:
  • We foster a culture of teamwork where every team member is encouraged to contribute, regardless of their role or title.
  • Our “Win Together, Learn Together” philosophy emphasizes collective success.
• Customer Obsession Sets Us Apart:
  • Cequence’s unwavering commitment to customer obsession distinguishes us.
  • We prioritize helping clients succeed and collaborate passionately with all employees.
• Distinctive Presence in Cybersecurity Landscape:
  • Our emphasis on collective success and shared dedication to customer satisfaction sets Cequence apart in the competitive cybersecurity landscape.
  • Our commitment to staying at the forefront of API security advancements ensures a secure digital environment for our customers.
• People-Centric Focus Recognizes Contributions:
  • We celebrate employees at all levels for their contributions, whether big or small.
  • Expertise matters more than physical location.
• Flexible Work Environment Encourages Productivity:
  • Cequence embraces flexible and inclusive work environments
  • Team members are encouraged to work where they feel most productive.
• Life-Work Balance is a Priority:
  • We value life-work balance, recognizing the importance of family, friends, volunteering, and personal time off.
  • Maintaining a healthy lifestyle for all team members is a priority.

What Employees Are Saying:

Linda
Vice President, Revenue Marketing
“It’s not just the amazing product that brought me here, it’s the people. I have countless stories to tell candidates when they interview about how much our leadership team cares. It starts from the top and this is seen across the company.”

Lucas
Security Engineer
“At Cequence, we cherish a culture that values not just hard work, but the importance of a healthy work-life balance. We encourage each other to prioritize their families and personal well-being, creating an environment where we work hard, play hard, and live a fulfilling life outside the office. Personally, I never hesitate to attend my son’s appointments or take a well-deserved day off, knowing that our dedicated team supports each other, ensuring nothing is missed. It’s more than a job; it’s a commitment to a balanced and rewarding life.”

Lorena
Director, Field Marketing
“Embarking on this journey with Cequence Security has been nothing short of incredible. Each day is an opportunity to learn and grow, surrounded by peers who inspire me to evolve as a marketer. Beyond being part of an extraordinary family of brilliant individuals, Cequence fosters a work environment that values a harmonious balance between professional and personal life. The contagious passion and motivation within the team make it nearly impossible not to be driven to give my best.”

Jenna
Executive Assistant
“I am incredibly grateful to have the opportunity to work with such a fantastic company with amazing coworkers and inspiring leaders. The leaders are not only knowledgeable, experienced, and transparent, but they are also approachable and fun to be around. I am thankful to work at a place where my opinions are heard, and professional growth is highly encouraged. I truly enjoy waking up every day and seeing what the new day will bring.”

Jeff
Director, Product Marketing
“One of the things I appreciate about Cequence is the transparency we get from executive leadership. We’re all a team, and we work together that way. When decisions are made, the reasoning is explained and shared so we’re all on the same page. It’s refreshing.”

We are honored to be recognized by Built In in the 2024 Best Places to Work Awards. This achievement reflects the dedication and hard work of our team members who contribute to making Cequence a remarkable workplace. As we celebrate this accomplishment, we remain committed to creating an environment where talent thrives, innovation flourishes, and each team member is proud to be part of Cequence. Thank you to our incredible team for making this recognition possible!

APIs have become integral to modern software architecture, and the digital economy has exponentially increased API adoption. However, with the rise of APIs, there has been a corresponding rise in API security risks. Capturing today’s headlines are API-origin data breaches that have compromised tens of millions of sensitive customer records. This dramatic increase in API-based attacks has caught the attention of regulators and standards bodies alike, giving way to various regulations and standards to ensure that APIs are secure and sensitive data is protected. This blog is a quick reference to catch up on the current API security regulations and standards. To allow each to maintain their respective level of importance, I cover them alphabetically.

CFPB Personal Financial Data Rights Rule (Proposed)

The Consumer Financial Protection Bureau (CFPB) proposed a rule in October 2023 that would accelerate a shift toward open banking, in which consumers would have control over data about their financial lives and would gain new protections against companies misusing their data. The proposed rule requires establishing and maintaining interfaces to receive and respond to requests for covered data. Screen-scraping is no longer an accepted method; APIs have replaced it. The shift to APIs requires conformity with security specifications, including access credentials, following information security specifications in section 501 of the Gramm-Leach-Bliley Act. Organizations covered by CFPB must ensure that data security practices are adequate to safeguard covered data. API security practices and solutions are key to complying with CFPB. Without a crystal ball, one cannot know when the rule will take effect; however, covered entities should not wait and begin securing their APIs now.

European Payment Services Directive (PSD2)

PSD2 mandates banks to share customer financial data with authorized third-party providers (TPPs) through secure APIs. Entered into force on January 12, 2016, this directive is one of the earliest to call attention to the need for API security. PSD2 is supplemented by regulatory technical standards on strong customer authentication and common and secure open standards of communication, as well as guidelines on incident reporting and security measures for operational and security risks. Beginning September 14, 2019, payment service providers must legally comply. I expect API security to have increased emphasis within PSD2 based on its 2023 evaluation report, wherein adoption has only partly been realized owing to fragmentation in the quality of application programming interfaces (APIs) and deficits in data sharing. European regulators will want to turn this around.

Federal Financial Institutions Examination Council (FFIEC)

In June 2021, the FFIEC issued the Architecture, Infrastructure, and Operations booklet, part of the series of booklets comprising its Information Technology Examination Handbook (IT Handbook). Within this booklet, the FFIEC addresses how covered entities should protect APIs, including authorization, authentication, and encryption of private, public, and third-party APIs. The booklet calls out that security needs for APIs should be assessed and implemented to mitigate risks of exposing sensitive customer or entity information, referencing the guidance provided by the OWASP API Security Project.

In August 2021, the FFIEC issued additional API protection directions within the Authentication and Access to Financial Institutions Services and Systems guidance. This guidance identifies the inventorying of APIs, effective mitigating controls for credential and API-based authentication, and secure management of API passwords.

National Institute of Standards and Technology (NIST) Special Publication 800-204

NIST SP 800-204, Security Strategies for Microservices-based Application Systems, is an analysis of multiple implementation options available for core features and configuration options in architectural frameworks, development of security strategies that counter threats specific to microservices, and enhancement of the overall security profile of the microservices-based application. This publication goes into depth about core API protection practices. Its importance is underpinned by many regulations referencing NIST as an accepted security baseline to comply with rules and regulations.

ISO/TS 23029:2020 Web-Service-Based Application Programming Interface (WAPI) in the Financial Services Standard

This standard, published in February 2020, defines the framework, function, and protocols for an API ecosystem that enables online synchronized interaction. Specifically, the document defines a logical and technical layered approach for developing APIs, including transformational rules. It outlines security, identity, and registration considerations relevant to an API ecosystem. Specific technical solutions are not defined, but they are referenced in the context of specific scenarios for guidance purposes. Like NIST, ISO standards are commonly called out in rules and regulations to achieve compliance.

OWASP API Security Project

Inaugurated in 2019, the OWASP API Security Project is an initiative by the OWASP Foundation to provide software developers and security assessors with strategies and solutions to understand and mitigate APIs’ unique vulnerabilities and security risks. The latest version of the OWASP API Security Top 10 in 2023 highlights APIs’ top 10 security risks that organizations should mitigate to protect APIs from cyberattacks. This new release added five new risks covering broken object properties, unrestricted resource consumption, server-side request forgery, lack of protection from automated threats, and unsafe consumption of APIs. OWASP has become a de facto standard for protecting APIs and is referenced by many rules and regulations.

Payment Card Industry Data Security Standard (PCI DSS)

Released in March 2022, PCI DSS version 4.0 explicitly includes considerations for API security within its standard. An API would come into the PCI DSS scope for any organization hosting an API interface to receive or transmit cardholder account data. Requirement 6.4.2 of PCI DSS standard version 4 calls for the continuous detection and prevention of web-based attacks. The solution should include an automated technical solution to protect public-facing web applications, including APIs. Requirement 6.3.2 calls for the security of bespoke software, including libraries and APIs.

U.S. Treasury Department API Guidance

In July 2018, The U.S. Treasury Department issued a report addressing the core principles outlined in Executive Order 13772, published in February 2017. Of particular importance is for financial entities to move away from screen-scraping to more secure access methods to reduce cybersecurity and fraud risks that can occur when consumers provide login credentials to access fintech applications. The report calls out the need to transition to an API method of instantaneously and safely transferring data.

Final Thoughts

Plenty of motivation exists to protect APIs; however, regulators and standards bodies have upped the motivation. Regulations and standards go hand in hand. Referencing an authoritative standard is a sound practice to ensure compliance with a regulation. I don’t expect the light to stop shining on APIs, as 2024 will likely bring more regulatory scrutiny around API use and security. When evaluating API security solutions, Cequence Security should be on your short list of vendors. They offer a free API security assessment to help you get started. Contact me here to share your thoughts on API security rules and regulations. If you want to keep up with my blogs on related IT security issues, go here.

Looking forward to 2024, we can confidently make some predictions based on our ongoing analysis of API attacks and the behavioral changes we are seeing as attackers refine their strategies. One thing we can be sure of – as organizations continue to increase their reliance on APIs to share data between applications, cybercriminals will continue to attack those APIs, and API security will continue to be a leading focus for security and IT teams.

New & Improved Data-Sharing Regulations

Consumer-centric industries, including finance, retail, and healthcare, will face increased scrutiny and regulation over their data-sharing practices. As the once nascent consumer protection rules mature, agencies and watchdogs will put into place more detailed requirements as well as penalties for non-compliance. Earlier this year, the Consumer Financial Protection Bureau (CFPB) published a new rule that reshapes data handling practices in the financial sector including API security, and we’re expecting others in 2024 in relevant industries.

Generative AI: More Controls, and Secure Data Sharing

Now that generative AI has hit the mainstream, organizations are thinking about how to utilize AI to increase efficiency. With those thoughts come fears about sharing data with large generative AI platforms such as ChatGPT. Looking forward to 2024, we expect to see organizations and vendors build contextual large language models (LLMs) on smaller, focused datasets. However, there are also situations where data sharing as it pertains to AI is in the organization’s interest. Organizations need to be comfortable sharing data with AI engines to make the most of them, and we’re expecting great strides to be made in 2024.

CISO -> CR(isk)O

The role of the chief information security officer (CISO) is making a significant transition, evolving beyond a strictly technical role into a more comprehensive business role, speaking the language of risk to boards, leadership teams, and investors. One can envision the role evolving into something akin to a chief risk officer (CRO). Cyber risk continues to broaden and expand throughout the business, there’s a need for a role that takes a broader role in shaping company strategy. Success in the role will require a broad skillset with an understanding of both the business side and the technical side, as well as governance, risk, and compliance (GRC).

In 2024, newly minted Chief Risk Officers will actively participate in the company’s overall business strategy, providing valuable insights on risk mitigation and cybersecurity implications. The executive team and board of directors will lean on them and their expertise to guide them through the evolving cybersecurity landscape and ensure that the company, its assets, and its customers are protected.

Shadow APIs will Continue to be an API Security Focus

The number of unique API security threats seen in 2023 by Cequence’s CQ Prime Threat Research team has already exceeded that of last year, and we can expect that trend to continue in 2024. The combination of persistent attackers and the proliferation of insecure and undocumented APIs all but ensures an increase in threats. Now more than ever it’s critical for organizations to know how many APIs they have, where they are, ensure they’re compliant and secured, and be able to identify and block attacks as they happen.

Threat Actors will Play the Long Game in 2024

Over the past few years, we’ve seen an increase in persistent threats with threat actors adopting a more protracted “long game” strategy. Instead of deploying flashy, high-impact attacks, these actors will increasingly target organizations with subtle, low-and-slow tactics that gradually infiltrate systems and steal valuable data, often incorporating pubic-facing APIs into their attack plan. These attacks are designed to build trust and credibility over time and necessitate increased vigilance and focus on API security throughout the year.

Ringing In the New Year

As dynamic as the last several years have been, we’re still expecting a lot of changes in API security and the API landscape in 2024. Organizations can prepare themselves by ensuring that they’re on top of their APIs and have the right technology, process, and procedures in place to protect them. The Cequence Unified API Protection platform helps organizations manage all facets of the API security lifecycle – get a free API security assessment today and be ready for what comes next in 2024.

Retail cybercriminals have graduated from relatively quick, unsophisticated smash and grab-style attacks to playing the long game, spreading attacks out over the course of the year in preparation for a holiday season bonanza. This shift in tactics has come to light in the latest threat intelligence research from the Cequence CQ Prime Threat Research team in their 2023 Holiday Season API Security Report.

Over the years, Black Friday has become more than just a day – many “Black Friday”-type deals start at the beginning of November and run throughout the month including Small Business Saturday, Cyber Monday, and eBay’s Green Monday. Attackers have gone even farther, with the data showing that in some cases they prep all year long for a holiday season that ecommerce has come to dominate.

About the Data

What sets Cequence’s reports apart is that they are derived from anonymized, real-world attack data against customer production environments. This data is part of the Cequence API threat intelligence database, the largest such database in the world. The CQ Prime team uses this data combined with machine learning (ML) and threat prediction workflows to detect and mitigate API security threats for the world’s most attacked organizations comprising Fortune and Global 2000 companies.

With that, let’s dig into some of the report findings. You can download the entire report for free here.

The State of Threats and Bot Management Today

The data below are based on six months of anonymized traffic across all Cequence customers from June through November 2023.

• Malicious traffic came from 719 million unique IP addresses.
• Of 154 billion requests, 22 billion (14%) were automated (bot) requests and 19 billion (12%) were confirmed malicious requests. While these percentages may seem low compared to some seen in the news, they are predicated on the scope of traffic the numbers are sampled from. Cequence typically processes all API traffic for its customers, so the breadth of traffic is much larger than products that only examine login traffic to a particular instrumented web app, for example.
• The highest number of blocked requests in a single day was 216 million.
• There were 325 million malicious login or Account Takeover (ATO) attempts. ATOs remain one of the main tactics for adversaries, increasing more than 50% from the previous six-month period.
• More than 148 million different browser types (user agents) were observed. A relatively small percentage can be accounted for by operating system, device, and browser combinations – the overwhelming majority of the number represents attackers generating massive numbers of unique browser user agents as part of their schemes, which gives you an idea of the massive scale of attacks that today’s businesses are facing.

Pre-Holiday Cyber Assault: Attackers Lay Groundwork Ahead of Retailers’ Security Lockdown

The first threat analysis focuses on large consumer home and body product retailers. Gift card fraud is standard operating procedure for these types of companies – attackers use botnets to test large volumes of card and PIN numbers in hopes of finding a successful pair from which they can drain the card of funds. These types of attacks are fairly consistent throughout the year.

In 2023, Cequence noticed that other types of attacks came through at high volume starting early in the year. Since retailers are well known to lock down their networks during the holiday season as well as the fact that “Black Friday” can comprise a month’s worth of promotions for some retailers, the data suggest that attackers are laying the groundwork for their holiday attacks well in advance of the holidays.

In the second half of the year, these companies noticed several types of attacks unrelated to gift card fraud happening in unison, as shown in the graph. While gift card fraud grew by 110% in the second half of the time period, scraping, loyalty card and payment card fraud increased by a collective average of over 700%. These types of attacks are correlated and spiked together because those parts of the website, applications, and associated APIs are related, especially as they pertain to attacks.

Bot Barrage: Combatting the Surge of Automated Line-Jumpers in High-Demand Retail Drops

You’ve probably read the stories about Taylor Swift tickets selling out instantly, or maybe you’re a sneakerhead trying to get the latest retro Jordans. You’ve probably run into bots trying to “jump the line” one way or the other, because it’s become a big problem for retailers that run flash sales or hype sales.

During these types of sales campaigns, attackers commonly use automated tooling to add large numbers of sneakers or other products to their cart in order to try and purchase as many in-demand items – either on sale or of limited availability – as possible. If successful, these bad actors can effectively corner the market and preventing sales to legitimate customers, and then sell these items elsewhere at a high markup.

Cequence’s data shows that large numbers of products were added to carts, but few comparative purchases as the fraudsters were identified and prevented from purchasing. Add-to-cart spikes are correlated with product launches, as attackers attempt to monopolize limited-availability items.

Playing the Long Game: The Rising Threat of Trust-Building Account Takeovers

“Social commerce” retailers combine ecommerce with social media, leveraging user contributions to build community. Most online retailers encounter account takeover (ATO) attacks that peak during the holidays. ATO is an attack on legitimate existing online customer accounts, where criminals take ownership of the accounts for their own nefarious purposes. This year, Cequence noticed its social commerce companies encountering a different type of attack well before the holiday season began.

In this example, attackers attempted to create high volumes of valid accounts via standard APIs earlier in the year, hoping to use the time to build trust and cred in the market to increase social sharing and extend their reach, increasing the visibility of the products they’re selling over others’. The attacker’s automated tools enable them to create accounts and generate likes and subscribes to increase influence – but much faster and at a larger scale than legitimate humans could, crowding out the sales of legitimate users.

Fraudulent account creation attempts declined nearing the holidays, while basic account takeover tactics rose. While fraudulent account creation dropped 72% from the first half to the second half of the time period, account takeovers (ATOs) increased a staggering 410 times! This is due to the attacker changing tactics to those that require less runway and planning, like ATOs.

Cequence Customers Enjoyed a Smooth Black Friday

This Black Friday, Cequence customers were largely unaffected by bot attacks thanks to their ongoing efforts as well as Cequence innovations across engineering, customer success, and the CQ Prime Threat Research team. In fact, Cequence customers submitted the total fewest support tickets during the month of Black Friday (November) compared to the rest of the year, and tickets were 70% lower than last year.

Wrapping Up 🎁

2023 reminded us that attacks are constantly evolving, with new tactics and techniques designed to evade improving defenses. To protect against API threats like these, organizations need to adopt a comprehensive approach to their API security. They must discover and inventory all their APIs, ensure they’re in compliance with API specifications, and then identify and block attacks as they happen. Cequence can be your partner throughout the API security lifecycle and help protect your organization from existing and emerging threats.

1. Read the full report
2. Check out the press release
3. Get a free API security assessment

Many API security vendors claim to have products that detect and block API attacks. Like many security product categories, a bit of investigation is warranted when reviewing such claims. For example, many of these vendors offer some level of automated bot attack detection but cannot natively block these attacks. They instead rely on other infrastructure like content delivery networks (CDNs) or Web Application Firewalls (WAFs) to mitigate such attacks.

The problem with using CDNs or WAFs to block automated attacks is not that these products are bad. The problem is that this is not the purpose for which they were designed. First, most automated attacks result in hundreds of thousands if not millions of IP addresses being blocked, a load having the potential to cripple or even crash a WAF. Of course, when attackers see their attack being blocked, they re-tool, often shifting to a different batch of IP addresses. This constant influx of additional IPs to block often overwhelms systems not designed for this. Second, the number of WAF rules needed to block based on IP or other expressions will slow down the WAF since it was not designed to handle this use case. Last, the WAF becomes hard to manage. If there are false positives, imagine screening through those lists to remove a handful of IP addresses that belong to legitimate users, akin to finding needles within a massive haystack.

How to Tell Real Blocking From a Hand-Off

A quick way to tell the two apart: ask what happens the moment a vendor’s system decides traffic is malicious. If the answer involves exporting an IP list, updating a WAF rule set, or waiting on a CDN policy push, that’s just detection with someone else’s infrastructure doing the enforcement. If the answer is that the request never reaches the origin in the first place, that’s native blocking. The distinction matters most under load, when attackers are actively cycling through address space and a slow hand-off turns into a widening window of exposure instead of a problem that gets solved once.

Why Cequence Blocks Attacks Natively

Cequence has been detecting and blocking automated bot attacks against APIs, web, and mobile applications for more than 7 years at some of the world’s largest Fortune and Global 500 companies. With this on-going experience and the data analysis that comes with it, we know how attackers typically re-tool in response to blocks and use that knowledge to combat current attacks as well as downstream escalations.

I’d be remiss in not mentioning that while Cequence got its start in bot management, we have capabilities across the entire API protection lifecycle – from discovery to testing to detection and response. Our solutions as a whole comprise the Cequence Unified API Protection (UAP) platform, delivering far more value and protection than bot management alone.

Several things set the Cequence Unified API Protection solution apart from other vendors.

• First, we accurately detect API attacks with an extremely low false positive rate. Our threat detection engine, CQAI, analyzes behavioral intent across API, web, and mobile traffic using patented multi-dimensional machine learning (ML) techniques to fingerprint requests separating malicious from legitimate actions. Fingerprinting significantly contributes to Cequence being agile, responsive, and resilient to adversarial re-tooling. With our low false positive rate, only legitimate API traffic is allowed through to your applications, enabling customers to confidently place the Cequence solution inline, natively blocking attacks in real time.
• Second, Cequence won’t adversely impact your CDN or WAF, as we’re not trying to make it do something it wasn’t designed for. Many vendors rely on a WAF for attack mitigation which is inefficient, slow, and has been known to crash the WAF as they are simply not built to handle the kind of address volume that a coordinated attack delivers.
• Third, no application integration is required. We protect your web, mobile, and API applications without needing to integrate JavaScript code or use an SDK to modify your apps. As a result, we deliver organizations more consistent and complete protection.
• Last, our solution is enterprise-class, elastically scaling to identify and block attacks at the largest and most demanding organizations in the world. Cequence secures more than 8 billion daily API calls and protects more than 3 billion user accounts. A significant percentage of Cequence customers belong to the Fortune 500, a proof point illustrative of our ability to scale for even the largest organizations.

What This Means for Your Security Program

For security teams, the false positive rate is often the more consequential number than the block rate. A system that blocks the vast majority of attacks but also flags a meaningful slice of legitimate traffic creates its own workload: someone has to review the flagged sessions, restore access for the users caught by mistake, and explain the disruption to whichever team owns the affected application. A low false positive rate is what makes it possible to run blocking inline with confidence, rather than treating detection as an alert that still needs a human decision before anything happens.

We’d love an opportunity to show you firsthand how we can help you in your API security efforts, putting you in a position to immediately solve today’s challenges while enabling you to easily and quickly respond to tomorrow’s.

In today’s rapidly evolving digital landscape, businesses are increasingly relying on Application Programming Interfaces (APIs) to drive innovation, streamline operations, and enhance customer experiences. However, as organizations harness the power of APIs, a new and critical concern arises: API security. While it might be tempting for CFOs to leave the technicalities to the IT or Security departments, API security holds profound financial implications that demand their attention. In this blog, we explore why CFOs should make API security a top priority to protect their organization’s financial health.

The Cost of Data Breaches

In an era defined by data, the consequences of a security breach are more far-reaching than ever before. API vulnerabilities can serve as an open door for malicious actors to access sensitive customer data, proprietary business information, and financial records. For example, Fashion retailer Forever 21 revealed that attackers accessed the names, dates of birth, bank account information, and Social Security numbers of over 500,000 customers earlier this year. The financial repercussions of such breaches are significant. Regulatory fines, legal settlements, customer compensation, and the cost of remediation can quickly spiral into millions of dollars, severely impacting the bottom line.

Regulatory Compliance and Financial Penalties

Today’s business environment is rife with regulations aimed at safeguarding data privacy and security. Organizations that fail to adequately secure their APIs run the risk of non-compliance with regulations such as GDPR, HIPAA, and CCPA. The fines and penalties associated with non-compliance can be crippling, and CFOs must recognize that neglecting API security could lead to substantial financial liabilities.

Reputational Damage and Customer Trust

In the digital age, an organization’s reputation is an invaluable asset. A breach resulting from poor API security can tarnish the brand’s image, erode customer trust, lead to a loss of business, or even result in the business closing down. Rebuilding a damaged reputation takes time and resources, and the financial losses from diminished customer loyalty can impact revenues for years to come.

Operational Disruption and Productivity Loss

When a breach occurs, the immediate aftermath can disrupt operations, causing downtime, productivity loss, and increased costs. Restoring systems, investigating the breach, and ensuring business continuity demand significant resources that translate into real financial impact. CFOs should recognize that the longer it takes to address and recover from a breach, the greater the financial strain on the organization.

Prioritizing API Security Can Lower Insurance Costs

To hedge against the financial risks of data breaches, many companies invest in cybersecurity insurance. However, insurance premiums are heavily influenced by the organization’s security posture, including API security. Prioritizing API security enables CFOs to negotiate better insurance terms and lower premiums, effectively reducing the organization’s financial exposure. Employing an industry-recognized solution like Cequence API Spyder to discover your externally accessible APIs provides a solid baseline from which to work. In fact, Cequence even offers a free API security assessment.

Ensuring Partner Ecosystem Security

In today’s interconnected business landscape, APIs often serve as bridges to third-party vendors, partners, and suppliers. Weak API security not only jeopardizes your organization but also exposes partners to potential security risks. For example, in late 2021, the now-famous Log4j vulnerability (CVE-2021-44228) enabled attackers to remotely execute code and potentially exfiltrate information due to weaknesses in the extremely popular open-sourced logging software. Mature companies such as Apple, Microsoft, and VMware all faced issues due to their use of this widely-used software. Clearly, a breach within your partner ecosystem can lead to a cascade of security incidents, impacting the financial health of multiple stakeholders.

Long-Term Viability and Innovation

APIs are instrumental in driving innovation, customer engagement, and operational efficiency. As your organization embraces digital transformation, secure APIs become essential for long-term viability and competitiveness. By prioritizing API security, CFOs are not only safeguarding against immediate threats but also positioning their organization for sustained growth in an increasingly digital future.

Questions You Should Feel Comfortable Asking

Here’s five questions CFOs should be comfortable asking their InfoSec team. The answers directly influence your organization’s financial security and health.

1. 1. How many externally-facing APIs do we have, and how do we know this information is accurate?
   2. What percentage of our APIs are documented/have up to date specifications?
   3. What percentage of our APIs have been tested and show OWASP API Security Top 10 vulnerabilities? What is our goal/target percentage, and what is the plan to achieve this goal
   4. Do we see an increase in account take over (ATO) and fraud before holidays and other large events? If so, what are we doing to reduce this exposure?
   5. In light of new guidance now available from the CFPB on Dodd-Frank, do we currently employ or allow screen-scraping to share data? What is our plan to move to more modern, secure data exchange mechanisms?

Conclusion

API security is no longer a mere technical concern; it’s a strategic imperative that directly impacts the financial health of an organization. CFOs play a pivotal role in managing financial risks, regulatory compliance, and reputational integrity. By championing API security initiatives, CFOs can ensure that their organizations thrive in a digital world while safeguarding against the financial fallout of security breaches. As technology continues to reshape industries, the proactive protection of API assets is a financial responsibility that cannot be ignored.

Our sources in Washington were right. The Consumer Financial Protection Bureau (CFPB) announced with the rule and set forth an ambitious goal that’s bound to redefine the contours of the financial world. Let’s unpack this significant shift to understand its nuances and implications:

Key Highlights of the CFPB Proposal:

• Current state: The CFPB estimates that at least 100 million consumers have authorized a third party to access their account data, half of which is via API.
• Consumer-Centric Approach: The new rule is a boon for end-users. By enhancing protection and preventing vendor lock-in, consumers are poised to enjoy superior services.
• The Dawn of Dedicated Digital Interfaces: The mandate is clear – data exchange needs dedicated, safe, and reliable digital pathways. The prevalent solution in today’s world? APIs.
• Guardrails for Data: With robust protections against unchecked surveillance and misuse, the importance of detecting and managing the sharing of sensitive data over APIs (or interfaces) is underscored.
• Empowering Users: The proposal champions consumer rights by allowing them to revoke data access, a control that can be centralized at the API level to regulate third-party data sharing.
• Redefining Data Collection Practices: A significant departure from screen scraping, the current risky practice at many Financial Institutions (FIs), the proposal is nudging the industry away from these error prone methods that often create vulnerabilities.
• Phased Implementation: The rollout is gradual. Larger providers will need to align with the requirements sooner, with smaller entities getting a longer runway.
• Timelines to Remember: The clock is ticking. Comments are due by December 29, 2023. And depending on assets under management, data providers have a compliance window ranging from approximately 6 months to 4 years from the final rule’s publication.
• The Necessity for Advanced Interfaces: Both consumer and developer interfaces are emphasized, which can be effectively managed and shielded using the right set of APIs.
• Performance Benchmarks: Commercially reasonable performance is non-negotiable. With a stipulated response time of under 3,500 milliseconds and a 99.5% average response rate, API security solutions that induce significant delays might be non-compliant.
• Security Considerations to Ponder: 
  • Access credentials shouldn’t overlap between consumer and developer interfaces. This underscores the importance of proper Authentication, Authorization and Access at the API level.
  • The information security program for the developer interface should align with the Gramm-Leach-Bliley Act (GLBA) or the FTC’s Standards for Safeguarding Customer Information, depending on the entity’s regulatory purview.
  • The CFPB took a stance that credential based access to this data is discouraged, leaving tokenized access as the preferred method.

Given this intricate web of requirements and shifts, how do institutions adapt while ensuring top-notch cybersecurity? We propose Unified API Protection (UAP) to help implement this CFPB rule at financial institutions.

Cequence Is Your Partner in These Choppy Waters

APIs are central to this new directive. Cequence dives deep into the realm of API Protection and offers a platform covering all phases of the API lifecycle, unifying API discovery, compliance, and real-time detection and native prevention for effective, efficient, and secure financial data sharing. As the financial sector braces itself for this new chapter, partnering with Cequence can mean the difference between treading water and charting a confident course staying ahead of these tight deadlines.

Consumer Financial Protection Bureau (CFPB) to Release Major New Proposed Rule on Thursday October 19

Cequence’s contacts in Washington D.C. indicate that the Consumer Financial Protection Bureau (CFPB) will publish their major rule on Dodd-Frank Section 1033 (Open Banking / Open Finance) Thursday, October 19, 2023. The rule is expected to be a key milestone in Open Banking / Open Finance to the U.S. clarifying requirements around API-based access to data. Many banks and other regulated entities have been waiting for this rule before investing heavily in their API security strategy. This rule is expected to resolve much of this uncertainty, enabling organizations to start safely pursuing their API strategy in earnest. The CFPB is just the latest to comment on the topic of APIs; the U.S. Treasury (2018) and the FFIEC (2021) both released guidance related to APIs and acknowledged their importance in secure data sharing.

Our intelligence projects the following timeline:

• Q4 2023 release of Proposed Rule Making and open comment period.
• Q1 2024 comment period closes.
• Q2 2024 release Final Rule. Implementation Period begins.
• TBD 2025 Enforcement Period begins.

As the foundation of inter-organizational financial communications, API security is critical. The new CFPB guidance on Dodd-Frank Section 1033 will bring about an Open Finance API building boom, and participating organizations must consider best practices in API architecture and security up front. Financial services organizations are 300 times as likely as other companies to be targeted by a cyberattack,¹ and cybercrime costs these organizations 42% more than other vertical markets.² Due to their desirable assets, financial organizations experience attacks at a high rate that can lead to theft of funds or sensitive data. Learn more about API protection at financial institutions.

Read our analysis of the rule to learn more about the CFPB rule, why it matters, and the action items and deadlines you need to know to prepare your business.

¹ https://www.bcg.com/publications/2019/global-wealth-reigniting-radical-growth

² https://risk.lexisnexis.com/insights-resources/research/true-cost-of-financial-crime-compliance-study-for-the-united-states-and-canada

Cequence Security is pleased to announce that the Unified API Protection Platform has been named the Enterprise CyberSecurity Solution of the Year in the 2023 CyberSecurity Breakthrough Awards for the second year.

The awards program is conducted by CyberSecurity Breakthrough, a leading independent market intelligence organization that recognizes the top companies, technologies, and products in the global information security market today. Cequence was selected as a winner by a panel of industry-expert judges based on the company’s innovation, performance, ease of use, functionality, value and impact on the cybersecurity market.

APIs play a crucial role in virtually every digital transaction, enabling a global-scale digital transformation for enterprises. However, along with their benefits, APIs also introduce a variety of security challenges. Unprotected shadow, deprecated, and third-party APIs risk exposure of confidential or sensitive data and fraud.

Cequence recognized the need for a comprehensive solution that offers full lifecycle protection of APIs. It’s what inspired us to develop the industry’s first comprehensive platform designed to safeguard organizations against losses across their entire API risk surface.

Cequence’s Unified API Protection (UAP) platform is the only solution that unifies API discovery, inventory, compliance, dynamic testing with real-time detection and native mitigation to defend against fraud, business logic attacks, exploits and unintended data leakage. UAP differs from fragmented API security offerings by taking a comprehensive approach, accounting for multiple types of risk, offering autonomous discovery, and providing native inline resolution without relying on third parties.

We are honored to be named the Enterprise CyberSecurity Solution of the Year and appreciate the recognition of our innovative platform and commitment to discovering and securing all APIs. This is on the heels of being recognized as a “best-in-class” solution in the Datos Insights Vendor Evaluation: API Security Solutions report, earning one of the highest product scores in the history of Datos Insights vendor evaluation reports. In addition, Cequence’s Unified API Protection solution was named the gold winner for “API Management,” “Full Life Cycle API Management” and “IT Solutions for Retail” categories in the 2023 Globee® Awards for Information Technology.

It has been quite a year, and we are looking forward to what’s ahead in 2024 and helping more organizations around the globe secure and defend their mission-critical API Applications from data loss, fraud, and business disruption. Learn more about the award-winning Cequence Unified API Protection platform.

Duolingo is one of the largest and most popular language learning apps in the world. In August of 2023, it was reported that data on 2.6 million Duolingo users – including names, email addresses, and more – had been leaked onto a hacking forum. Duolingo’s API for user account access only required an email address, with insufficient verification. That allowed a hacker with a large email database to run a script against the API and gather a bunch of account data each time a matching email was found in their system. This once again underscores the importance of API Security as this PII data allows scammers to create very believable phishing attacks. This is potentially bad for every Duolingo customer, and very bad for Duolingo’s reputation.

The Duolingo leak shows that APIs have become a major frontier in the cybersecurity wars. Consequently, any company that does not take API Security seriously does so at their own peril. As many have pointed out, the data leaked from Duolingo was not the result of a traditional incursion exploit and might barely be considered a breach at all. Yet, the impact is tangible and damaging, for both Duolingo and their customers. So, what can we learn from this incident and what actions should we take to avoid being the next victim?

Lesson 1: You Have More APIs Than You Know, and You Don’t Know What They All Do

Typical enterprises today rely on an average of twenty thousand APIs to run their businesses, from front-end websites serving customers to thousands of apps and microservices on the back end. Whether developed in-house, contracted, or open source, 90% of developers are using private or third-party APIs (Slashdata Developer Economics Survey). That’s an awful lot of APIs without proper security control or review. In addition to potential security issues, APIs often have multiple functions, even if only one is actively in use. Hackers may be able to trigger other functions with unknown consequences to the business. The opportunities for hackers are endless.

These “Shadow APIs” that live outside the normal IT governance and security processes have become the number 1 attack vector. Out of 16.7 billion malicious transactions, almost a third (5 billion) targeted unknown, unmanaged and unprotected APIs1. OWASP lists these APIs under API9:2023 in their API Security Top 10 – Improper Inventory Management. Most enterprises have no way of even identifying every API in use, not to mention evaluate their functions or remediate security issues.

Lesson 2: Your APIs May Be Helping the Hackers to an API Breach

API protocols that simplify communications between systems and services are perfect opportunities for malicious actors to gain unwanted access. For instance, a Duolingo customer is leveraging APIs when they log into their account to access their usage, spending, and profile data. In this data leak, hackers used a bot to find and access Duolingo accounts through this API to identify accounts and scrape information associated with each. This API made it easy by not validating each user before granting access. Poor or missing validation logic is an extremely common API security gap that can easily lead to an API breach.

Another common way that APIs make hacking easy is by exposing data structures in function calls. This can occur in a million ways, but a simple example would be a URL or data call that includes a number reference to an account. All a hacker has to do is increment that number to call the next account. Easy. Developers are paid to program functionality, and security often takes a back seat, or is never addressed at all.

APIs often focus on function only – not security.
You can’t protect what you don’t know about.

“This incident underscores that not all attacks on digital resources involve traditional hacking techniques,” – Jason Kent, hacker in residence at Cequence Security, in Infosecurity Magazine.

Lesson 3: Traditional Tools Won’t Protect You from Poor API Hygiene

Traditional security approaches assume the goal of hackers is to gain access to sensitive information protected behind some secure boundary, like a firewall or authentication gateway. Many APIs are designed to go around or through those boundaries intentionally, to efficiently serve business needs. If traditional security is the lock and deadbolt on the front door, APIs are the open windows and vents that also provide access into the house, if you simply know where to look.

While traditional security solutions monitor and identify the precursors and activity associated with traditional hacks, API usage is normal and expected, making it much harder to identify when malicious activity is happening. Poor logic, such as the insufficient validation of the Duolingo APIs, is perhaps one of the most common API security holes but won’t be discovered by most security solutions. Beyond logic, the list of API hygiene issues is long indeed. Some of the more common issues (also mostly missed by traditional security tools that do not address the full API Protection lifecycle) include:

• Poor data input sanitizing, allowing injection attacks
• Insufficient or missing encryption
• Validation to protect against cross-site scripting (XSS)
• Inadequate rate limiting or throttling to protect service
• Poor error handling
• Unintended information or data structure disclosure
• Weak or broken session management
• Dependencies on third-party and/or outdated libraries
• Insufficient logging
• Unknown and unaccounted for APIs
• Etc.

Only solutions specifically designed to identify, inventory, and evaluate APIs can protect against these and many other security holes. Unfortunately, too many organizations still have this hole in their security arsenal.

APIs could be open windows, even when the doors are locked.

“The Duolingo data breach highlights the vulnerabilities posed by poorly secured APIs and the potential for business logic abuse by threat actors,” said Jason Kent, Hacker in Residence, Cequence Security, in CPO Magazine.

Takeaway: Understand and Mitigate Your API Attack Surface to Prevent an API Breach

Understanding the importance and necessity of API security is only the first step to completing your security strategy. The first thing any company must be able to do is identify and INVENTORY the tens of thousands of APIs that are already operating in the organization. Once a complete list is generated, every API must be evaluated for COMPLIANCE against every API hygiene rule, including OpenAPI specifications, appropriate governance guidelines and security best practices. To the best of your ability, proactively address and correct identified issues. Then, ideally, deploy a system capable of MITIGATION, which provides the ability to block API attacks in real time with a low false positive rate. Mitigation capabilities should also include DDoS PROTECTION.

Now that the bad actors have recognized the API opportunity and have made it their number one attack surface, it’s time for organizations to make it a priority as well.

Get an Attacker’s View into Your Organization

Free API Security Assessment

API Security Breaches – Lessons learned

In the digital age, APIs (Application Programming Interfaces) have become the backbone of modern application architecture, enabling seamless integration and communication between various software applications. The increasing reliance on APIs has also opened up new avenues for cyber threats: recent API security breaches have underscored the importance of robust security measures, including the discovery and management of rogue APIs.

The Rising Threat of API Security Breaches

APIs are a prime target for cybercriminals due to the sensitive nature of the data they handle. Recent breaches have demonstrated the devastating consequences of inadequate API security, including data leaks, financial loss, and damage to brand reputation.

1.  Facebook: In 2018, Facebook suffered a significant breach where attackers exploited a vulnerability in Facebook’s “View As” feature, which was related to Facebook’s API. The breach affected 30 million users, whose access tokens were stolen. This incident highlighted the importance of regularly auditing and testing APIs for vulnerabilities.
2.  Twitter: The 2013 exploitation of Twitter’s API, lead to the unauthorized access of approximately 250,000 user accounts. The attackers were able to access user information, including usernames, email addresses, and encrypted/salted versions of passwords. This breach underscored the importance of securing APIs, even when they are not directly exposed to end-users.
3.  Strava: In 2018, the fitness tracking app Strava unintentionally exposed sensitive information about military bases and patrol routes through the data shared via its API. The users of the Strava app were military personnel and subject to an elevated security risk as a result. This incident highlighted both the potential risks and the importance of considering privacy when designing APIs.
4.  Panera Bread: In 2018, Panera Bread’s website had an unauthenticated endpoint (API) that leaked millions of customer records, including names, email addresses, physical addresses and birthdays, as well as the last four digits of customer credit card numbers. This breach emphasized the importance of properly securing APIs and ensuring that sensitive data is not unnecessarily exposed.
5.  Zendesk: A GraphQL endpoint on their popular help desk ticketing platform was vulnerable to SQL injections. This specific vulnerability could be exploited to reveal sensitive user data. While it was active, the software flaw allowed attackers to access customer conversations, email addresses, ticket numbers and comments.

These incidents highlight two critical aspects of preventing API security breaches: the need for robust API security measures, and the importance of discovering and managing rogue APIs.

The Importance of Rogue API Discovery and Protection

Rogue APIs are developed and deployed without the proper oversight of the IT or security team. They often do not adhere to the organization’s security policies and can provide a backdoor for attackers.

The discovery and management of rogue APIs are crucial for maintaining a secure API environment. Automated discovery tools can scan the network for API traffic, identifying any that are not listed in the organization’s API directory and flagging them for further investigation.

Once a rogue API is discovered, it needs to be evaluated to determine if it can be brought into compliance with the organization’s security policies; if it can’t, it needs to be decommissioned. In either case, the existence of rogue APIs should trigger a review of the organization’s overall development and deployment practices to prevent similar occurrences in the future.

Bringing APIs into Compliance

Bringing an API into compliance involves ensuring it adheres to the organization’s security policies. This may involve implementing proper authentication and authorization mechanisms, encrypting data both in transit and at rest, validating all API requests, and setting up regular audits and monitoring.

Regulators are emphasizing security compliance as well. In fact, the US Consumer Financial Protection Bureau (CFPB) recently announced a rule that requires financial institutions to take actions to secure their APIs, including specifics such as ensuring that consumer and developer interfaces remain separate.

Bringing rogue APIs into compliance may also involve integrating them into the organization’s API management platform. This ensures they are subject to the same security measures, monitoring, and governance as other APIs.

Lessons Learned

Recent API security breaches have underscored the importance of robust API security measures. They have highlighted the need for a comprehensive approach to API security, including the importance of bringing all APIs into compliance with the organization’s security policies.

These incidents serve as a reminder that API security is not a one-time effort but an ongoing process. It requires continuous monitoring, regular audits, and proactive measures to discover and manage rogue APIs. By learning from these incidents and implementing robust security measures, organizations can protect their sensitive data and maintain the trust of their users.

Get an Attacker’s View into Your Organization

Free API Security Assessment

The Open Web Application Security Project (OWASP) is a non-profit organization dedicated to improving software security. One of their most well-known projects is the OWASP API Security Project, which aims to provide a foundational set of security controls for APIs. In this post, we’ll explore the changes introduced in the 2023 version compared to the 2019 version of the OWASP API Security Top 10.

Key Takeaways

The 2023 version of the OWASP API Security Top 10 introduces new categories that reflect the evolving landscape of API security threats. It emphasizes the importance of proper authorization at both the object and function levels, managing resource consumption, protecting sensitive business flows, and maintaining a proper inventory of APIs. It also introduces the concept of unsafe consumption of third-party APIs, highlighting the risks of trusting data from external sources.

OWASP API Top 10 2023

The 2023 version of the OWASP API Security Top 10 introduces several new categories and redefines existing ones. Here’s a sneak peek:

1. API1:2023 – Broken Object Level Authorization: This category remains the same as in the 2019 version, emphasizing the importance of proper authorization checks for every function that accesses a data source using an ID from the user.
2. API2:2023 – Broken Authentication: This category also remains unchanged, highlighting the risks of incorrectly implemented authentication mechanisms.
3. API3:2023 – Broken Object Property Level Authorization: This new category combines API3:2019 (Excessive Data Exposure) and API6:2019 (Mass Assignment), focusing on the root cause: the lack of or improper authorization validation at the object property level.
4. API4:2023 – Unrestricted Resource Consumption: This category emphasizes the importance of managing the resources required to satisfy API requests, such as network bandwidth, CPU, memory, and storage.
5. API5:2023 – Broken Function Level Authorization: This category highlights the risks associated with complex access control policies and unclear separation between administrative and regular functions.
6. API6:2023 – Unrestricted Access to Sensitive Business Flows: This new category focuses on the risks of exposing business flows without considering how the functionality could harm the business if used excessively in an automated manner.
7. API7:2023 – Server Side Request Forgery: This category highlights the risks of Server-Side Request Forgery (SSRF) flaws, which can occur when an API fetches a remote resource without validating the user-supplied URI.
8. API8:2023 – Security Misconfiguration: This category remains the same as in the 2019 version, emphasizing the risks of missing or incorrect security configurations.
9. API9:2023 – Improper Inventory Management: This new category highlights the importance of maintaining a proper inventory of hosts and deployed API versions to mitigate issues such as deprecated API versions and exposed debug endpoints.
10. API10:2023 – Unsafe Consumption of APIs: This new category focuses on the risks associated with trusting data received from third-party APIs more than user input, leading to weaker security standards.

The Implications of OWASP API Security 2023 Changes

The OWASP API Top 10 2023 version reflects the evolving landscape of API security threats and the growing importance of APIs in today’s digital world. The changes introduced have significant implications for developers, security professionals, and businesses alike.

Emphasis on Authorization

The 2023 version introduces a new category, Broken Object Property Level Authorization, which combines two categories from the 2019 version: Excessive Data Exposure and Mass Assignment. This change emphasizes the importance of proper authorization at the object property level, not just at the object level. It indicates that APIs need to be designed with granular access controls in mind, ensuring that only authorized users can access or modify specific properties of an object.

Resource Management

The addition of Unrestricted Resource Consumption as a category highlights the importance of managing the resources required to satisfy API requests. This is particularly relevant in the era of cloud computing, where resources are billed per usage. Unrestricted resource consumption can lead to increased operational costs and even Denial of Service (DoS) if not properly managed.

Business Logic Protection

The new category Unrestricted Access to Sensitive Business Flows emphasizes the need to protect business logic from abuse. APIs often expose business processes that, if used excessively or in an automated manner, could harm the business. This category encourages businesses to consider the business logic implications of their APIs and implement appropriate rate limiting and abuse prevention mechanisms.

Inventory Management

The addition of Improper Inventory Management as a category highlights the importance of maintaining a proper inventory of hosts and deployed API versions. As microservices architectures and API-first approaches become more prevalent, keeping track of all deployed APIs becomes a significant challenge. This category emphasizes the need for proper API governance and lifecycle management.

Third-Party API Consumption

The new category Unsafe Consumption of APIs highlights the risks associated with trusting data received from third-party APIs. Developers often trust third-party APIs as they would internal APIs, leading to weaker security controls. This category encourages developers to treat third-party API data with the same level of scrutiny as user input.

Conclusion

The changes in the OWASP API Top 10 2023 version underscore the evolving nature of API security threats. They highlight the need for robust authorization controls, resource management, proper inventory management, and safe third-party API consumption. As APIs continue to play a crucial role in modern applications, understanding and mitigating these risks will be key to maintaining secure systems.

Get an Attacker’s View into Your Organization

Free API Security Assessment

In an era where technology is the cornerstone of the financial industry, safeguarding sensitive information and maintaining the integrity of data has become paramount. Financial institutions are constantly faced with the challenge of ensuring the security of their systems, especially when it comes to Application Programming Interfaces (APIs) and API security. The Federal Financial Institutions Examination Council (FFIEC) has established security guidelines and addressed API security specifically in its most recent Authentication and Access guidance.

Understanding API Security

Before we dive into the specifics of FFIEC’s requirements, let’s grasp the concept of API security. APIs act as bridges between different software systems, enabling them to communicate and exchange data seamlessly. They play a pivotal role in enabling financial institutions to offer innovative services to customers, but they also introduce potential security vulnerabilities. Hackers are continually looking for weak points in APIs to gain unauthorized access, steal sensitive data, or disrupt services.

Cequence Security provides an industry leading Unified API Protection platform that can be the foundation of any financial services API security strategy that provides full API lifecycle protection. Finance organizations have invested in Cequence Security for API inventory, compliance, testing, mitigation, and fraud. Cequence currently secures billions of API calls per day user accounts across its customer base.

The FFIEC API Security Framework

The FFIEC, a consortium of regulatory bodies overseeing financial institutions in the United States, recognized the need to set standards for security to ensure the safety of financial transactions and customer data. Their security framework serves as a blueprint to help financial institutions identify and mitigate risks associated with API usage, among other things. Based on the categories below we have outlined where Cequence can provide immediate protection and assessment for your API protection strategy.

1. Authentication and Access Control

The first pillar of the FFIEC framework focuses on ensuring proper authentication and access control mechanisms. Institutions are required to implement strong authentication methods, such as multifactor authentication (MFA), to verify the identity of API users. Additionally, access control mechanisms must be in place to restrict API access to authorized individuals or systems.

Cequence offers agentless discovery with no software or traffic redirects, providing a complete view of your external and internal APIs in a matter of minutes.

Cequence can also provide an analysis of runtime traffic for OWASP Top 10 identity authentication weaknesses that may exist in your API landscape.

2. Encryption and Data Protection

Encrypting data is a fundamental aspect of securing APIs. The FFIEC mandates the use of encryption for data both at rest and in transit. This ensures that sensitive information remains unreadable even if intercepted by malicious actors.

3. Audit and Monitoring

Proactive monitoring is crucial for identifying and responding to potential security breaches swiftly. Financial institutions must implement audit logs that track API usage and any unusual activities. These logs aid in detecting and investigating security incidents.

Cequence Security unifies API discovery, inventory, compliance, dynamic testing with real-time detection and native detection to defend against fraud, business logic attacks, and data leakage.

4. Secure Development and Testing

Developing and testing APIs securely is a cornerstone of the FFIEC framework. Institutions are encouraged to follow best practices during the development lifecycle, conduct thorough security testing, and promptly address vulnerabilities.

Cequence uses Generative AI to automatically generate security test cases customized to your unique APIs, business, or vertical. Comprehensive API testing of your application in the CI/CD pipeline ensures critical vulnerabilities are remediated before production.

5. Incident Response and Recovery

Even with robust security measures, incidents can occur. The FFIEC requires financial institutions to have well-defined incident response and recovery plans in place. These plans should outline steps to mitigate the impact of breaches and ensure the continuity of services.

6. Third-Party Risk Management

Many financial institutions rely on third-party APIs to enhance their offerings. However, these third-party integrations can introduce risks. The FFIEC stresses the importance of assessing and managing third-party risks through due diligence, contract negotiations, and ongoing monitoring.

This is another strength of Cequence Unified API Platform protection. Cequence enables organizations to assess APIs and runtime traffic and what is coming in, where it is coming from, and when to mitigate.

Embracing the Future of API Security

As technology continues to evolve, so do the tactics of cybercriminals. The FFIEC API security requirements provide a foundational framework to help financial institutions navigate the complex world of API security. However, it’s important to note that these requirements are just a foundation; they should be seen as a starting point for building a strong security posture.

Financial institutions should continuously educate their teams about emerging threats and best practices, conduct regular security assessments, and adapt their security strategies accordingly. Collaborating with cybersecurity experts and staying updated on industry trends is essential to stay ahead of potential risks.

Cequence Security can play a crucial role for financial services organizations in complying with FFIEC API security guidance and securing their financial systems. By adhering to these guidelines, financial institutions can contribute to the creation of a secure and resilient financial landscape, where customers can trust that their sensitive information remains protected, and transactions occur without a hitch.

See also: check out our blog about the new CFPB open banking rule with new guidance around API security and compliance.

Cequence is pleased to announce that we have been named to the Enterprise Security Tech 2023 Cyber Top 20 Awards List for our Unified API Protection (UAP) platform! The Cyber Top 20 honors organizations shaping the future of cybersecurity and those that have redefined the approach to protection and defense. The Cequence UAP platform is the only solution that helps organizations manage their API security throughout the complete API lifecycle.

The top 20 cybersecurity companies were named to the list as providing the most value to the market based on:

• Technical product or service innovation
• Industry analyst recognition and customer testimony
• Diversity and inclusion initiatives
• Talent development initiatives
• Giving back to the cyber community (resources, education)

Cybersecurity is constantly evolving, and nowhere is that more apparent than API security. APIs (Application Programming Interfaces) enable communication between modern applications, and in fact make up almost 80% of today’s internet traffic. However, APIs are also becoming one of the most attack vectors for bad actors. Organizations need a solution that protects their APIs and helps eliminate unknown, unprotected, and unmitigated API risk.

The Cequence UAP platform protects the organizations across the entire API lifecycle including API discovery (automatically discovering both known and unknown APIs), API posture management (ensuring the APIs are in compliance), and API protection (bot mitigation and attack blocking). Our unique platform provides visibility to IT and security teams and ensures that business can continue as usual.

We are honored to be named to the 2023 Cyber Top 20 Awards List and appreciate the recognition of our innovative platform and commitment to our customers and partners.

Learn more about the award-winning Cequence Unified API Protection platform

The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), U.S. Cybersecurity and Infrastructure Security Agency (CISA), and U.S. National Security Agency (NSA) released a joint Cybersecurity Advisory on July 27, 2023, to warn vendors, designers, and developers of web applications and organizations using web applications about insecure direct object reference (IDOR) vulnerabilities also known as broken object level authorization (BOLA) vulnerabilities.

An IDOR is an object on a web server such as a user’s profile, that can be accessed without controls to that access being in place. In other words, api.example.com/id/12345 has this issue, the user could just change the number on the end of the query string and api.example.com/id/12346 would be the next user and the access controls wouldn’t check to see if 12345 was supposed to see 12346’s profile.

The advisory provides some good advice but it’s important to note that even if things are designed well and code scanners and reviews have taken place, it’s possible to end up with an issue like this. One of the glaring things that the advisory is missing is the fact that for a while now a transaction-by-transaction account of the intent of each transaction, is possible. This means that looking at a transaction where someone looks at 12345’s profile, when they try to see 12346’s profile, the transaction will be flagged/dropped/alerted on/given a deceptive response, etc…., which goes way beyond the basics and requires a deeper look but is a far faster way to deal with it.

Never forget the basics and as such the advice in the advisory is sound, but to understand where they are coming from, let’s look at the types of IDOR/BOLA they are talking about:

Horizontal IDOR vulnerabilities

This is the one most people understand, as a regular user I can see another regular user’s information. It’s called Horizontal IDOR or Horizontal Privilege Escalation because the attacker and the victim are at the same user level or unauthenticated, not an administrator or using administrative functions.

Vertical IDOR vulnerabilities

The attacker’s goal is often to get data out, they want to do this as silently as possible. Sometimes this is more easily achieved if their account privileges elevate to that of an administrator for the system. The direction here is up, from a regular user the attacker elevates their privilege up to that of an admin and performs those functions.

Object-level IDOR vulnerabilities

Logged in or not logged in attacker can access a data object they shouldn’t be able to, at any level. This could be an administrative function, server data, user data, really anything.

Function-level IDOR vulnerabilities

Functions are the backbone of the application. What any given user can do within the application happens via various functions designed and implemented into the application. Often administrative functions are obscured from a user but can be inferred via various common paths or via comments. One such function level IDOR is the ability to go to a subdomain and ask if /graphql is available. If api.example.com/graphql is available, the graphql playground is launched and the attacker has the entire database and schema at his/her disposal.

One of the assumptions here is that you are aware of the applications you have, the endpoints they contain and what level of access is required for each endpoint and/or endpoint function. This is rarely the case. Our typical customer comes to us because they have an API security issue. We tend to start at the same place with everyone, simply looking for APIs on the exterior attack surface via public records searches etc…. It is rare for an organization to look at the list and say they were aware of each subdomain let alone each endpoint that was accidentally left on.

All of the vulnerabilities that are listed in this advisory are valid and things that we see on a daily basis. However, we are still seeing breaches that start off with an endpoint the organization was unaware of, it often doesn’t require authentication and is often very impactful in the data it discloses. Once you are aware of the endpoints you have, instrumenting them for security posture becomes the next priority. This includes things like transaction monitoring, logging, analytics as well as ensuring the testing rigor all other applications face in your organization includes these applications as well.

Cequence can help customers to discover, comply, and protect their organization’s mission-critical APIs. The Cequence Unified API Protection (UAP) solution can empower security teams to discover their entire API footprint, understand their API security posture and protect their APIs from cyber-attacks. Through Cequence, customers can identify the IDOR vulnerabilities that may be present within their APIs, empower security teams to work with their R&D teams to remediate critical IDOR vulnerabilities and protect in real-time against any API cyber-attacks.

If you are interested in learning how Cequence can help you to defend against IDOR vulnerabilities that can exploit your organization’s APIs, just request an assessment today!

Introduction

After winning numerous industry accolades and awards, we are very pleased to announce the latest feather in our cap, where Cequence was named a Best-in-Class AI Security solution among all vendors by Datos Insights (formerly known as Aite-Novarica). The Datos Insights Vendor Evaluation is a comprehensive, proprietary process that is designed to provide a holistic analysis of participating vendors and identify market leaders in each evaluated vendor market. You are likely aware of similar reports such as the Gartner Magic Quadrant (MQ) and Forrester Wave. By incorporating many aspects of a vendor’s essential characteristics for success and growth, including financial and client stability, product features, and customer service, the vendor evaluation provides an actionable guide for market participants looking for viable third-party vendor solutions and services.

History Made: Highest-Ever Product Score

“The company has become one of the market’s most respected API security vendors.” This is the one-sentence summary Datos Insights offers about Cequence in this latest report, and this market designation is only bolstered by their in-depth analysis and consideration of the entire field of API security vendors. According to Datos Insights’ latest report, not only did Cequence earn the Best-in-class API Security designation and the highest position in the report, but it also earned “one of the highest product scores in the history of Datos Insights publishing its Vendor Evaluation reports”. This is a significant achievement that we have worked hard for and are proud to have earned.

So why should you read this report? This Datos Insights report should be required reading for every enterprise, not because it validates our technology and execution, but because it does an excellent job of educating us on the history, the dynamics, and the necessity of great API security. They offer a detailed breakdown of nearly every aspect of what such a solution could and should offer to effectively protect this massive attack surface – in fact the largest single attack surface for many enterprises.

Learn Why API Security Is Essential

Business productivity and customer interaction has come a long way as APIs have evolved over the last 20 years. Today, our businesses simply couldn’t operate (or compete) without the APIs that enable every aspect of enterprise operations. Malicious actors know this and work hard to take advantage of these tens of thousands of little windows into our critical infrastructure and sensitive data. The question becomes, how well have we closed, locked and protected these windows? To be sure that we have done a good job, we should understand all the different ways data could be accessed or lost. Datos offers the following graphic as a summary of the many threat types that we should be aware of and protect against.

And not only are there many ways that APIs may be compromised, but the amount of damage from just a single breach can be enormous. In fact, a simple data scraping technique applied to a website API allowed the exposure of 700 million LinkedIn user records just 2 years ago. Many more complex attacks have also been successfully used to breach many millions of records every year, ranging from deliberate exploitation of zero-day vulnerabilities to benign negligence of out-of-date and insecure APIs. In fact, with the rapid development of new APIs, I am afraid that new vulnerabilities are unwittingly introduced into many environments almost every day.

While this is certainly educational, and good for any SecOps professional to understand, it is infinitely more important that your API Security solution effectively addresses every one of these avenues of threats and more.

Learn What API Security Can (Must) Do for You

We know that the landscape of APIs at most companies is extremely complex, and there is not a single person in any company who knows about every one that is in use or how it connects to other APIs, servers, and databases. So, there is a whole sequence of things that must happen to truly protect all your APIs. Datos Insights used a very thorough and rigorous process to dig into every aspect of these essential capabilities throughout the evaluation process. This is often referred to as API Protection Lifecycle and includes everything from discovery of APIs currently in production, to preemptive security integrated into the IDE and CI/CD pipelines, to active notification and protection of identified issues. Following are thirteen areas that Datos Insights drilled into in this report:

• Implementation Model
• API Discovery Capabilities
• API Security Policies
• Access Control
• API Inventory and Attack Surface
• Vulnerability Detection
• Threat Management
• Event Notification
• Monitoring
• Testing
• Dashboard
• Auditing
• Solution Design

I am pleased to report that Cequence achieved a positive mark in every single subcategory across all thirteen product areas, the only vendor to do so. Think, for example, about whether the implementation model and integration points of a solution map well to your own environment, both how it is today and how it may evolve into the future. The figure below shows a heat map of the results for Cequence. Please download the complete report for the full table.

Partial Figure from the report

It is also important to note that the proprietary methodology developed by Datos is holistic and goes well beyond today’s product capabilities. This includes essential characteristics for success and growth that are also critical to customers in the long run, like financial stability, customer service and product roadmap. So, what will you learn about Cequence in this report?

Learn If Cequence Is the Best Vendor to Protect Your APIs

To earn the best-in-class API Security designation in the Datos Insights report, we had to prove beyond doubt that we can deliver everything today’s enterprises need to keep their businesses safe from threats, both malicious and benign, regardless of what the operating environment, geography, size or vertical is. We not only had to check boxes, but also prove by documentation, product demonstration and customer references that we could backup everything we claimed. Most of the vendors (including some very well-known public companies and “unicorns”) either did not make the cut or could not provide customer references. Whoever you ultimately choose to protect your APIs, know that you will be far better informed on that decision after reading this report.

Datos Insights has been in the vendor comparison business for nearly 20 years. The current Matrix methodology was launched in 2015 and has created nearly 70 reports, each requiring about six months and 400 hours (about 2 and a half weeks) of researchers, advisors, and editorial staff to produce. This means that companies looking to understand and evaluate possible vendors can feel confident in leveraging this trusted third-party effort to save a ton of time and move much more rapidly toward their best-informed decision. We thank the Datos Insights team and especially Tari Schreider for leading this research.

Conclusion

It is not enough for CISOs to simply check the API Security checkbox and move on. Feature additions in web application firewalls (WAFs) or extending the firepower of their API Gateways, for example, simply won’t cut it today or in the future. APIs are the single greatest software attack surface for most medium and large enterprises, and Datos Insights believes and demonstrates how standalone API solutions are essential to handle the complex API environments that are now so prevalent.

I highly recommend this Datos Insights Vendor Evaluation to anyone who is either just starting or continuing their exploration and evaluation of API security solutions.

Get Your Copy of this Datos Insights Report

To learn more on why Cequence was ranked the best-in-class API Security solution, download the full Datos Insights Vendor Evaluation: API Security Solutions.

Download the full Report

We are proud to share that our Unified API Protection platform has been honored as a gold winner in the 18th Annual 2023 Globee^® Awards for Information Technology in Application Programming Interfaces (API) Management, Full Life Cycle API Management, and IT Solutions for Retail categories.

These esteemed global awards celebrate outstanding achievements in information technology and cybersecurity, further validating our mission to protect today’s hyper-connected enterprises from fraud, business abuse and data loss. They acknowledge vendors who demonstrate excellence through their advanced, ground-breaking products, solutions, and services, thereby raising the industry standards in all aspects of technology and cybersecurity.

The judging process for the 2023 Globee^® Awards for Information Technology involved the active participation of over 600 judges from diverse corners of the globe, representing a broad spectrum of industry experts. These esteemed judges contributed their expertise to evaluate and assess the submissions received.

The recognitions come at a pivotal time for the API security space. APIs have become the currency of exchange for everything we do digitally, with nearly 80% of all internet traffic today coming from APIs. History has shown the rapid adoption of new technology is followed by a significant rise in cyber threats and solutions designed to address those threats, and this is precisely what has transpired for securing APIs.

Today’s organizations need a solution that can relieve the anxiety and costs of unknown risks by eliminating previously unprotected and unmitigated API security and compliance exposures. Cequence was recognized for our unique approach to uncovering and preventing API threats via our Unified API Protection solution that enables organizations to increase revenues, lower service delivery costs, and improve user experience across all their API-enabled applications. IT teams are empowered to deliver secure business connectivity without stress, worry, or lost efficiency by providing continuous, real-time, end-to-end API risk discovery, detection and defense.

This accomplishment underscores our dedication to pushing boundaries through product innovations and maintaining a steadfast focus on our customers. It is a testament to our unwavering commitment to delivering exceptional solutions that address their security needs by safeguarding the organization across the entire API risk lifecycle.

See the complete list of 2023 winners here

Today’s blog highlights how an existing telecom API security customer was able to discover and protect a shadow API that was under attack in less than 30 minutes. Highlighting a common theme of rapid-time-to-value, this customer benefited from the Cequence approach to bot protection that eliminates the cumbersome SDK or JavaScript integration requirement. Agentless bot prevention with API Spartan is enabled by CQAI, a multi-dimensional machine learning engine that accurately models and detects the attacker eco-system – even when cybercriminals retool to avoid detection.

Why API Security is a Big Deal for Large Enterprises

What customers realize is a highly streamlined onboarding process that brings immediate time-to-value API protection for their critical applications, eliminating software integration, eliminating page load delays and forced mobile app updates. Contrast this to other security vendors that can take weeks to months to onboard API protection for a single API endpoint, leaving the door open for attackers to continue to conduct attack campaigns.

Protection in Under 30 minutes

At this telecom provider, cybercriminals were attacking a critical API endpoint that had not yet been protected by API Spartan, a component of Cequence’s UAP (Unified API Protection) solution. A member of the application development team responsible for this API had contacted the security team about this API that was under attack. They requested immediate assistance to quickly onboard API protection to mitigate the targeted attacks. The security team had jumped on protecting this API by implementing protection in under 30 minutes, configuring blocking policies that stopped the attacks right in their tracks. More importantly, 25 of these 30 minutes were spent on a conference call to plan and strategize. Cequence was up, running and protecting critical assets in minutes.

API Spartan: A component of Cequence UAP

A Comparison in Contrasts

This highlights another example of a customer that has taken advantage of Cequence’s unique approach to API protection. When API Spartan was first deployed at this telecom customer, thousands of APIs and web apps were onboarded within a matter of weeks. This contrasted with the previous API security vendor, which took 18 months to onboard a single API due to the extensive software integration and QA cycles required to integrate the vendor’s instrumentation. Because of this and despite their best efforts – they had only onboarded 13 API applications with a serious backlog of unprotected applications. With API Spartan, they could move extremely fast to onboard unprotected APIs in a matter of minutes, ensuring that they could quickly respond to the security needs of the organization.

Try API Spartan today

Get a Free API Security Assessment of Your API Attack Surface

Free API Security Assessment

Long before the clock ticks past midnight into the morning hours of Black Friday, excited shoppers are eagerly preparing to hit the pavement and the websites of their favorite retailers. Using ecommerce applications for retailers across the globe, everyone is scoping out potential buys in the hopes of finding those deals and the hot products that will make for the perfect present. However, one thing will be different this year, even as vaccination efforts are enabling physical shopping worldwide — retailers should expect customers to continue to avoid the crowds and stick to online shopping.

Everyday Cequence Security helps some of the largest retailers to defend their web, mobile and API applications against today’s advanced automated attacks. So, we asked the experts on our customers’ teams for their advice on preparing for the rush. Below are four tips they shared for fellow ecommerce organizations gearing up for the 2021 holiday season.

Stress Test Everything

This one is a bit obvious, but it’s important to reiterate that your infrastructure is about to take a beating. Therefore, it’s critical to ensure that your ecommerce applications and everything they depend on won’t buckle during the increased load generated by both shoppers and the botting community. While not every team also has the time and resources to simulate attack traffic, it’s something to consider if your organization can manage. In particular, if you’re going to be releasing a hot, hyped product be sure your team has scoped out ways to double (or quadruple) capacity and work through multiple risk scenarios so that you’ve got a plan of action before you’re in the heat of the moment.

Also, if you haven’t already, assign someone to track your infrastructure spend. Building a baseline over time will help you budget and potentially even uncover issues that may have gotten missed while providing valuable data to justify new security tools that might help.

Tidy up the Shop

There have likely been a few issues you’ve identified since the last busy season. Don’t wait. Prioritize those fixes that you’ve been putting off. If you can tackle them now, you’ll be in a much better position as the festive season arrives and the shoppers descend. Many organizations enter the holiday freeze on October 1st, and some even earlier. If you don’t take care of an issue now, you might not be able to touch code or tweak your configurations when in code freeze and bot activity ramps up.

Clearly Define and Communicate Responsibilities

If you oversee a team, clear as many obstacles from their path as you can manage and clearly outline your priorities and goals as you begin to approach the starting line. If that means running a bit of defense between them and other requests so you can empower your team to focus on preparing, do it.

At the same time, be sure you’re not wasting cycles on something another team has already figured out or has made progress on. This collaboration uncovers where there are overlaps in responsibilities and identifies ways to help each other out and make the organization more efficient. Especially when it comes to threat investigations, chances are if you see something weird, someone else in your organization or industry is likely also observing it or has additional data and details that will help you resolve the issue downstream.

Identify Potential Risks and Fraud

Whether you’re dealing with content scraping to create fake marketplaces or account takeover attacks that target loyalty programs and identity/credential theft, it can be a lot for you and your infrastructure to deal with during the busiest time of year. So, mitigate what risk you can now, while you still have some time.

Even if you have bot mitigation measures in place, it is very likely that there is malicious activity that your current solution is not detecting. For example, if orders per minute are increasing so quickly that the backend is struggling to scale, it may be worth investigating further.

Bots adapt quickly, so even if your solution worked at the start, the botters may have retooled and identified ways to bypass your defenses. Fortunately, there are newer solutions, like Cequence API Spartan, that can react as quickly as the bots and maintain high efficacy to keep defeating those malicious bots.

The shopping bots are sure to be out in force again this holiday season, and they are smarter than ever. Unfortunately, you can be certain that they will be hard to differentiate from legitimate customer activity, and, if left unchecked, will lead to a poor customer experience, reduced inventory allocation, cost overruns and performance issues. Some retailers might wonder if it matters who gets the sale during such a busy season as long as inventory keeps moving, but research shows it can lead to dissatisfied guests and brand damage.

Good luck and best wishes to everyone who will shortly begin to prepare for the holidays!

If you’d like to learn more about stopping automated attacks, watch a 5-minute demo of our platform in action:

Enriches Unified API Protection with Advanced Fraud Prevention & Enhanced Testing Capabilities

APIs are the currency of business exchange driving innovation and commerce. In fact, IDC estimates that up to 50% of enterprises’ revenues are enabled over APIs, translating for example to over $161 BILLION in Telecom revenues year before last. This has resulted in API Security quickly becoming a top three business initiative among the CISO community. The only way to defend is to outpace the adversary. We are pleased to announce several new capabilities that strengthen customers’ ability to discover, manage risk and protect their APIs. With the latest Unified API Protection platform updates, organizations can now protect their users from online fraud, operationalize security findings with low-code/no-code API SOAR like workflows, and rapidly deploy API Security Testing with built-in Generative AI automation. These capabilities continue to set us apart from other point API security, bot management, anti-fraud and WAF vendors by having the industry’s first and only Unified API Protection platform that covers the entire API lifecycle.

API Security Testing with Generative AI

Given the enormous potential of Generative AI tools like ChatGPT and Bard, Cequence added several new capabilities to our API Security Testing module to use Generative AI for Test Plan generation with a new feature called Intelligent Mode. Several other enhancements include detailed insights and remediation workflows into test failures, and out-of-the-box integrations with several CI/CD systems such as GitLab, Jenkins, Harness, and BitBucket.

One of the pain points with any Application Security Testing plan is to generate test cases customized for the apps being tested so that their relevant business functionality can be tested before releasing them to production. This problem is exacerbated with API Security Testing due to the varied nature of APIs, which vary by technology (GraphQL/REST/etc.), or by business functionality (sensitive or non-sensitive data exposure), besides other aspects.

Cequence now supports Intelligent Mode which helps automate the generation of API Security Test Plans using plain English extending the low-code/no-code approach to test case generation. For example, security analysts can state in plain English to “Generate a test plan for my Payments API to ensure PCI data compliance”. Cequence would then automatically introspect their Payments API endpoints, their payload characteristics and associate the appropriate test cases to test those endpoints for the compliance need. The resulting test plan would be exportable as a Postman collection that the analyst could integrate right into their CI/CD pipeline or use Cequence to test their pre-production API directly. For APIs that do not have any existing OpenAPI/Swagger specifications, Cequence can dynamically generate specifications based on the runtime traffic observed for their production API.

This is vastly superior to manual approaches to generate test plans, which are error-prone and require developers to be security-savvy about security test cases that they need to associate with their APIs. This accelerates the generation and adoption of API Security Testing by not requiring the security analyst to manually associate test cases for their API endpoints or the application developer from having to figure out which security tests they are required to run prior to pushing code from development to higher environments.

Cequence now also supports detailed insights into test failures, allowing the results to be exported to 3rd-party systems for remediation, including providing the details into the causes of the test failure. These can be integrated into several commercial CI/CD systems that are available out-of-the-box.

API Security Testing showing detailed actionable test failure insights

New Fraud Prevention Capabilities

To enable organizations to protect their public-facing APIs against online fraud, such as payment or money transfer fraud, Cequence has now introduced a new module called Fraud Prevention in API Spartan. The new Fraud Prevention module enables organizations to protect their users from online fraud and instantly take actions, including blocking transactions involving suspected fraud and generating notifications to internal fraud teams to take note of an active fraud incident. Protecting applications and users against online fraud complements the existing capabilities of Cequence to detect and block business logic abuse, Account Takeover (ATO) attempts, common OWASP API security risks, and automated malicious traffic.

According to the FTC’s Fraud Reports, financial organizations reported over $1.5B in online bank transfer or payment fraud in 2022, making it one of the most active channels in online fraud. Now, financial organizations can use Cequence to detect and prevent online fraud in real-time and inform their targeted users or customers, as well as alert their internal fraud teams.

Cequence includes a customizable rules engine that allows fraud analysts to define their custom detection criteria. Cequence also allows fraud detection teams to upload their proprietary datasets of business information, such as lists of known rogue accounts, or high-risk users. Such data can be looked up within the Cequence rules in runtime, and upon matching desired criteria, instant remediation and alerts are generated. When notifications about a suspected fraudulent transaction are triggered, they include detailed information so that fraud detection teams can conduct incident forensics to detect the start and subsequent progress of the entire transaction.

Cequence has further enhanced API Spartan with Proof-of-Work Captcha as a mitigation action, allowing organizations to throw cryptographic challenges that deter automated or malicious clients from targeting their applications. These are different from traditional Captchas which prompt the user to solve a puzzle manually. Those are known to be easily bypassed by malicious bot operators as well as known to turn good users away due to a frictional user experience.

Notifications View in Cequence’s new Fraud Prevention module

Low-code/No-code Security Automation

To operationalize API protection, organizations must integrate security findings with their internal applications to generate alerts, notifications, or other custom workflows to inform their app and operations teams. Security analysts may need to create such workflows for new threat detections, for new security risks detected in either production or CI/CD pipelines, or for the triggering of certain policies that were created to detect incidents of high risk.

Cequence is excited to announce out-of-the-box integrations with over 300 3rd-party apps, including ServiceNow, PagerDuty, JIRA, Slack, and several others. Using off-the-shelf connections to these 3rd party apps, security analysts can make sure that security risks or threats are routed promptly to their business teams for remediation.

Security analysts can use a low-code/no-code approach within Cequence to implement the equivalent of an API Security Orchestration and Response (SOAR) workflow, wiring together multiple 3rd-party connections to achieve their desired outcomes. This enables analysts with no coding experience to create such workflows, test them out, and deploy them in production quickly. An example of a zero-code workflow that can be quickly put together is to log a JIRA ticket when sensitive data exposure is detected from a shadow API, automatically geo-fence access to the offending API to internal applications only, and finally send an email to the developer or business API owner informing them about the detection of the issue.

Using this approach, API protection business owners can operationalize workflows that promptly remediate critical API security risks, such as the discovery of shadow APIs that have access to sensitive data, new security risks of weak authentication or non-conformance to OpenAPI specifications in newly built pre-production CI/CD pipelines, or an active attack on a mission-critical production app.

Out-of-the-box Integrations with 300+ 3rd-Party Apps for Notification Workflows

Rapidly Integrate with any Network Technology or Cloud Provider with Passive Integrations

Cequence now supports REST API-based passive network integrations, allowing it to be integrated with any network technology, such as a CDN, API gateway, proxy or load balancer with no impact on application latency.

This enables organizations to passively integrate their CDN or API gateway using any natively supported out-of-band integration option, such as Lambda functions (CloudFront), Lua scripts (Kong), Service Callouts (Apigee), Custom Policies (MuleSoft), and Workers (Cloudflare). Cequence already provides detailed integration guides to integrate with popular CDNs and API gateways. Custom integrations can be implemented using the Cequence Traffic Ingestion REST API with any network technology.

The Cequence UAP solution now has the ability to instantly discover runtime inventory of APIs via cloud security posture management integrations such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). Not only does this allow our customers to have a frictionless way to build out their inventory, but it also allows them to realize the benefits of the Unified API Protection platform. New enhancements to API Spyder enable our customers to easily identify APIs that are externally accessible, but not entirely protected by their Cloud Security Posture Management (CSPM) infrastructure. Additionally, this approach offers a seamless compliment to API Sentinel’s deep insights into runtime API inventory and compliance checking using the OWASP API Security Top 10 and other custom risk categories.

All new features above help organizations accelerate their trials as well as production implementations of Cequence into their environments without requiring any changes to their network or applications.

Request a Demo

To learn more about the new capabilities in the Unified API Protection solution v3, request a demo. We would be happy to show you these exciting new capabilities!

Request a demo

June 9th Progress Software released a statement “Multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database.”

Well, that doesn’t seem very good at all, in this case “multiple” meant 3 on June 15th with a 0Day SQLi and RCE flaw. Progress Software has released a security advisory for a privilege escalation vulnerability (CVE-2023-35708) in MOVEit Transfer—a Managed File Transfer Software. A cyber threat actor could exploit this vulnerability to take control of an affected system. CISA is also urging users and organizations to review the MOVEit Transfer advisory, follow the mitigation steps, and apply the necessary updates when available.

So, what happens when a massive flaw like this is found out, what is the first thing you should do?

Step 1: Know what you have. Then Patch.

Really the first step, as with any program or process for Information Security, is knowing what you have. Does this MOVEit vulnerability impact you? So, turn to your CMDB or your SBOMS or your SCAs or endpoint agents. Do you see traffic flowing to an impacted system that you can identify? The answer here is to probably start identifying systems and then cataloging the applications they are running. Why is it so important to find all the systems quickly?

In the case of this vulnerability there was a patch made available very quickly. If the organization wasn’t aware this was the Managed File Transfer solution they were using, they wouldn’t know to apply the patch. But also, though the patch was available quickly the exploit was available before the patch. So there needs to be a very rapid response to this type of thing.

This is a great example of a virtual patch scenario. Virtual patches are a tool that can be deployed in WAF or Analytics type systems that look for the behavior of this type of vulnerability exploit. Virtual Patching gets out ahead of the problem and allows for time to locate systems, schedule outage time and get the patches applied. If the vulnerability becomes known off-hours, virtual patching can mean the difference between a breach and a successful patch application before a breach.

How Cequence was able to help our customers with the MOVEit vulnerability

We had customers approach us for virtual patches as the exploits were being developed. Having very little to go on meant we had to be creative in finding the behaviors that would lead to a breach as well as putting in place mitigations for possible exploit paths. Additionally, we learned that these types of transactions are often completely unmonitored and having those APIs onboarded meant greater visibility into what could potentially be an attack. A hidden benefit for our customers for sure, now that visibility can inform further action.

Are virtual patches perfect? No. But if I was to compare them to the security a zipper topped Jeep might have, they do include the ability to harden the canvas and lock the zippers. Is it still possible to steal the Jeep, sure, but its much harder. As the virtual patches are applied and monitored its possible some information gets missed but a virtual patch isn’t meant to replace a software patch, it is just a step if the patching process is too cumbersome or not possible due to other constraints.

Our customers were able to stop, take a breath, approach the problem with speed and efficiency because they weren’t battling an ongoing data breach, they were simply able to watch more of the perimeter and have their internal teams do the permanent work that is needed.

Interested in finding out how we can help you, request an assessment.

The digital landscape is fraught with ever-evolving threats, making it crucial for organizations to stay informed about the latest trends in data breaches and cyber-attacks. The Verizon Data Breach Investigations Report (DBIR) serves as a valuable resource, providing deep insights into the current threat landscape. One crucial thing missing in the earlier versions of the report was the role of APIs in these incidents and breaches. We are pleased to announce that we were able to work with the Verizon DBIR team to plug this hole in the latest version of the 2023 Verizon Data Breach Investigations Report. We are also honored and humbled to be the ONLY API Security vendor in the industry to be mentioned in this prestigious report. Three key reasons for our inclusion were:

1. Cequence owns the largest API threat database in the world.
2. Data that Cequence provided was based on real threats as compared to theoretical survey-based data from other API Security vendors.
3. 24% of Cequence customers are Fortune/Global 500; bringing representation from the largest organizations on the planet facing the most advanced attacks.

As software continues to eat the world and APIs continue to take the biggest bite, they will become more prominent on both the incident and the breach front for years to come. In this comprehensive blog post, we will dive into the findings of the latest Verizon DBIR, highlighting key facts and illuminating the critical role of Unified API Protection (UAP) in safeguarding web and other applications.

Where DBIR and API Security Intersect

Here are a few observations looking deeper into the DBIR to highlight API Security specific issues:

Social Engineering Attacks and the Rise of Business Email Compromise (BEC)

The Verizon DBIR underscores the effectiveness and profitability of social engineering attacks. Notably, Business Email Compromise (BEC) attacks, a type of pretexting attack, have witnessed a significant increase across their incident dataset, representing more than 50% of incidents within the Social Engineering pattern. These attacks leverage human vulnerabilities to manipulate individuals into divulging sensitive information or performing fraudulent actions. As most of these actions go over APIs, organizations can use UAP as a last resort to stop these fraudulent transfers even when BEC and other solutions fail to protect the user.

Web Applications as a Breach Point

One of the most alarming findings of the Verizon DBIR is that a staggering 60% of all breaches occurred through web applications. According to Cequence Threat Research, as much as 80% of this web traffic comprises of API transactions. This statistic emphasizes the critical need for organizations to implement robust API protection measures. This observation is further substantiated by the 2H 2022 Cequence Threat Report, which delves deeper into the traffic analysis enabled by our advanced API Spartan detection module. Within the realm of web applications, our CQ Prime team encounters API security techniques such as fingerprint rotation, lack of human entropy, and session replay attempts on a regular basis.The report also emphasizes that DOS attacks are the primary action varieties affecting customer systems. This aligns with the research findings of the CQ prime threat research team. Public APIs belonging to our customers face highly voluminous attacks daily, with the goal of exhausting resources and causing outages. Fortunately, API Spartan platform incorporates a remarkably effective native mitigation module that successfully blocks these automated volumetric attempts. Not deploying multifaceted API protection can leave organizations vulnerable to exploitation by cybercriminals seeking to gain unauthorized access, steal sensitive data, or disrupt business operations.

Understanding the API Attack Surface

The Verizon DBIR reveals that servers represented over 80% of all reported breaches. The utilization of APIs to access server data is growing exponentially. Within the realm of data breaches, the exfiltration of Personal Identifiable Information (PII) continues to reign as the most common occurrence. This assertion is strongly supported by the significant volume of threat events we consistently thwart on APIs that handle sensitive data, including operations such as authentication, authorization, credit checks, and payment flows. It is imperative for organizations to comprehensively understand their API attack surface, including the APIs exposed to the internet and their associated vulnerabilities. Cequence recognizes the criticality of API attack surface management and provides organizations with the tools necessary to gain visibility into their API ecosystem, identify potential risks, and proactively secure their APIs.

Addressing Developer and System Administrator Errors

Developers and system administrators play a vital role in the development and maintenance of applications. However, the Verizon DBIR points out that most errors leading to breaches are committed by developers (55%) and system administrators (40%). Cequence acknowledges the significance of addressing these human errors by implementing API security posture management and API security testing. These measures help organizations identify misconfigurations, coding errors, and vulnerabilities before they are released into production, thereby mitigating the risk of data breaches.

Combating Automated Attacks and Credential Theft

The Verizon DBIR highlights that basic web application attacks, including automated brute-force attacks, remain prevalent and successful. Additionally, a staggering 86% of web application breaches involved the use of stolen credentials. Cequence recognizes the importance of real-time threat detection and mitigation to counter these automated attacks and protect against account takeover (ATO) incidents. By leveraging advanced AI-driven technologies, Cequence offers organizations the ability to detect and block automated attacks, safeguarding against unauthorized access and potential data breaches.

Combining Effective BOT Strategy in API Security programs

According to the DBIR report and the CQ prime threat research database, ‘DOS’ and ‘Basic Web Application Attacks’ have consistently been among the most active threat patterns in recent years. This observation aligns with our findings in Q2 2022, where we also encountered similar patterns involving volumetric attempts on web applications and API security techniques. The DBIR report validates two significant themes highlighted in the Cequence reports:

1. The importance of automated threat (BOT) mitigation in API security programs: The DBIR report supports our assertion that automated and native threat mitigation is of utmost importance in any API security program.
2. The prominence of Web application and API Security TTPs (Tactics, Techniques, and Procedures) in attacker strategies: The DBIR report further substantiates our findings that attackers heavily rely on Web application and API Security TTPs when targeting APIs.

Linking MITRE ATT&CK Framework, Machine Learning and API Protection

No blog these days would be complete without mentioning AI (and specially generative AI) The top techniques identified in the MITRE ATT&CK framework, as highlighted in the DBIR report, align well with the machine learning (ML) rulesets that should be part of an effective API protection strategy. Cequence UAP platform ships with hundreds of ML models used to effectively block various malicious attempts, including Credential Stuffing, Password Cracking, Password Guessing, Password Spraying, Account Guessing, Application Access Token abuse, and Vulnerability scanning. Cequence UAP’s ML-based detection capabilities ensure that these events are swiftly detected and mitigated in real-time. By leveraging machine learning algorithms, our system not only identifies and responds to current threats but also stays vigilant against future attempts by constantly adapting and evolving its detection mechanisms.

Conclusion

The Verizon DBIR provides critical insights into the constantly evolving threat landscape, highlighting the need for organizations to prioritize robust web application security and API protection strategies. Cequence’s participation in the report underscores its commitment to addressing modern application attacks faced by Fortune and Global 500 companies. By recognizing the growing significance of APIs as an attack vector and offering comprehensive API protection solutions, Cequence enables organizations to protect their applications, prevent data breaches, and maintain the trust of their customers. As the threat landscape continues to evolve, it is imperative for organizations to partner with industry-leading API protection vendors like Cequence to fortify their defenses and stay one step ahead of cybercriminals. Together, we can secure the digital realm and protect invaluable assets from the ever-present risk of data breaches.

Largest Mobile Carrier Identified 4,600 APIs
in Days, not Weeks, or Months

The security team at the nation’s largest mobile carrier had a problem trying to obtain a consistent and complete inventory of the company’s sprawling API footprint. Business critical API-based applications were driving the mobile carrier’s day-to-day business of managing their mobile network, but the number of APIs were quickly outstripping their ability to keep track of them all.

Key Objectives: A Complete API Catalog

A 2021 security team objective was to obtain a complete running inventory of all their APIs within their organization to ensure that they understood their entire API footprint. Across the organization, they had software groups that supported API application development but worked independently of each other. What resulted was shadow APIs that were not cataloged and were without the oversight of the security team. However, because so many teams were associated with API development, and in the absence of API protection solutions, the cataloging process for both managed and unmanaged APIs was difficult, time-consuming, and lacked accuracy.

Scratching the Surface

When asked how many APIs they had, the security team replied that they had roughly 100 APIs that had been documented manually. They intuitively knew that they were only scratching the surface as there were (likely) hundreds if not thousands of APIs still unaccounted for and not within their existing API catalog.

API Sentinel Automates API Discovery

Cequence introduced API Sentinel to the security team and a proof of concept (PoC) was kicked off. By deploying API Sentinel, in just a matter of days, they were able to discover over 4,600 API endpoints that were active across their infrastructure – a 98% increase in API visibility and inventory over what the security team had just days prior to the introduction of Cequence. Moreover, they were able to obtain deep security insights that included the following:

• 6 sensitive data exposure incidents where customer ID, account number and other related business sensitive data was exposed.
• 5 instances of user authentication issues where username and passwords were exposed in cleartext, information that could be read by an attacker.
• 4 fake request headers that were detected aimed at deceiving the application into processing the rogue requests to gain sensitive data.

API Sentinel Dashboard

Immediate Improvement in API Protection, Quality and Consistency

For every API endpoint discovered, API Sentinel was able to save developers hours in manually verifying the compliance of their APIs against OpenAPI specifications. In addition, this helped to create a baseline by which if a developer changed or added new headers or fields, API Sentinel could discover and catalog these changes, providing an update to the security team. This allowed the security team to proactively and continuously monitor their API endpoints for changes, ensuring that they are always up to date with the latest security state of their APIs.

API Sentinel 2 minute Demo Video

Conclusion

With Cequence deployed, they were able to obtain a continuous protection process for their APIs that included discovery, inventory, tracking, and risk assessment. As new APIs were introduced, API Sentinel was able to immediately add them to their API catalog. Software changes to existing APIs, such as parameter changes or sudden sensitive data exposure surfaced within the dashboard. The security team could now work collaboratively with the development team to highlight critical API security issues that needed to be immediately addressed before a potential API exploit could lead to a major data breach — try API Sentinel today.

Free API Security Assessment of Your API Attack Surface
Get an Attacker’s View into Your Organization

Free API Security Assessment

API threat research by the Cequence CQ Prime Threat Research team during the second half of 2022 confirms that API security and API attack mitigation are two sides of the same coin, and both are essential to ensure the security of APIs. Attackers continue to use tried and true techniques to find and exploit shadow APIs, with the team observing 45 billion search attempts for shadow APIs over six months.

In addition, with data from approximately one trillion transactions spanning a variety of industries, the team found that attackers are relentlessly modifying their payloads, with new and unique fingerprints providing valuable insights into the tenacity and sophistication of their tactics, techniques, and procedures (TTPs).

• New OWASP API threat category: lack of protection from automated threats: The CQ Prime Threat Research team mapped its observations for the second half of 2022 to the proposed API8:2023, Lack of Protection from Automated Threat category in the OWASP API Security Top 10 2023RC. The findings confirm that automated attacks and API security are complementary and necessitate a robust API security program with API attack mitigation capabilities.
  

• 900% increase in attackers looking for shadow APIs: The threat landscape of shadow APIs has become increasingly alarming. In the second half of 2022 alone, approximately 45 billion search attempts were made for shadow APIs, marking a 900% increase from the 5 billion attempts made in the first half of 2022.
  

• Holiday shopping sees a 550% increase in API threats: Attackers are particularly active during the holiday season when high-value products are frequently introduced. For example, the data shows that the number of unique TTPs employed by attackers, rising from approximately 2,000 in June to a staggering 11,000 by mid-November 2022.
  

• Attackers Increasingly Combine API and Web Application Security Tactics: From June 2022 to October 2022, attackers favored traditional application security tactics; however, as the holidays approached, there was a 220% surge in API security tactics like anomalous traffic.
• Mobile devices continue to be extremely valuable for attacks: The constant stream of attacks on the telecom industry has created a common misconception that they lack adequate security measures. They are a high-value target due to the scope of their attack surface area and the value of the attack target – our mobile devices. These devices with varying service configurations contain user information and phone numbers that’s extremely valuable to attackers.

Protecting your APIs from Relentless and Sophisticated Attacks

Having a complete understanding of how correctly coded APIs and those with errors can be attacked is critical to protecting your APIs from exploits and abuse. Armed with this understanding security operations and development decision makers and practitioners can make great strides to complete API lifecycle protection as a key initiative. Organizations looking for end-to-end API protection, including automated attack mitigation should look for solutions that allow them to discover their APIs, assess risks and enforce compliance while natively detecting and mitigating automated attacks and vulnerability exploits.

• Discover: Right from the moment that a private, public, or partner API is used by developers as part of their application development there must be a way to discover and inventory all APIs. An often-overlooked aspect of discovery is determining the unknown attack surface – most organizations are unaware of how many shadows, hidden, deprecated, and third-party APIs they have, leaving many unprotected.​
• ​Comply:​ Then there must be a way to assess that API inventory for risk, using API security testing to ensure compliance with secure API specifications and being able to test APIs before they go live. In addition, detection and remediation of coding errors, lack of best practices, or improper training can lead to vulnerabilities easily exploited by bad actors.
• ​Protect:​ APIs enable high speed communication often to back-end systems making them prime targets for automated attacks and business logic abuse, even when perfectly coded. Attackers are relentless as they execute business logic abuse such as stolen credentials or broken authentication processes to exploit APIs, commit theft, fraud, data exfiltration and business disruption. There must be a way to leverage threat intelligence to quickly detect abuse and natively block the bad activity.

Organizations with complete API visibility have a greater awareness of the types of threats they may face and the relative risks to their APIs. They can then use this knowledge to inform their ongoing efforts to detect advanced threats and prevent attacks from granting threat actors access to their data and networks.

When it comes to the global financial services industry which includes banks, credit unions, exchange houses, finance companies, payment card issuers, and insurance companies, API security is a top priority. It only takes one data breach or persistent fraud because of an API exploit or abuse to damage an organization’s reputation and get the attention of industry regulators.

Financial Services Require APIs to Transact Business

APIs have become a core piece of the financial services industry, ensuring connectivity for mobile applications and peer-to-peer payment systems. APIs are at the center of open banking and enable companies to standardize how they connect and exchange data, allowing information to be instantly shared across organizations and third-party service providers. With a dynamically changing list of partners and technology suppliers, API connections are being continuously added to the financial ecosystem.

The problem is that ever-opportunistic attackers are paying attention to this vast and increasing number of API in use by the industry. They are exploiting incorrectly coded or configured APIs or leveraging business logic abuse such as stolen credentials to commit theft, fraud, and business disruption.

The potential top API vulnerabilities listed in the OWASP API Security Top 10 illustrate the opportunities for successful data breaches, and if attackers aren’t sophisticated, they can be relentless. And with financial services businesses, dealing with trillions of dollars, there’s money to be made.

It’s Complicated: Protecting Private, Public, and Partner APIs

Industry regulators are taking notice to promote standards for providing safe and robust APIs that can accelerate the adoption of financial services innovation yet at the same time, ensure API security and secure data. For example, the Federal Financial Institutions Examination Council (FFIEC) updated its cybersecurity guidance, calling out potential data breaches due to broken, exposed, or compromised APIs. This guidance describes a range of procedures to help financial institutions defend against API attacks such as inventorying APIs to identify potential vulnerabilities and reduce exposure. In other regions of the world, the Securities and Commodities Authority (SCA) is a federal financial regulatory agency in the United Arab Emirates and has issued guidance on the application of the key principles covering the use of APIs.

The problem is that trying to stay ahead of attackers means protecting APIs across the entire API lifecycle. These and other guidance call out the extent to which API protection is expected. They include conception and the formulation and design of an API; production and the development and testing of an API; publishing and the steps taken to make an API available for use; consumption and the use of an API; and retirement in terms of the withdrawal of an API from use.

The pressure to meet the requirement to protect APIs in the financial services industry is compounded even more when considering the several types of APIs must be protected. They include private APIs used within an organization to provide interoperability between internal applications to help transaction automation and provide flexibility. In addition, there are partner APIs used to integrate software between a company and its partner, often for a specific purpose such as providing a product or service. Last, there are public or open APIs designed to be easily accessible by the wider population, regardless of whether a business relationship has been established or not.

API Security and the Need for Proactive API Protection

Traditional approaches to security won’t work for API security in the financial services industry. For example, the industry is required to meet unique data security requirements such as Payment Card Industry Data Security Standard (PCI-DSS) that focus on protecting data both at rest and in motion. In the financial services industry, substantial amounts of data can be stored on devices that are not transferred from device to device or network to network. It includes data stored locally on computer hard drives, archived in databases, file systems, and storage infrastructure. Yet, facilitated by APIs, data can also be moving from one location to another, whether it’s between computers, virtual machines, from an endpoint to cloud storage, or through a private or public network. This movement and storage of data, helped along by APIs, means that protecting APIs from attack and abuse, and consequently detecting data exposure can be much more complicated.

Why is API Protection Such a Problem?

First, most organizations are unaware of how many shadow, hidden, deprecated, and third-party APIs they have, leaving many unprotected. Cequence Security has reported that over 50% of APIs are unknown or shadow APIs and 31%, or five billion of 16.7 billion malicious transactions targeted unknown, unmanaged, and unprotected APIs. Second, developer errors, lack of best practices, or improper training can lead to vulnerabilities easily exploited by bad actors. Third, even perfectly coded APIs can lead to data breaches and disruption from automated attacks and business logic abuse.

Traditional approaches to API security include web application firewalls (WAFs) that use signatures to detect known vulnerabilities as described in the OWASP Web Application Top 10 Threats list. WAFs will struggle to find and block API attacks that appear legitimate, and they are unable to address the visibility, inventory tracking, risk assessment and threat prevention requirements necessary to protect APIs. API gateways are reactive in nature, requiring developers to register the APIs to be managed. Often deployed within the infrastructure, at a department level, or in a cloud environment, API gateways are inadequate tools for gaining complete visibility, inventory tracking, risk assessment, common security policy enforcement and threat prevention requirements necessary to protect APIs.

Ensure API Protection for the Financial Services Industry

For the financial services industry what’s needed for API protection is a way to constantly discover all APIs, and then inventory, assess, and fix the broken ones. Next, there needs to be a way to ensure that an organization can comply with API coding specifications, along with industry guidelines and regulations. Finally, and perhaps most importantly, there needs to be a way to protect all APIs from automated attacks and business logic abuse. In fact, the proposed OWASP Top 10 API Security Risks for 2023 reinforces the need to address automated attacks specifically calling out “Lack of protection from automated threats” as a top ten risk.

This discover, comply, and protect approach will result in the strongest API protection for the entire lifecycle.

The good news is that Cequence Unified API Protection covers all the bases. In fact, it’s a one-stop location for all things API protection.

With the Cequence approach you’ll continuously discover APIs using machine learning-based attack surface discovery. Pre-defined, imported or dynamically generated API tests helps security and development teams quickly comply with specifications and regulations by uncovering and remediating API vulnerabilities including OWASP API Top 10 risks. Vulnerabilities are detected with enhanced detection capabilities and layered with deep contextual analysis. The solution leverages monitoring, profiling of APIs, and applications to protect from API-related threats.

Cequence Unified API Protection – API Security

The Cequence approach to API protection helps enable a collaborative effort for API security that includes developers, application owners and the security team to accomplish the following:

Discover

Gain an understanding of your public-facing API footprint to see what an attacker may see. In addition, complement an external view of your APIs in your network and related resources with a comprehensive inside-out API inventory, including all existing APIs and connections.

Comply

Continually analyze existing and new APIs to keep them in compliance with specifications such as the OpenAPI specification and ensure high API coding quality, consistency, and governance. And with ongoing API testing you’ll integrate API protection into development to complement API security efforts within the organization, so risky code doesn’t go live.

Protect

Even perfectly coded APIs can be attacked, so it’s critical to continuously scan your entire API inventory and API traffic for threats, including your API transactions for subtle business logic abuses and malicious activity that has not yet been observed. Then, it’s critical to be able to respond quickly and natively with countermeasures such as alerts, real-time blocking and even deception, without the need for added third-party data security tools.

Unified API Protection is different from fragmented or incomplete API protection offerings because it’s a methodology designed to account for multiple types of risk, across every phase of the API protection lifecycle. In the financial services industry, security teams deploying Cequence Unified API Protection (UAP) enable their organizations to help protect customer data and quickly block API-related fraud activity.

API protection is important to ensure the security of financial transactions and the privacy of individuals. Financial companies must protect sensitive information such as personal and financial data. Failure to do so can have profound consequences for both the financial company and its customers. Therefore, it is important to ensure that APIs are protected throughout their lifecycle.

Get Started Today with the Cequence Unified API Protection Solution.

Get a Free Security Assessment of your API attack Surface

Cequence, the largest API security company in the world is powering up at booth 0455 at the RSA Conference talking to cybersecurity professionals and enthusiasts from around the world about API security.

With API security the number one topic, along with artificial intelligence, and the potential benefits in the field of cybersecurity top of mind at RSAC, Cequence is showcasing our AI-powered Unified API Protection (UAP) solution which helps organizations discover all APIs, ensure these APIs comply with industry and government regulations, and detects and prevents automated attacks in real-time. It was only a week earlier that the Cequence approach to API security was validated with a strategic investment from the venture capital program of Hewlett Packard Enterprise (HPE) and an investment from Prosperity7 Ventures.

Proactive Measures to Protect APIs

Cequence is getting plenty of traffic where we’re demonstrating our use of AI and machine learning algorithms to analyze traffic patterns and identify malicious API attacks, allowing companies to take proactive measures to protect their APIs. We’re also giving away power up swag like our popular artist-customized water bottle.

Sessions Covering API Backdoors and Threat Intelligence to Protect APIs

Today, we have a live session covering the API backdoors to an organization’s data. Tomorrow, we’ll have more sessions covering the use of threat intelligence to protect APIs. Learn how Cequence leverages a threat database with 70 million+ malicious IPs, curated over the last 6+ years, to protect your APIs.

The API Backdoors to Your Data – Booth 0455
Jason Kent, Hacker-in-Residence
Wednesday, April 26 at 4:30PM

Network-IQ: Using Threat Intelligence to Protect APIs – Booth 0455
Zack Kaplan, Software Engineer, CQ Prime
Thursday, April 27 at 1:30PM

At the end of each presentation, we will be giving away a PlayStation 5. Here is a photo of yesterday’s winner and excitement at the booth.

Learn About Addressing API Vulnerabilities Before Deployment

Another hot topic at the 2023 RSA Conference was the continued use of DevSecOps to speed up development processes, and the need for security to be integrated into the development lifecycle. The Cequence security experts are showing how Cequence API Security Testing can implement security into DevSecOps workflows to identify API vulnerabilities allowing them to be addressed before deployment.

It’s safe to say that Cequence is one of the companies making waves with their innovative approach to API security. As companies continue to face ever-evolving cyber threats, solutions like Cequence’s will become increasingly crucial in protecting their applications and data.

Visit booth 0455 and meet with API security experts today!

APIs used in connected vehicle systems offer points of entry for hackers and other malicious actors to exploit cars, trucks, telematics devices, and fleet management operators. In this blog you’ll learn what’s needed for an effective API security program to ensure vehicle safety and security for the entire API protection lifecycle.

The average vehicle has over one hundred million lines of software code used by dashboard-controlled air conditioning, audio, and navigation systems. In addition, software is involved in electronic control units (ECUs) that control engine functions, regulate braking behavior, and monitor the air conditioning system.

Connected Vehicles Rely on APIs For Basic Functionality

These systems are connecting to smartphone apps, along with third-party applications for diagnostic and maintenance scheduling, updating vehicles from the cloud, and autonomous driving. All this communication activity for connected vehicles is often glued together using thousands of APIs that allow the various systems to interact with each other to provide better functionality and performance.

Access and Control Vehicles by Exploiting API Security

This increasing use of APIs and 5G technology in the automotive industry present a growing attack surface for organizations and offer attackers a scalable and fully remote way to cause disruption and steal data.

Security researchers revealed the ability to access and control multiple vehicles by exploiting an API’s broken object-level authorization (BOLA). This is a common API vulnerability listed in the OWASP API Security Top 10: API1:2019 Broken Object Level Authorization

The researchers found that sending an API request, via a telematics service provider, with the VIN on a unique ID field enabled them to remotely start, stop, lock, and unlock vehicles. Exploiting other API flaws allowed the researchers to access PII (personally identifiable information) for owners of several global automobile brands.

While obtaining PII without permission is unacceptable for any customer, for the most expensive car brands, the ability to disclose owner information, from more high-profile individuals, with data that includes sales information, physical location, and customer addresses, could be particularly damaging to a business’s reputation.

This research shows that when it comes to API security, this industry is no different, and the OWASP API Security Top 10 vulnerabilities will also apply.

Fleet Management and Increased API Security Risk

Like car and truck manufacturers, fleet managers who oversee car leasing, commercial shipping companies and government agencies are now managing fleets that are more connected than ever and utilize data transmitted from telematic devices to improve services and revenues.

Similarly, this increased connectivity has introduced API-related cyber risks and the impact of a breach can be much more when compared to consumer’s connected vehicles. This is because fleet management can be considered as critical infrastructure with fleets transporting anything from food and vegetables to pharmaceuticals and natural resources.

Because fleet managers are using in-vehicle devices that connect with backend management systems and mobile applications, all enabled by APIs, they’re creating the opportunity for a large-scale attack via a non-secured API, similarly resulting in vehicle theft or data misuse.

The Problem with Private, Public, and Partner APIs

Thus, API security is crucial in the automotive industry because it protects the data and privacy of car owners and ensures that the car’s software and systems are secure from external threats ensuring products are safe and reliable.

The problem is that APIs have become so prevalent, and whether they are private, public, or partner APIs, some organizations may be unaware of all of the API’s that their vehicle control systems or applications are using.

Cequence Security has reported that over 50% of API’s are unknown or shadow API’s and roughly 31%, or 5 billion of 16.7 billion malicious transactions targeted unknown, unmanaged and unprotected APIs, commonly referred to as shadow APIs

What’s more even when all APIs are known and perfectly coded with no misconfigurations or compliance issues, attackers can still abuse them. Attacks on well-formed APIs are a common occurrence because the attackers exploit the same nonfunctional requirements that developers love about APIs – flexibility, speed and ease of use.

Ensure Vehicle Safety and the Protection of Information

So, what can be done to ensure vehicle safety, and the protection of driver and vehicle information caused by miscoded or abused APIs?

Because attackers do not adhere to a top 10 list, and perfectly coded APIs, whether open source or proprietary, are susceptible to attacks, API protection needs to begin with discovering, identifying, and inventorying your API footprint.

Once the API estate is known, continuous risk analysis can be performed to uncover and remediate sensitive data, authentication or specification non-conformance related coding errors for production and nonproduction APIs. This middle phase of the API protection journey also incorporates runtime attack detection. API protection for cars, trucks, telematic, and fleet management systems should include a focus on the OWASP API Security Top 10 list of potential vulnerabilities. This approach enables stakeholders to increase security posture by effectively identifying misconfigurations, threats, and risks related to vehicles.

Then, employing countermeasures such as real-time blocking or deception without the need for added third-party data security tools, combined with ongoing testing to ensure risky APIs do not go live make up the last phase.

API Security for Cars and Trucks

5G technology enables vast amounts of data being exchanged to monitor everything from driver safety to goods and asset tracking. All of this rich information exchange requires APIs to be secure, free of vulnerabilities and continuously monitored.

To combat the ever-present risk to vehicle and passenger safety, along with protecting customer data that is evident with APIs, requires a unified and integrated approach that works across the entire API protection lifecycle, across all API automotive system implementations.

The good news is that Cequence Security has taken the approach of enabling API protection for the entire vehicle, consumer, and applications API lifecycle. With this approach APIs related to the operation of cars and trucks are continuously discovered using machine learning-based attack surface discovery. Pre-defined, imported or dynamically generated API tests helps security and development teams quickly uncover and remediate API vulnerabilities including OWASP API Top 10 risks. Vulnerabilities are detected with enhanced detection capabilities and layered with deep contextual analysis. The solution leverages monitoring, profiling of APIs associated with vehicles, consumers, and applications to detect API-related automotive threats.

The Cequence approach helps enable a collaborative effort for connected vehicle API security that includes developers, application owners and the security team to accomplish the following:

• Outside-in discovery: Gain an understanding of your public-facing API footprint for your connected vehicles to see what an attacker may see.
• Inside-out inventory: Complement an external view of your APIs in your network and related resources with a comprehensive inside-out API inventory, including all existing APIs and connections.
• Compliance monitoring: Continually analyze existing and new APIs to keep them in compliance with specifications such as the OpenAPI specification and ensure high API coding quality, consistency, and governance.
• Threat detection: Even perfectly coded APIs can be attacked, so it’s critical to continuously scanning your entire API inventory for threats, including your API traffic for subtle business logic abuses and malicious activity that has not yet been observed.
• Threat prevention: It’s critical to be able to respond quickly and natively with countermeasures such as alerts, real-time blocking and even deception, without the need for added third-party data security tools.
• Ongoing API testing: Integrate API protection into development to complement API security efforts defined by shift left efforts within the organization, so risky code doesn’t go live.

Unified API Protection is different from fragmented or incomplete API protection offerings because it’s a methodology designed to account for multiple types of risk, across every phase of the API protection lifecycle. In the automotive industry, security teams deploying Cequence Unified API Protection (UAP) enable their organizations to help ensure vehicle safety, and customer data.

The Cequence UAP creates a complete runtime inventory of all managed and unmanaged APIs, known and previously unknown. Discovered APIs risks are flagged for remediation while sophisticated threats are detected and mitigated in real time. The result is complete protection from API threats that cause data loss, theft, fraud, and business disruption.

Overall, API security is a critical issue for the automotive industry and connected vehicles, and manufacturers need to take it seriously to protect their customers and ensure that their products are secure, safe and reliable.

Get Started Today with the Cequence Unified API Protection Solution.

Get a Free Security Assessment of your API attack Surface

API security is a top 2023 security initiative for many organizations, given the continued increase in API usage and the API breach activity observed in 2022. Since more and more organizations are starting API security programs, I thought it might be prudent to provide a 30-60-90 day framework that we are all pretty familiar with. For simplicity sake we will assume a green-field API security program, meaning the organization is developing applications with exposed APIs and an API security program is in its infancy. We also should note that API security, like any other form of network security is a continual process – you won’t be done in 90 days, but you will have established a foundation.

Your First 30 Days: Ask “Where am I with Application Security?”

By this we don’t mean physically, we mean, what assets do you have to complement your API security program. Your first 30 days should be used to learn how good or bad things are. Examples include what the culture is like, what the focus has been and where are you going to start. Key learnings should include historical practices, what do role do different teams and individuals play in the API security lifecycle. What can you draw on, and who do you have as champions or supporters. Within the first 30 days your goal should be to understand:

• Do we have an inventory of our public facing or 3rd party APIs?
• Do we have historic penetration tests or security audits for these APIs (Establish the gap)?
• Have we completed a data audit to know what sort of data is used by our APIs?
• Who is interested in API security and can you include them in the next phase?
• Your first 30 days should define the things that you want to accomplish in the next 30 and the following 30. Keep in mind, every organization is different but that doesn’t mean a framework won’t help.

Your 60 Day API Security Program Goal: Establish the Application Security Infrastructure

The first 60 days are getting things answered and/or setting things into motion. This means getting to know the stakeholders and how you can enable them to make the business and your API security program successful. Quick wins are important and one of the easiest is to identify a way to simply find and categorize all your APIs. API visibility is the most critical phase of any API security initiative. The reason is obvious. Unknown, unmanaged APIs, also known as shadow or zombie APIs cannot be protected and are a prime attack target. Many organizations will begin using a manual process, which is a good start, but can quickly be out of date with the next API release cycle. Having a complete inventory and knowing where the APIs are will streamline your API security program execution and is best achieved with an automated API discovery tool.

As a reminder, a 30-60-90 plan is really a map created to guide you and your organization towards improving your API security. Many of the things that are achieved in the first few months, set the stage for things going forward. By the end of your first 60 days you should aim to:

• Complete an API Inventory and derive possible next steps (e.g., remove old API subdomains, retire zombie or deprecated APIs, standardize endpoint security paradigms, etc.)
• Set in motion the people side of your API security program, it could be getting the right people to the right meetings with the right goals. People are the way your API security challenges will be addressed and your team will develop the processes that work.
• Add API specific training for all parties – development, security, operations – APIs are different than web apps and knowing how to treat APIs is a critical success factor.

Start looking at the long term technology items. Is there a tool or vendor that can shoulder some of your API security workload? What does success with them look like?

Your 90 Day API Security Program Goal: Lay the Groundwork

The last 30 day block of your 90 day plan should be spent confirming you are on track with status reviews while looking at longer term roadmaps with the right People, Processes and Technology. There are obvious things that will be in motion now and it is a good time to establish processes for re-evaluation of the businesses goals established earlier and how you are meeting them. By the end of 90 days, you will want to make sure the organization is still on the same path and the objectives make sense. At the end of 90 days you have the understanding of:

• Where your APIs are, what data they contain, how they are developed and tested.
• Are your APIs documented consistently, is there a mechanism for updating?
• If your logging is sufficient to identify potential threats or identify points of compromise.
• Do you have a set security standard for API development for minimums like Authentication and Authorization?
• Do you have coding standards in place, have you adopted an API specification framework to improve consistency, quality, and security?

By putting an API security plan into motion, you are laying the groundwork for having a complete API picture and how you can address the risks to your business as you move forward.

API Security Solution Recommendations

With the people and processes in place to move your API security program forward, many organizations will look at adding technology to the mix to improve efficiency. Recommendations are to look for an API security solution with a unified and fully integrated approach that works across the entire API protection lifecycle, protecting all APIs, across all API implementations, channels, and infrastructure environments. The approach must discover and create a complete runtime inventory of all managed and unmanaged APIs and provide comprehensive API protection including not just complete discovery and runtime inventory, but compliance monitoring and remediation, threat detection, and inline, robust threat prevention.

This unified API protection solution would need to deploy and scale quickly, easily and cost effectively without the need for intrusive instrumentation or sensors that slow development and deployment and prevent effective scaling. Lastly, the approach must protect against today’s agile, sophisticated, and persistent attackers and their always changing attacks through native, real-time attack detection, alerting, and inline stealthy mitigation that leverages ML, AI, and global API threat intelligence to fingerprint and identify attacks well beyond evadable, least common denominator domain-based signatures.

Learn how customers are leveraging security automation to accelerate bot attack response time and improve their API security posture. In effect, customers can fight fire with fire by using automation to block (automated) bot attacks like account takeover, shopping bots and loan fraud.

Every IT security professional I know, or meet is overworked. This is not just people just saying they are busy for the sake of it. This is real – late nights, weekends, holidays on call – working. Validating what I am hearing is data from the 2022 (ISC)² Cybersecurity Workforce Study, which states that there are 3.5M unfilled IT security jobs. This equates to roughly 41% of the 8.1M available positions. No wonder all my friends and our customers are overworked.

To make matters worse, many of the daily tasks are manual and repetitive, introducing unreasonable delays, injecting errors into the process and reducing an organizations competitive stature. Research shows that tedious, repetitive tasks within an organization can drive employees away, and for your business that can mean you aren’t getting the return on investment you expect for the smart people you hire. Enter automation – a process historically proven to improve productivity by minimizing human interaction required to accomplish a given task.

Automation was a key topic during a recent business trip where I had a chance to speak with a couple of dozen CISOs. They resoundingly said that one of their top 2023 business initiatives was automation, specifically security automation. Why? Because they want to focus their staff on more interesting, challenging things that cannot be or are not yet automated. To get to this point though, you first need to get rid of the tedious, mundane, multi-step tasks that are burning their time. The opportunity for automation is significant. Any process done manually, and on a regular basis is low hanging fruit with other, less frequently but also manual processes an additional longer-term opportunity.

Threat actors have long used automation by scripting attacks – both large and small – with shopping bots the most well-known example. Your daughter did not lose her chance to see Taylor Swift because her friend was faster at hitting the buy button. She lost because she was competing with millions of bots operating at computer speed.

API Security Automation Enables Successful Hype Sales

API security automation plays a key role for our customers in successfully detecting and mitigating automated bot attacks on their APIs. Obvious examples are hype sales or drops where much-anticipated products are brought to market. During the pandemic, hype sales extended to toilet paper but more often than not today they gaming consoles, concert tickets, and shoes. With success measured not only in sales and revenue, but end-customer satisfaction, it becomes critical for the offering organization to leverage automation to create an environment where the bots don’t win.

As an example, prior to deploying the Cequence Unified API Protection (UAP) solution, one of our retail customers would need to manually scale their platform by 400% for each sale event. During the event, it was all hands on deck to maintain system operations while their platform was pummeled by bots. This manual effort placed significant limitations on how frequently they could execute their hype sales, resulting in revenue expectation and vendor relationship challenges.

Once the UAP was deployed, our CQ Prime Threat Research team worked closely with the customer to map out the hype sale process and identify simple ways to get rid of the bots. The steps were then automated to where the customer is now able to execute a hype sale at any time of the day, without needing to manually pre-scale or call for all hands on deck. They simply load some information about the hype sale into a system, this triggers alerts that a drop is happening and automation scales the UAP solution accordingly. During the hype sale, automation is used to monitor the malicious traffic, making real-time adjustments to mitigation responses based on bot behavior. Even if the bots change IP addresses, API paths, user agents and so on, the UAP sorts through the noise by automatically adjusting policies to drop unwanted traffic. The customer is able to launch new products to market while the UAP ensures the bots are mitigated and humans can purchase the items they want.

Automating API Security to Fight Loan Fraud

One of our financial services customers regularly handles a large number of fraudulent loan applications. Prior to deploying the Cequence UAP, the loan application legitimacy was determined manually, overwhelming the fraud team during promotional events. Today, all digital loan applications are analyzed by the Cequence UAP, with potentially fraudulent loans tagged for analysis by their fraud analysis platform and if needed, manual review. This process reduces the need to review every loan document and frees up reviewers for loan applications that are actually fraudulent. This is automation augmenting a manual review to reduce errors.

API Security Automation Instantly Mitigates Account Takeovers

Many of our customers enjoy the automatic protection our Confidence-based mitigation provides. ML analysis by CQAI determines the likelihood (Confidence) that traffic is malicious and policies are implemented to mitigate the traffic automatically, eliminating any manual traffic analysis. Additional signals and criteria can be layered in to build detailed policies that will drop malicious traffic. One of our retailers had an Account Take Over campaign hit their login flows and our systems picked it up automatically based on rates of failed login attempts, overall login attempts and an understanding that usernames should only come from a certain number of IPs. When combined, each transaction was rated and confidence scores applied. Confidence based policies are great for a number of transaction types and often result in an attack campaign writer getting frustrated with retooling attempts not working.

These are just a few examples of the way in which security automation helps customers do more with less in the battle against malicious (automated) bots. Security teams are less involved in the mundane, repetitive tasks and are now able to chase down the real problems. If your goals for 2023 include creating or implementing automation keep these key steps in mind.

• You need to have a manual process that can be integrated into technology.
• You need to understand the metrics that you would like to improve.

It’s possible that you already have mechanisms in place to trigger automation and you just need a partner that will complete the story.

Schedule a customized demo today

A large global investment firm operates globally with over $7 trillion dollars in assets. It offers a wide variety of financial products to over 30 million retail investors that rely on this firm to manage their investment and retirement accounts. Their clients expect easy, secure, and uninterrupted access.

Key API Application That Powered Customer Access

The investment firm utilized a highly scalable enterprise grade API application to provide access to their 30 million retail investors. Due to their large asset size, they had become an attractive target for cybercriminals to initiate rolling account takeover (ATO) attacks that aimed to gain unauthorized access to customer accounts and their financial portfolios. Once compromised, it allowed cybercriminals to exfiltrate money out of retail accounts for illegal financial gain.

More Than Just an Attractive Target

For the firm, detecting ATO attacks had become a mission critical function whose responsibility was held within the fraud team. Every successful fraud attack on the investment firm’s online retail accounts would erode customer confidence, increase customer attrition, and damage brand image.

To prevent fraudulent transactions, the fraud team relied on identifying suspicious logins on their application programming interface (API) endpoints. Their existing solution, a post-forensic tool would only provide a raw dump of transactions for the day, and it would take a fraud analyst several hours to analyze all the data for malicious activity.

This was time-consuming and exhausting work that placed enormous pressure on the fraud team. These attacks had even gained the attention of the senior executive team, placing pressure on the security team to deploy a security solution that could detect ATO attacks faster before they could potentially compromise their retail investors.

Setting Serious Security Goals

The security team had devised a set of requirements that were used to help choose a security solution that could faster detect malicious activity to user accounts. They were looking for a security solution that could help achieve the following:

• Faster Fraud Detection: Enable faster fraud detection reducing the amount of time required to detect fraud attacks.
• Minimize Manual Analysis: Implement an automated solution that could minimize the manual work that fraud analysts were doing every day, that was taking up to 3 hours a day.
• Move to Proactive Security: Security team wanted to move away from constantly being in a reactive security mode to a more proactive security mode.

Cequence Blocks Fraudulent Activity Through API Protection

The security team had chosen Cequence from a select set of API security vendors to reduce the time to detect fraudulent login activity on their API application. Working together, Cequence worked with the security team to configure and deploy API Spartan, a component of Cequence Unified Protection (UAP) in front of their mission critical API application. The results were immediate.

After implementing Cequence UAP, they were able to achieve the following:

• Faster Fraud Detection: Cequence was able to reduce fraud analysis time, shaving off hours of analysis time each day.
• Automated Analysis: By implementing Cequence, they eliminated hours a day of manual analysis that allowed them to focus on a narrow set of high probability fraud transactions.
• Powerful Security Policy: Cequence offered a powerful security policy language that allowed them to create custom security policies that could pinpoint targeted attacks.
• Easy Deployment: Unlike other fraud detection solutions, Cequence required no mobile SDK or JavaScript instrumentation to work.

Conclusion

For the investment firm, deploying Cequence UAP enabled the fraud team to respond faster to ATO attacks, reducing threat detection time from 3 hours to 30 seconds a day. The fraud analysts were now more productive, responding to ATO attacks much sooner rather than spending hours each day sifting through thousands of transactions to determine which logins were malicious. They were now able to constantly monitor the login activity to their API application, ensuring that only legitimate retail investors had access to their own online retail accounts, surfacing malicious ATO attempts almost immediately to the fraud team.

Learn more about how Cequence helped this investment firm achieve API protection.

Free API Security Assessment of Your API Attack Surface

Get an Attacker’s View into Your Organization

The Cequence Unified API Protection solution integrates with a wide range of API gateways, complementing their API security features with API discovery, risk analysis and threat protection. API gateways are a key element in the quest for API security and API protection, acting as the focal point for API calls between the client and the application and providing standardized access control for applications, data, and service. In simple terms, API gateways are traffic managers that facilitate data exchange between APIs within and outside the business.

Secure Your APIs with API Gateways and API Security

Developers love APIs because of their inherent flexibility and power – each API includes all necessary commands, payload, and data to produce engaging user interactions. However, the wide-spread use and the all-inclusive nature of APIs makes them a high value target for attackers who use their developer skills to take advantage of common API security gaps that include:

• Unknown attack surface: Most organizations are unaware of how many shadow, hidden, deprecated, zombie and 3rd-party APIs they have, leaving many unprotected.
• New exploit opportunities: Developer errors, lack of best practices, or improper training can lead to vulnerabilities easily exploited by bad actors.
• Breaches and disruption from automated attacks: APIs enable high speed communication often to back-end systems making them prime targets for automated attacks and business logic abuse, even when perfectly coded.

API gateways are often included in the API security conversation, however their role in protecting an organizations entire API estate is limited for several reasons. First, API gateways are often deployed across an organization, often times from multiple vendors making complete API discovery and visibility an ongoing challenge. Second, API gateway security functionality is limited to basic access control and rate limiting, falling short of the ability to uncover and protect APIs from vulnerability exploits and advanced bot attacks. Lastly, the act of mitigating an attack often requires that the API gateway signal a third-party web application firewall (WAF) or other security infrastructure component, introducing numerous challenges for security teams.

Check out our Growing List of Technology Integrations

How Cequence Unified API Protection Complements API Gateways

Much like how peanut butter and jelly, or chocolate and red wine complement each other, the Cequence Unified API Protection (UAP) solution complements the native security features found in most AP gateways with full API protection lifecycle coverage, eliminating any reliance on third-party tools such as a (WAF. The Cequence UAP integrates with leading API gateway offerings from Apigee, Kong, MuleSoft and Software AG to provide customers with both API management and API protection. Using either an inline or passive deployment mode, or a combination of both, the Cequence UAP integrates with all your API gateways, regardless of location or vendor. Complementary features include:

• Discover Public Facing API Attack Surface: API development and deployment is often distributed across many groups, introducing the risk of APIs deployed outside of the API gateway purview. The Cequence UAP solution solves that challenge by continuously assessing your public facing APIs and resources to provide an attackers view of your organization’s attack surface, including cloud hosting services, any associated API endpoints, and servers that may be vulnerable to Log4j and LoNg4j exploits.
• Centralized Inventory Tracking of Known and Unknown APIs: For organizations with many API gateways, the Cequence UAP solution provides centralized API visibility and inventory tracking of all the APIs that have been registered with the respective gateways. Unregistered or unknown APIs are also discovered, allowing security and development to migrate those shadow APIs to the respective API gateway to ensure security and governance policy consistency.
• Strengthen Compliance and Data Governance Controls: Cequence extends any compliance and governance controls provided by the API gateways with proactive API risk analysis and remediation. Predefined and custom risk assessment rules help organizations teams find and remediate coding errors that introduce sensitive data handling and authentication vulnerabilities that can lead to data governance and compliance violations.
• Detect Sophisticated API Attacks: Going beyond basic volumetric protections that most API gateways provide, Cequence UAP uses ML-based analysis based on a threat database with millions of records and behavioral fingerprinting to detect and continually track sophisticated API attacks as they retool to evade detection.
• Flexible, Real time Mitigation Responses: Real time responses to API attacks range from basic block and rate limit to HTTP header insertion and deception, all executed in real time, per policy or per app, without reliance on integration with third-party WAFs.

Review the API gateway integration guides for Apigee, Kong, MuleSoft and Software AG to learn how the Cequence UAP complements your API gateway, much like ice cream and pie.

Schedule your personalized Unified API Protection solution demo today.

We are excited to announce Unified API Protection v2.0, the latest release of our market leading API security platform. Unified API Protection v2.0 adds dynamic API Security Testing to the platform to help security and development teams find and remediate API vulnerabilities before they are released to production. In addition to the new API Security Testing product, this release includes API discovery, risk analysis and protection enhancements that will help customers accelerate their 2023 API protection initiatives.

API Security Testing

We’re launching a new API Security Testing solution that will enable security teams to deploy continuous integrated testing for their pre-production continuous integration and deployment (CI/CD) environments to detect Open Web Application Security Project (OWASP) API risks. The new API Security Testing solution complements and extends Cequence API Sentinel ability to discover and manage the inventory of pre-production APIs and compare against those in the production versions. API Security Testing detects security risks in pre-production APIs, such as shadow API endpoints, sensitive data exposure and the rest of the OWASP API Top 10 risks so that security teams can remediate them before the APIs are released to production.

The following capabilities of API Security Testing are now available:

• CI/CD Integration of Pre-production Environments: This enables customers to integrate API Security Testing into any CI/CD pipeline environment such as GitHub, Gitlab or Jenkins. Using Cequence-provided containers, customers can integrate and customize the configuration in their environments.
• Visualization of Test Results: This enables security teams to view the results of each test run and the security issues raised in it. The results are exportable to allow sharing with API owners and development teams who can then remediate the respective findings.
• Comprehensive Detection of OWASP API10+: The list of security tests covers the OWASP API Security Top 10 and attacks that target APIs that are coded correctly, properly inventoried and are not susceptible to any of the OWASP API Security Top 10 threats. The list is customizable for each run and allows security teams to customize the security checks for different API groups, including adding new ones to the pre-defined catalog of API risk categories.

Cequence API Security Testing showing CI/CD integrated test runs

For more information, reach out for a demo of this exciting capability.

Zero-touch API Discovery and Shadow API Notifications

We launched API Spyder in June 2022 to allow organizations to discover their exposed API attack surface without deploying any agents or network changes. This approach to attack surface management was unique in the API security space, and we were flattered to note that the market validated our approach with other vendors emulating API Spyder capabilities. Today we’re excited to announce the following key enhancements to API Spyder.

• Proactive Notification of Shadow APIs: Our initial API Spyder deployments have helped customers discover shadow or rogue API server deployments outside of their approved security posture but within the environment that the apps are authorized to be hosted. We’re enhancing API Spyder to proactively notify customers about shadow API implementations that are not actively being monitored and protected. This enables security teams to instantly detect rogue API implementations, often manifesting as pre-production or user acceptance testing (UAT) deployments, and quickly remediate the situation with the respective API owner team. Since API Spyder is SaaS-based, this functionality is available immediately and will automatically be delivered to all existing API Spyder customers.

• API Spyder showing API attack surface not protected by Cequence UAP
• Granular API Attack Surface Visibility and Reporting: API Spyder now supports detailed reporting of the discovered API attack surface with added information about whether each discovered API server is actively protected by Cequence or not. Such information is available via the dashboard UI as well, allowing authorized users to easily get a quick view of how many API servers are being discovered, and their security posture.
• Customized Crawl Scheduling and Domain Configuration: Our customers are now crawling hundreds of their domains to monitor their public API attack surface. With today’s update, now they can set customized crawl schedules for specific domains, allowing API Spyder to focus in on those areas that might be of top concern.

Cequence Bot Defense Has Now Evolved to Cequence Spartan

To align with its current charter of protecting web and API apps from more than just automated bot traffic, we’ve not only renamed the Bot Defense module to Spartan but we’ve added new features unmatched by any existing bot management solution in the market.

When Cequence came out of stealth mode in 2015 with our flagship Bot Defense product, the main problem statement it solved was to detect and block automated bad traffic attempting account takeover attacks. Cequence made a design decision to solve this problem without using any client-side instrumentation such as JavaScript or SDKs that were commonly used to solve this problem. The “no-code instrumentation” technique became widely popular, winning us many customers including Fortune-50 organizations who found the technology incredibly fast to deploy and highly effective at protecting APIs and web apps with equal efficacy.

In retrospect, that design decision became one of the fundamental underpinnings of the Unified API Protection solution since API traffic can originate from web or mobile apps or be clientless direct API calls. We have made several recent enhancements to this product that transcend the original goal of protecting against automated bot traffic. We have chosen to rename Bot Defense to Cequence Spartan to more accurately reflect its expanded focus on detecting and protecting against traditional OWASP Automated Top 20 as well as API-specific attacks such as broken object-level authorization, enumeration attacks and business logic abuse.

Recent Cequence Spartan enhancements include:

• Dynamic Confidence Score-Based Mitigation: Cequence Spartan automatically profiles good and bad traffic, assigning each request a confidence score that quantifies the potentially malicious nature of the request. During an attack on APIs, the confidence scores of malicious traffic start surging much higher than those of good traffic. The product now has built-in automatic logic that captures the behavioral patterns of the malicious traffic and pushes those out to Cequence Defenders, which take action inline, such as blocking, rate-limiting, or inserting headers into the malicious traffic. This helps security teams to automatically detect and mitigate malicious traffic without having to manually triage the behavioral characteristics of the traffic.

• Block Malicious API Traffic using Advanced Mitigation Criteria: Spartan now supports advanced mitigation criteria that can act on malicious API traffic based on rapidly mutating behavioral characteristics. These characteristics include deep payload inspection for patterns observed in the malicious traffic including rapidly changing query parameters, header values or body parameter values. This allows security teams to apply deep web application firewall (WAF)-like controls to block the attack as it happens. Using a combination of customized machine learning (ML) models and out-of-the-box rules, customers can have an automated deployment that detects and protects against malicious API traffic.

• New Improved Spartan Dashboard

Runtime Inventory—API Sentinel

API Sentinel has several new capabilities for comprehensive runtime API inventory and security compliance.

• Tracking of API Inventory Over Time with Summary Dashboard: Using API Sentinel, customers now have access to a summary dashboard that lists several key metrics that help them track API inventory over time. Newly discovered shadow APIs or OWASP API risks are immediately visible on this dashboard, allowing security teams to take remediation action.

• OWASP API Risk Metrics on the API Sentinel Summary Dashboard
• Instant Report Generation: A dashboard user can also instantly generate a detailed report listing the findings from the summary dashboard. This report summarizes the findings from the dashboard for executive target users, including the actionable findings of OWASP API risks for app teams to act on.

• Exported API Sentinel report showing actionable risk findings

Requesting a Demo

To learn more about any of the new capabilities in Unified API Protection v2, feel free to request a demo. We’d be happy to get on a call to show you these exciting new capabilities!

Request a Demo

A large telecommunications API security customer with over 100 million mobile subscribers detected and blocked a sophisticated API-based phishing attack in a matter of hours, highlighting a rapid API security time-to-value provided by the Cequence Unified API Protection (UAP) solution.

With many applications that support their mobile business, their IT security team is constantly on the look-out for cyber-attack campaigns that seek to exploit their mobile users via theft and fraud, often taking advantage of stolen personal data. The attackers had built a series of fake websites mimicking the company look and feel to attract users and steal data.

Sophisticated Phishing Campaign Outmaneuvers API Security

In a recent attack, the security team discovered a sophisticated phishing attack campaign that targeted their customers and their mobile devices asking them to change their password. The attacker created a set of fake malicious sites that could interact with the carrier’s API application used to authenticate these mobile users. The attacker positioned these malicious sites as a fake middleman between the mobile user and API application. Once the mobile user clicked on the URL in the phishing email, the attacker’s malware site redirected them to an API application verifying the identity of the user via multi-factor authentication (MFA). Once authenticated, the malware site presented the mobile user with a fake webpage, which was an exact replica of the mobile carrier’s change password webpage, except for the URL which closely resembled the carrier’s domain. The mobile user would insert their credentials, thinking they changed their password when in fact they had unknowingly provided their username and password to the attacker. Once compromised, the cybercriminal was able to access the mobile user’s account and purchase a new iPhone by establishing a new phone line without the account owner’s consent, costing the carrier anywhere from $1000 to $1500 per compromised account.

The attack is a perfect example where an API security program can help ensure that APIs follow the right specifications to minimize losses due to API vulnerabilities. But much more is needed because in his case, the APIs were not necessarily coded or configured incorrectly. A more unified approach for API protection is required that also protects from the most sophisticated and relentless attacks that use legitimate traffic to commit theft, fraud, and cause business disruption.

Cequence Security API Spartan in Action: Detection and Mitigation.

API Spartan Helps Provide API Protection and Disrupts Major Cyber Campaign

The application security team understood that they had a severe problem. With API Spartan a component of the Cequence UAP solution, they were able to quickly onboard API protection to mitigate the targeted attacks. The security team had jumped on protecting this API application used to verify the identity of users by implementing protection in under 30 minutes. The security team placed API Spartan in front of this API application that intercepted all redirected requests from 3^rd party sites such as from a search engine or, in this case, malicious or fake websites. Through API Spartan, they were able to develop new security policies that were able to distinguish between legitimate versus malicious redirects, enabling them to block all rogue requests, that originated from over 75 malware sites. In a matter of days, this complex and sophisticated cyber-attack campaign was completely stopped right in its tracks. The attacker gave up the campaign soon after.

Free Telecommunications API Security Assessment of Your API Attack Surface
Get an Attacker’s View into Your Organization

Free API Security Assessment

A massive segment of organizations’ digital footprint today is built around internal and external APIs. As more IT leaders realize and acknowledge the size of APIs’ influence, it’s become clear that new methods are needed to secure those APIs.

While many companies today use the term “API security” to describe their offerings, these solutions often handle only a few of the many functions needed to protect APIs from becoming a source of vulnerability that can be used as an attack vector. A new mindset, a new category, and a proper end-to-end solution are needed; this is where Unified API Protection comes in.

First, it’s vital to quantify why Unified API Protection has become so essential.

APIs: The Double-Edged Sword of Digital Business

The impact of rapid API adoption on the business world has been mixed, introducing both functionality and risk. This dual nature breaks down as follows:

• On the one hand, APIs have become a development tool of choice in reaction to application componentization, competitive business dynamics, and user expectations for seamless app experiences. On the other hand, APIs have delivered velocity and competitive advantage to companies of all kinds as part of their development tool kit.
• On the other, APIs are highly visible, and their well-defined nature has made them an irresistible target for attackers. Some companies are implementing APIs without security practices or authentication in place and not conforming to required API specifications. In some cases, sensitive data is being exposed as clear text, placing compliance and overall data security at risk.

Organizations need a way to bring their API usage under control, all while still reaping the speed and competitiveness benefits.

Unknown, Unprotected, and Unmitigated API Risk

Initial efforts to protect organizations’ APIs tend to fall short because the chosen methods can’t cope with the scale of API use and related risk today. Extending web application firewalls and API gateways or using Gen 1 API Security solutions to cover a company’s known API risk surface isn’t enough, largely because:

• Unknown and “shadow” APIs are not discovered by these solutions. Legacy approaches API security often lack a way to uncover APIs that are not officially known or only visible through an outside-in or edge-based inside-out view and analysis of the business’s technology footprint.
• Protection options may be inadequate. Existing detection systems are often difficult to deploy, easy for threats to avoid, and hard to scale. Moreover, since many of these solutions can’t discern and natively block threats in real time, they leave large security gaps.

IT security teams trying to protect their organizations with these solutions can fall behind, performing too many manual tasks and operating at cross purposes with developers and security operations personnel. Modern API use demands a similarly modern solution rather than a cobbled-together legacy version.

The Answer: Unified API Protection

After struggling with limited security offerings, it’s natural for a new mindset to take hold in IT security departments: Today’s organizations must protect the entire API footprint from all security and compliance risks and threats. Unified API Protection solutions are meant to deliver this experience.

Unified API Protection differs from fragmented or incomplete API security offerings because it’s a methodology designed to account for multiple types of risk and, more importantly, to provide resolution. These solutions are based on three functional pillars:

• Discover: Companies can’t adequately protect their risk surfaces until they know the existence and location of every API in use, including “shadow” APIs. This requires both inside-out and outside-in detection efforts.
• Detect: Ongoing real-time detection of API activity is essential. A comprehensive system should be able to provide compliance and risk monitoring alongside advanced threat detection that incorporates artificial intelligence and global API threat intelligence to find well-concealed attacks.
• Defend: While some API security tools stop alerting security personnel of threats, a true Unified API Protection solution also includes native real-time remediation. Blocking out harmful traffic and stopping even sophisticated and persistent threats should be part of the package, keeping organizations safer with less manual action needed or reliance on third-party tools such as a WAF to avoid vendor lock-in and lowest denominator security.

There are six individual steps associated with achieving these three pillars of Unified API Security:

• Inside-out discovery: “Knowing the unknown” and automatically detecting shadow APIs.
• Outside-in inventory: Detecting all known and managed APIs and connections without their prior knowledge of existence.
• Compliance monitoring: Ensuring real-time compliance with standards and specifications.
• Threat detection: Scanning for potentially malicious activity, including well-disguised attacks and business logic abuse.
• Threat prevention: Defending data and infrastructure through alerting, stealthy mitigation, and real-time blocking of attacks without relying on any third-party tools.
• Ongoing testing: API protection should become a part of development, shifting security left and preventing risky code from entering production.

Cequence Security’s solutions are designed to deliver Unified API Protection and provide the comprehensive security needed to cope with the way APIs are leveraged today.

Continuous Protection for Ubiquitous API Connectivity

By providing continuous, real-time, end-to-end API risk discovery, detection, and defense, the Cequence Unified API Protection solution can allow IT teams to deliver secure business continuity without stress, worry, or lost efficiency.

This solution can:

• Deliver visibility of the full runtime API inventory, including risk and compliance states.
• Monitor suspicious and malicious traffic, as well as risky changes to any API.
• Respond to threats in real-time with stealthy blocking while cutting down on false positives and manual intervention.

The solution delivers this state of API protection without getting in the way of development or operations efforts, so the whole organization is united in working more securely, even as new APIs continue to roll out.

Ready to put Unified API Protection to the test? Request a demo and a FREE API security assessment.

Using the Cequence Unified API Protection (UAP) solution, a Fortune 100 financial services customer detected and blocked a large-scale account takeover (ATO) attack that targeted their mobile APIs. Attackers analyzed perfectly coded APIs found in the mobile application to understand how they work. Then, using commercially available attack tools combined with the billions of readily available stolen credentials, attackers launched a high-volume ATO campaign.

Industry research by BCG Digital notes that financial services organizations are 300 times as likely as other companies to be targeted by cyberattacks. The reason for the popularity is simple, attackers view the assets held and programs provided by the financial services industry as highly coveted targets, often lacking advanced API security. The APIs are relentlessly attacked using a variety of techniques to execute ATOs against APIs that often result in theft or fraud.

Login APIs Targeted by Account Takeover Attacks

This scenario is exactly what transpired for a large financial services customer that provides both consumer and commercial products and services globally. The customer had adopted an API-first development methodology to better support their mobile users and as a means of delivering new and compelling products to market more rapidly. The move provided significant business benefits but also introduced a security challenge: the mobile login APIs were increasingly attacked.

• Attackers used known tools like OpenBullet, malicious, Bulletproof Proxy infrastructure and readily available (stolen) credentials to launch sophsitcated ATO campaigns.
• At the peak of the high volume attacks, up to 90% of the traffic across roughly 50 mobile login endpoints was automated.
• When the ATOs were detected, attackers shifted to a low and slow technique, rotating across as many as 1 million proxies over week long periods of time.

If a malicious login attempt was successful, they would proceed to transfer funds to their own (fake) account using the OFX API, the financial services industry standard fund transfer protocol.

Schedule a personalized demo to learn how the Cequence UAP stops ATOs in their tracks.

Traditional Protection Methods Fall Short

The original solution to their ATO problem was an internally developed tool that proved successful initially, but over time, proved to be resource intensive to maintain as attackers quickly figured out how to evade mitigation. First-generation bot detection solutions were evaluated but showed limited success due to the solution’s reliance on JavaScript and mobile SDKs. The challenge first-generation bot detection solutions have is the simple fact that APIs are code – they cannot be instrumented in the same way a web page, or an app can. This meant that the first-generation bot solutions had limited access to telemetry data and other information needed to determine if the intent of a transaction is malicious or not.

Clientless API Security Used to Prevent Account Takeover Attempts

Faced with mounting fraud, customer dissatisfaction and a need to better protect their API-first development methodology, the customer turned to the Cequence Unified API Protection (UAP) solution to stop the attacks. The Cequence UAP detects ATOs and other automated attacks using CQAI, an advanced ML-based analytics engine that automatically discovers API, web and mobile application endpoints to build an intuitive site map for visibility and policy-based protection. Predefined policies based on the largest API threat database available dynamically analyze API transactions to determine the intent of each request. If malicious activity is detected, the customer was able to natively enable mitigation policies using multiple response options such as blocking, rate limiting or deception.

The agentless, ML-based approach of the Cequence UAP helped the customer achieve the following results:

• 80% reduction in infrastructure consumption and related costs by eliminating malicious traffic.
• $580,000 saved by protecting roughly 2,000 user accounts from fraud and user dissatisfaction. Savings is based on the Juniper Research estimate that each incident cost organizations $290 and roughly 9 hours of investigative work.
• Reduced time-to-market as new APIs and web apps are automatically protected through DevOps integration.

Today, the customer is using the Cequence UAP to protect all their public-facing APIs and web applications from fraud and theft associated with ATOs and other forms of automated attacks.

Interested in evaluating the Cequence UAP for yourself?

The Australian Cyber Security Centre (ACSC) leads the Australian Government’s efforts to improve cyber security and recent data breaches and the potential theft of private data, have put a spotlight on API security.

API Abuses and Related Data Breaches

The ACSC provides a valuable service as businesses continue to move more of their operations to the cloud and more data moves through APIs. As these trends continue so to is an increase in API-based attacks. The Optus breach is only the latest example. Gartner predicts that by 2024, API abuses and related data breaches will double.

This recent string of API security incidents and data breaches highlights how attackers are leveraging Open Web Application Security Project (OWASP) categorized security gaps to execute their attacks. The techniques observed in these incidents mimic those outlined in the API Protection Report where attackers are actively mixing and matching the OWASP API security categorized threats to bypass common security controls.

A New Control to Ensure Clients Are Authenticated

As a potentially proactive step to help mitigate API threats, the ACSC had added API vulnerabilities to its influential Information Security Manual (ISM). The latest edition of the ISM, published by the ACSC, adds a new control “to ensure clients are authenticated when calling web application programming interfaces that facilitate access to data not authorized for release into the public domain.”

Attackers Performing New Levels of Analysis

These new controls are directly related to trying to prevent attackers using a combination of three different tactics to exploit APIs listed in the OWASP API Top Ten – Broken User Authentication (API2), Excessive Data Exposure (API3) and Improper Assets Management (API9) – to bypass common security controls and achieve their end goal. The increased combination of these three threats indicates that attackers will be performing new levels of analysis to understand how each API works – including how they interact with one another and what the expected result will be.

Shadow APIs and API Security Controls

What complicates matters is security controls will only help if an organization is aware of all APIs used by the business. The challenge is that many companies have unknown or shadow APIs that are hosted by third parties, or are in use by developers, but not visible to the rest of the organization. New research by the Cequence CQ Prime threat research team confirms shadow APIs are the top threat challenging the industry with 31%, or 5 billion malicious transactions observed in the first half of 2022 targeted unknown, unmanaged and unprotected APIs, commonly referred to as shadow APIs.

That is because shadow APIs are easy for attackers to discover by analyzing an organization’s exposed APIs and then simply fuzzing or modifying the values, enumerating through other API endpoints on different versions, under different hostnames to find other API variants.

Unified and Integrated Approach to API Protection

To combat the ever-present risk evident with APIs requires a unified and fully integrated approach that works across the entire API protection lifecycle, protecting all APIs, across all API implementations, channels, and infrastructure environments, and all user groups and business use cases.

Cequence has taken the approach that an effective API protection solution should protect APIs across the entire lifecycle, leveraging a collaborative effort that includes developers, application owners and the security team to accomplish the following:

• Outside-in discovery: Gain an understanding of your public-facing API footprint to see what an attacker may see.
• Inside-out inventory: Complement an external view of your APIs and related resources with a  comprehensive inside-out API inventory, including all existing APIs and connections.
• Compliance monitoring: Continually analyze existing and new APIs to keep them in compliance with specifications such as the OpenAPI specification and ensure high API coding quality, consistency, and governance.
• Threat detection: Even perfectly coded APIs can be attacked, so it’s critical to continuously scanning your entire API inventory for threats, including subtle business logic abuses and malicious activity that has not yet been observed.
• Threat prevention: It’s critical to be able to respond quickly and natively with countermeasures such as alerts, real-time blocking and even deception, without the need for added third-party data security tools.
• Ongoing API testing: Integrate API protection into development to complement API security efforts defined by shift left efforts within the organization, so risky code doesn’t go live.

Security teams deploying Cequence Unified API Protection enable their organizations to help comply with regulations, industry requirements and security controls. Cequence improves visibility and protection while reducing cost, minimizing fraud, business abuse, data losses and non-compliance while creating attack futility, failure, and fatigue for even the most relentless of attackers.

Get Started Today with the Cequence Unified API Protection solution

Get a Free Security Assessment of your API attack surface

What Is API Security

API security means protecting the APIs and their associated digital assets. With so much of our digital world supported by APIs, the need for API security is staggering. The speed of API adoption had far outpaced most organizations efforts to apply oversight or implement appropriate API security measures.

The shopping, financial management, food delivery, or ridesharing apps we use are API-based. The cars we drive, the tablets, mobile devices, and smart home appliances we use are API-based. History has shown that the rapid adoption of a particular technology is followed by an equivalent growth in cyber threats as exemplified by the rash of API security related incidents over the past 2 years. The market has responded with a wide range of solutions designed to address the need for improved API security, resulting in confusion.

Organizations are being told that their WAF and API gateway are sufficient to protect their APIs. In other cases, they are told that a shift-left, DevOps effort combined with better testing is how API security is defined. Lacking from these recommendations is how to protect a perfectly coded API. The truth is all phases of API development must be considered and a great place to start is with the resources available from the Open Web Application Security Project (OWASP).

Secure APIs from Common Attacks – OWASP API Security

OWASP has published data regarding the API Security Top 10, which describes the ten most common API security flaws. The OWASP API Security Top 10 is a good starting point for securing APIs and understanding common security vulnerabilities in APIs. The OWASP API Security Top 10, and the risks they introduce are:

• API1:2019 Broken object level authorization (BOLA): Insufficient validation of an object access request allows an attacker to perform an unauthorized action by reusing an access token.
• API2:2019 Broken user authentication: Poorly implemented user authentication allows attackers to impersonate legitimate users by exploiting implementation flaws in authentication mechanisms.
• API3:2019 Excessive data exposure: A published API might expose more data than necessary, relying on the client app to perform the necessary filtering.
• API4:2019 Lack of resources & rate limiting: By not implementing rate limiting policies, attackers can overwhelm the backend with denial-of-service attacks.
• API5:2019 Broken function level authorization: Allows an attacker to perform actions by sending requests to functions they are unauthorized to access.
• API6:2019 Mass assignment: Unfiltered data provided via APIs to client apps allows attackers to guess object properties via requests.
• API7:2019 Security misconfiguration: Commonly a result of insecure, incomplete or ad-hoc configurations, verbose error messages containing sensitive information and other HTTP related coding errors.
• API8:2019 Injection: Untrusted injection of data, such as SQL, NoSQL, XML Parsers, ORM, LDAP, OS Commands, and JavaScript, resulting in the execution of unintended commands or unauthorized data access.
• API9:2019 Improper assets management: Insufficient environment management and environment segregation allows attackers to access under-secured API endpoints.
• API10:2019 Insufficient logging & monitoring: Insufficient logging, monitoring, and alerts allows attacks in progress to go undetected.

Successful API Attacks

API security incidents are on the rise with attackers finding exploitable errors as defined in the OWASP API Top 10 and targeting gaps in business logic. One of the more recent API security attacks was against Optus Telecom where the malicious actor was able to retrieve the personal information by exploiting several exploits listed in the OWASP API Security Top 10 list. Much like previous API security incidents that have made the news, the attacks have a significant impact on the business bottom line.

How Has Security Changed to Protect API Data?

As noted above, organizations are approaching the API security challenge in an ad hoc manner. The problem with this approach is that they have no way to uncover all the (shadow, or zombie) APIs and API vulnerabilities without knowing where to look. Even if all APIs are discovered and known, attackers can still leverage seemingly legitimate transactions to steal data or commit fraud. Traditional approaches that use WAFs or API gateways depend on easily evadable detection, lack the real-time ability to discern good from bad API activity and are reliant on static, least common denominator protection spread across multiple technology components.

API Protection Best Practices

While each organization may approach their API security efforts from a different starting point or focus, its important that they look at ways to protect their APIs across the entire lifecycle, not just at the management or development phase. Improving your API key protection posture requires a collaborative effort that includes developers, application owners and the security team.

• Outside-in discovery: Gain an understanding of your public-facing API footprint to see what an attacker may see.
• Inside-out inventory: Complement an external view of your APIs and related resources with a comprehensive inside-out API inventory, including all existing APIs and connections.
• Compliance monitoring: Continually analyze existing and new APIs to keep them in compliance with specifications such as the OpenAPI specification and ensure high API coding quality, consistency, and governance.
• Threat detection: Even perfectly coded APIs can be attacked, so it’s critical to continuously scanning your entire API inventory for threats, including subtle business logic abuses and malicious activity that has not yet been observed.
• Threat prevention: It’s critical to be able to respond quickly and natively with countermeasures such as alerts, real-time blocking and even deception, without the need for added third-party data security tools.
• Ongoing API testing: Integrate API protection into development to complement API security efforts defined by shift left efforts within the organization, so risky code doesn’t go live.

Whether you are just starting your API protection journey, or you are deeply entrenched in an API-first methodology, it is critical that you look at API security holistically, across all phases, not just development, management, or detection. Being able to see the attack traffic, analyze it, respond, and adjust based on the results is not something that can easily be accomplished when pieces of the puzzle are missing or when using multiple solutions. Following the recommended best practices ensures that even the most innovative and resourceful bad actors will experience fatigue, and ultimately, failure, while ensuring that your APIs and your data are protected.

Schedule your Free API Security Assessment Today

Long after the press news and panic surrounding the discovery of Log4j, the Log4 Shell exploit and the supply-chain variant dubbed LoNg4j, IT and security teams are still struggling to adopt Log4j best practices for ensuring their servers are patched and protected. To help our customers address this critical need and improve API security, we added a Log4j detection capability to API Spyder. Any inbound DNS requests API Spyder received were time-stamped as an added datapoint. API Spyder was finding Log4j instances for our customers and they were patching them as quickly as they were found. First 12 were found, then 10, then 8, then 12 again….wait, what? It seemed something was going on.

The fluctuations in Log4j instances found was not a bug – it turned out to be something we called LoNg4J. This new Log4j variant showed that even after a globally known vulnerability has been disclosed and a patch made available, organizations are still suffering from a lack of applied patches. Best practices on capturing unpatched Log4j servers and potential LoNg4j instances are to expand the testing radius to include third-party solutions within your digital supply chain and to extend the timeframe for results to as long as 24 hours.

LoNg4J Explained

Demonstrating how connected our systems really were, LoNg4J are instances of Log4j vulnerability found upstream in your digital supply chain. One of the API Spyder detection techniques inserts a vulnerability test payload into a header. So when the initial tests were done, the transactions were logged, and the results came back negative – no Log4j. Then those logs were compiled/processed/parsed by an additional system that is vulnerable and returns the results back to API Spyder that Log4J is present.

While the news cycles around Log4j have come and gone, the vulnerability still exists. As I sit here writing this, almost a year later, our team still sees API Spyder light up with detections across our customers and prospects. In some cases, the vulnerability resides in an organization we are not engaged with yet, resulting in a responsible disclosure submission.

Learn more about API Spyder

Initial Responses to Log4j and Log4Shell Discoveries: Denial

When informed that an organization may have a vulnerability, the initial response often comes in the form of “let me see exactly how you did this.” We often get requests that challenge the validity of our claims, so we have processes in place to ensure we aren’t crying wolf. The next response is usually “we have already patched this in all of our systems” followed by “tell us how you found this.” Digging through the API Spyder data repository, I can pull out the requests and responses to illustrate what how the LoNg4j instances was found. In the most recent case we were seeing our tests generating returns from one of their vendor systems that performs an orchestration function. Denial here might be accurate, your systems aren’t impacted but, your digital supply chain may be.

This pattern of doubt or denial is common when an organization is made aware of potential vulnerability via a Responsible Disclosure. It’s important to note that if someone tries to inform you that they have found a vulnerability in your app or web site, be willing to believe it. A Responsible Disclosure notification is done with the interest of helping. There are further steps many organizations go through on this journey, but that first step of acceptance is the hardest to get over. I am not sure why.

Vulnerability management is a very difficult to execute properly. It’s a significant resource drain, requiring massive amounts of coordination to apply the simplest of patches. The initial patches and deployments are often flawed or must be applied again, and that assumes that you know which systems needs patching. Then what happens when the patch breaks something else? Now, when you consider the number of servers and resources in a large organization, you can understand why it is so hard. Keep in mind though, response to an attacker getting shell on one of your servers, with a very small script, is even harder to handle than vulnerability management. Once an attacker has access, the average time they spend on a system is over 180 days and that assumes you find them and kick them out.

Staying Ahead of Log4j and LoNg4j

The widespread use of Log4j and the vast library of internal and 3rd-party servers that organizations have deployed means that the vulnerability will be with us for years to come. Confirming this assertion, in the last six months API Spyder has found over 4,000 instances of Log4j and LoNg4j in the wild. Many of these detections have been in 3rd-party systems or buried deep in our customers supply chain. My recommendations to our customers is to remain vigilant, regardless of how successful your patching efforts may appear to be.

• Understand your exposure: Use API testing and penetration tools to fully understand your public facing threat footprint and what your adversaries see.
• Expand testing parameters: Include potential 3rd-party and digital supply chain including targets in your testing efforts.
• Exercise patience: Lengthen testing timeframes to as long as 24 hours to accommodate supply chain traversal that incorporates log analysis or event correlation.
• Track inventory and assess risks: Use visibility gained during initial analysis for continuous inventory tracking, API risk assessment and threat detection.
• Remediate and mitigate: Patch discovered vulnerabilities quickly, block threats in real-time to prevent data loss and business disruption.

Log4j, LoNg4j and Log4Shell will not disappear anytime soon, making it imperative that all organizations are aware of the risks and are fully prepared.

Confirm your Log4j and LoNg4j patching efforts are complete with a free API Spyder assessment.

API business logic abuse, informally defined as as OWASP API10+, an extension to the OWASP API Top 10, is the practice of attacking perfectly coded APIs to achieve a malicious end-goal. Coding errors like weak authentication, excessive data exposure or the inadvertent publication of internal APIs are all known to be root causes of recent API security incidents. What’s rarely covered are attacks on well-formed APIs, yet with 3.6 billion malicious requests blocked by the CQ Prime Threat Research team, these API10+ attacks were the second largest API security threat mitigated during the first half of 2022.

API10+ Business Logic Abuse: An Informal Extension of the OWASP API Top 10

Any API, or web application for that matter, can be attacked. The Cequence Security API Protection Report highlights how well-formed APIs are attacked daily across all customers. Categorized by the CQ Prime Threat Research Team as API10+, an unofficial extension to the Open Web Application Security Project (OWASP) API Security Top 10 list, this set of attacks target APIs that are coded correctly, properly inventoried and are not susceptible to any of the OWASP API Security Top 10 threats. Yet malicious requests targeting well-formed APIs continue to occur and include these attacks that were blocked by the CQ Prime Threat Research Team during the first half 2022:

• 3 billion+ shopping bots: Shopping bots targeted well-formed APIs with a dense network of highly volumetric and geographically distributed fuzzing payloads. These attacks often have an extremely low success rate, however, economies of scale lead to a compounded return when the target item (e.g., sneakers, luxury goods, game consoles) is successfully bought and then resold for highly inflated prices.
• 290 million+ malicious gift card checks: Gift card enumeration is based on fuzzing numeric patterns on APIs that support payment and checkout microservices. Attackers employ cheap cloud computing resources, distributed across many proxies to execute credential stuffing attacks looking to gain access to free money. The lack of request failure analysis on such APIs leads to a huge gap in application security hardening. Cequence utilizes multiple out of the box capabilities to track threat vectors and attack payloads dealing with payment fraud.
• 37 million comment spam requests: This set of payloads abuse APIs that serve customer relationship management workflows. Spamming and DoS activities on these flows lead to significant customer friction and hampers an organization’s ability to serve its customers.

The rapid growth in API attacks caused by coding errors has led to the notion that an increased focus on application security and testing will solve the problem. The reality is that a shift left mentality will help, but it will not stop a highly automated attack. Attacks on well-formed APIs are a common occurrence because the attackers exploit the same nonfunctional requirements that developers love about APIs – flexibility, speed and ease of use.

API10+ Example: Methodical API Business Logic Abuse

The CQ Prime Threat Research Team successfully mitigated a financially motivated threat actor targeting an e-commerce platform abusing the OWASP API5 (Broken Function Level Authorization) vulnerability. The attackers automated the purchase of consumer items with stolen credit cards and Payment Card Industry Data Security Standard (PCI-DSS) data. The API abuse attack lifecycle depicted the following behavior:

• Vulnerability scanning: The attackers began by mapping the entire site using commonly known vulnerability scanning tools from a single IP address. This included OWASP API 8 attack behaviors such as SQL injection, command injection, directory traversal, and fuzzing of sensitive data. When basic recon did not yield low-hanging fruit, the attacker moved to mapping the API ecosystem.
• Attack probes: The attackers then began using existing attack configurations from well-known bot automation tools like OpenBullet to perform basic credential stuffing and fake account creation attacks. During a 24-hour period, attackers initiated more than 1.5 million requests from 130,000 IP addresses, all of which were mitigated by more than 1,000 different behavioral fingerprints.
• Continued reconnaissance: The attack continued even as it was mitigated, leading to the discovery that this was a head-fake from the attackers and was not the goal. During the following attacks, the reconnaissance behavior returned, this time focusing on account creation and checkout APIs.
• Vulnerability discovered: Attackers discovered that upon creation of a brand-new account, and before email verification had taken place, that the checkout APIs (particularly those to add a payment method) could be invoked by the user. This is an example of broken function level authorization, where an API functionality is intended to be used only by users who have both authenticated and are authorized.
• Theft: The focus of the attack shifted to account creation, and attackers immediately began stuffing new (fake) accounts with stolen payment info, targeting retail products for purchase. They did not care their credential stuffing campaign was failing, they were simply watching which of the new accounts they created would be able to successfully access payment APIs, iterating through stolen credit cards until they found one eligible to continue with the purchase.

API Security Means Full API Lifecycle Protection

The Cequence Unified API Protection (UAP) solution helps protect well-formed APIs from bot-generated abuse by addressing all phases of the API security lifecycle to eliminate unknown and unmitigated API security risks that can lead to data loss, fraud, and business disruption. Cequence UAP features include:

• Discover Public Facing API Attack Surface: API development and deployment is often distributed across many groups, introducing the risk of APIs deployed outside of a CDN purview. The Cequence UAP solution solves that challenge by continuously assessing your public facing APIs and resources to provide an attackers view of your organization’s attack surface, including cloud hosting services, any associated API endpoints, and servers that may be vulnerable to Log4j and LoNg4j exploits.
• Centralized Inventory Tracking of Known and Unknown APIs: The Cequence UAP solution integrates with CDNs and a range of API gateways to provide centralized API visibility and inventory tracking of all the APIs deployed and managed by the respective API gateways. Unregistered or unknown APIs are also discovered, allowing security and development to migrate those shadow APIs to the respective API gateway to ensure security and governance policy consistency.
• Strengthen Compliance and Data Governance Controls: Cequence helps organizations enforce compliance and governance controls with proactive API risk analysis and remediation. Predefined and custom risk assessment rules help organizations teams find and remediate coding errors that introduce sensitive data handling and authentication vulnerabilities that can lead to data governance and compliance violations.
• Detect Sophisticated API Attacks: Going beyond basic protections that CDNs can provide, Cequence UAP analyzes your APIs using ML-based analysis based on a threat database with millions of records and behavioral fingerprinting to detect and continually track sophisticated API attacks as they retool to evade detection.
• Flexible, Real time Mitigation Responses: Real time responses to API attacks range from basic block and rate limiting to HTTP header insertion and deception, all executed in real time, per policy or per app, without reliance on integration with third-party WAFs.

Unified API Protection is different from fragmented or incomplete API security offerings because it’s a methodology designed to account for multiple types of risk, across every phase of the API protection lifecycle.

Schedule your personalized API protection demo today

New threat research for API security, this blog walks through the discovery of a Broken Object Level Authorization or BOLA vulnerability (OWASP API1) by the CQ Prime Threat Research Team that could be used to exfiltrate sensitive (customer) data.

It’s well known that attackers can use stolen PII to apply for credit card accounts, government benefits, and loans in the victim’s name. This identity theft can damage not only an individual’s credit and inflict harm that takes years to undo, but negatively impact an organization’s reputation and brand.

• Data from the Federal Trade Commission (FTC) show 343,625 fraud reports related to COVID-19 and government stimulus payments were filed between 2020 to 2022.
• The rapid move to online shopping has its fair share of benefits, but the resulting increase in card-not-present (CNP) transactions, which account of all debit transactions, has led to a surge in CNP fraud.
• The advent of new, less monitored marketplace platforms from food delivery platforms to social networking sites to dating apps have been popping up everywhere — making them easy targets for identity thieves.
• According to a report by the US-based Identity Theft Resource Center (ITRC), the first nine months of 2021 saw a 17% rise in the number of businesses experiencing data breaches. These breaches are one of the prime sources of identity theft.

APIs Facilitate PII Access

Whether it’s our favorite shopping, financial management, food delivery, ridesharing application, or the new cars we drive, the tablets and mobile devices we use, or our home appliances, APIs are the heart of all things digital. The rapid adoption of APIs has been followed by an equivalent growth in cyber threats as seen in the security incidents at Peloton, ClubHouse, John Deere and more at Optus and Dialog. The same characteristics that developers love about APIs – flexibility, speed, ease of use – are also loved by attackers who either find coding errors to exploit, or use bots to attack perfectly coded APIs, or a combination of both. Recently, the CQ Prime Threat Research Team performed a customer engagement where the team was directed to uncover any API security weaknesses. The result was the discovery of a Broken Object Level Authorization (BOLA) vulnerability and exploited it to obtain the PII data of the organization’s customers. The OWASP API Security Project has defined a BOLA vulnerability as OWASP API Security Top 10 API1. OWASP mentions that API1 involves APIs vulnerabilities in a situation where APIs will tend to expose endpoints that handle object identifiers, creating a wide attack surface Level Access Control issue. OWASP states that API security mitigation should involve object level authorization checks in every function that accesses a data source using an input from a user to help secure the API.

Uncovering API Security Weaknesses

Following the same process an attacker would execute, the engagement began with API attack surface reconnaissance to uncover potential API vulnerabilities. Using Burp Suite, a tool for performing security testing of web applications, the team analyzed the entire site collecting all the GET and POST requests made from a web browser and find vulnerabilities. New customer accounts were created, registration forms and password resets executed with the goal of uncovering any business logic errors.

Analysis of the Burp Suite HTTP History tab showed that a POST request made to the server during a new account login exposed a parameter “email” and the value, which in this case, was also used as the customer ID. The response to this request was quite simple. It returned to the security researcher all the details of the account associated with the value of the email parameter (as shown in the image below).

Image 1: Response to a POST request displays redacted details of an account

This behavior confirmed that an API residing on one of the organization’s servers, or endpoint was exposing sensitive data as a response, and with only one parameter in the request, there might be a possibility of a BOLA vulnerability (OWASP API1), as well as the risk of Excessive Data Exposure (OWASP API3).

Exploiting an API to Access PII

A BOLA vulnerability allows an attacker to gain unauthorized access to resources such as a server that contains PII. When an API directly accesses objects, using user-supplied input, attackers can manipulate the request to access and potentially steal PII. To test for the presence of a BOLA vulnerability, the researcher tried changing the “email” parameter from the initial request to other accounts that were created for testing purposes but in response, no data was returned because a Cross-Site Request Forgery (CSRF) token was allocated to the customer account and with that same CSRF token, they cannot access another account. A CSRF token is a value generated by the server that a web application is communicating with, proving that a user, and the web application they’re using is sending a legitimate request from a form or a link generated by the server. The CSRF token is a secure random token that is used to prevent CSRF attacks by ensuring that data requests made by a user are performed with the user’s consent.

The security researcher then tried changing the CSRF Token with a CSRF token made up of any random value instead of a true value, to check if CSRF tokens are implemented properly or any random value is accepted. Unfortunately, this bypass didn’t work. The security researcher then removed the CSRF token completely from the request and this approach them to request data from the server by manipulating the “email” parameter. The security researcher was able to request the data for any user including PII Information such as customer name, profile picture URL, username, phone number, role, and first and last name. To recap, just by removing a required parameter from the request, we were able to fetch data without any authentication. Repeated testing confirmed that the steps outlined above could potentially lead to the unauthorized access of PII or other data.

Best Practices for API Security to Eliminate BOLA Vulnerabilities

BOLA related vulnerabilities are typically a combination of API design and coding errors. API owners must make sure developers and security teams have a full understanding of the desired functionality. This helps to ensure that secure coding practices are followed and validated by QA and testing. Additional recommendations include:

• Tight access control checks on every capability to confirm the user is authorized (the A in BOLA) to access and/or manipulate a requested object.
• Validate any parameters that are sent to the server to access information can help mitigate BOLA attacks.
• Ensuring that CSRF tokens are not transmitted using cookies will help mitigate CSRF vulnerabilities because without a token, an attacker cannot create valid requests to the backend server.
• A CSRF token should be created and saved server-side as part of the user’s session data.
• The server-side application should be designed to check that the token included in the request matches the value that was saved in the user’s session when a later request is received that must be validated. Regardless of the HTTP method or the request’s content type, this validation is required. Similar to when an invalid token is present, the request should be refused if it contains no token at all.

How Cequence Helps Mitigate BOLA-related Attacks

Cequence Security can help organizations uncover and remediate BOLA-related threats with a market-defining Unified API Protection solution that goes beyond API security approaches that may focus solely on web application security or application security testing that are each only one aspect of the API protection journey. Customers can use API Spyder, and API Sentinel to efficiently discover and mitigate these types of API vulnerabilities. API Spyder will discover all external-facing APIs, providing an attacker’s view of external resources. API Sentinel creates an up-to-date API inventory and assesses risks for remediation to eliminate coding errors that can lead to data loss and business disruption.

To help uncover data exposure errors, BOLA-related or otherwise, API Sentinel provides a Sensitive Data Exposure dashboard to quickly identify and remediate APIs and endpoints using sensitive data based on predefined (such as credit card and social security numbers, Stacktrace codes) and customizable data patterns. Context-aware sensitive data detection using a Natural Language Processing (NLP) machine learning technique complements predefined patterns and reduces false positives by allowing teams to find sensitive data exposure using contextual clues. The results are graphically displayed in a dashboard for fingertip access to details such as the API source or response codes leaking the data, the pattern found, and the underlying IP address details. Notifications can be sent to development teams for rapid remediation using predefined alerts for tools such as Slack, PagerDuty, or email.

To protect your APIs and reduce the risk of unauthorized PII access and damage to your organization’s reputation, schedule a Cequence Security API security assessment here.

Survey Highlights API Business Value and API Security Balancing Act

Much like the plumbing in our homes that works behind the scenes to make our lives easier, APIs are quietly helping organizations large and small generate significant business value APIs silently help us purchase nearly anything we need from our living room and have it delivered the next day. They are the glue that enables the apps we use to manage our money, automate our homes and keep them safe and secure. Factors driving the explosive use of APIs include cloud and microservices adoption, mobile device ubiquity, and the move to agile, more iterative development as a means of delivering more compelling new features to market more quickly.

The same characteristics that developers love about APIs are also leveraged by attackers as seen in recent API security incidents at Optus, Twitter and Telstra to name just a few. In response, security teams are using disparate solutions that lack integration, slowing attack detection response times which can result in a failure to provide adequate API protection from theft, fraud, and business disruption. These are just a few of the findings from a recent survey of 300 API security decision makers to explore how businesses are maximizing API business value, while maintaining and ensuring proper security.

APIs Help Drive Revenue

More than three quarters (79%) of the respondents stated that their revenue dependency on APIs would increase over the next 12 months. On the surface, this finding seems obvious given the use cases and trends mentioned above which are, in many ways, necessitated as the move towards an internet connected society continues.

Drilling more deeply into specific API use cases shows that partner and third-party APIs are viewed as the most significant revenue drivers at 66% and 67% respectively. On the surface, this finding was surprising because partner and third-party APIs are not as obviously connected to revenue as one would think. The reality is very different. Third party and partner APIs are core to making our money management app seamlessly link multiple accounts together; they help simplify our shopping experience, either in-person or online, by providing up-to-date local inventory status or by validating our credit/gift cards behind the scenes. Viewed from this perspective, it would be easy to ask why the findings were so low. Clearly, APIs are viewed as a critical element in driving revenue and business value, which makes them a valuable target for attackers.

Data validates API Business Value Jeopardized by Disparate API Security

Surprisingly, the survey showed that more than half (53%) of the respondents reported that their business has been impacted by more than three API attacks per month while 5% said they were hit with more than six attacks per month. Viewed on an annual basis, this finding means the security team is battling between 36 and 72 API attacks every year.

In terms of response time, 7% stated that they were able to respond to an attack in an hour or less while 62% said it took as long as 24 hours and 18% stated it takes up to 5 days. In a worst-case scenario, some of the respondents may be battling API attacks all year long (72 attacks x 5 days = 360).

The somewhat delayed response to attacks may be tied to the disparate API security infrastructure used and the types of attacks respondents were seeing. The most common tools used to protect APIs are web application firewalls (WAFs) at 71% and API gateways at 63%, neither of which is designed to protect against the most common threats observed – authentication enforcement (71%) and content inspection (63%).

Why Legacy Tools Fall Short on API Security

WAFs were originally designed to address PCI section 6.6 requirements, using signatures to detect known vulnerabilities as described in the OWASP Web Application Top 10 Threats list. API gateways are designed to help organizations aggregate and manage APIs, providing access control and basic security functions such as rate limiting and IP block lists. Both of these tools inadequate for addressing the top API security concerns expressed by survey respondents.

Another factor contributing to the delayed response is the lack of integration and alignment between tools and teams. The survey findings showed that nearly half of the respondents (49%) state that better integration between multiple API security tools would be most impactful for improving response times. The results also showed that 35% felt that better alignment between security and development teams would impact API security in a positive way.

Cequence Unified API Protection

The Cequence Unified API Protection (UAP) solution addresses the challenges with API sprawl with a broad set of technology integrations designed to ensure visibility into all APIs regardless of how and where they may be deployed. Deployed as a SaaS or as a hybrid architecture, the Cequence UAP solution provides complete coverage for every phase of your API protection lifecycle.

• Discover Public Facing API Attack Surface: API development and deployment is often distributed across many groups, introducing the risk of APIs deployed as a shadow API. The Cequence UAP solution solves that challenge by continuously assessing your public facing APIs and resources to provide an attackers view of your organization’s attack surface, including cloud hosting services, any associated API endpoints, and servers that may be vulnerable to Log4j and LoNg4j exploits.
• Centralized Inventory Tracking of Known and Unknown APIs: The Cequence UAP solution integrates with a range of infrastructure components to provide centralized API visibility and inventory tracking of all the APIs deployed within your environment, including shadow and zombie APIs.
• Strengthen Compliance and Data Governance Controls: Cequence UAP helps organizations enforce compliance and governance controls with proactive API risk analysis and remediation. Predefined and custom risk assessment rules help organizations teams find and remediate coding errors that introduce sensitive data handling and authentication vulnerabilities that can lead to data governance and compliance violations.
• Detect Sophisticated API Attacks: The Cequence UAP solution detects threats in your APIs using ML-based analysis based on a threat database with millions of records. Behavioral fingerprinting continually tracks sophisticated API attacks, even as they retool to evade detection.
• Flexible, Real time Mitigation Responses: Real-time responses to API attacks range from basic block and rate limiting to HTTP header insertion and deception, all executed in real time, per policy or per app, eliminating the time-consuming reliance on integration with third-party WAFs.

The Cequence Unified API Protection solution ensures customers can continue to reap the competitive and business advantages of ubiquitous API connectivity. The Cequence UAP results in attack futility, failure, and fatigue for even the most relentless of attackers. It significantly improves visibility and protection while reducing cost, minimizing fraud, business abuse, data losses and non-compliance.

Schedule Your Free Demo

Research by the CQ Prime Threat Research Team documents how attackers leveraged multiple OWASP API Top 10 threats including Broken User Authentication (API2), Excessive Data Exposure (API3) and Improper Assets Management (API9) to achieve their end goal. The practice of mixing and matching the OWASP API Top 10 categorized threats to bypass API security is commonly observed in customer environments, and they are eerily similar to the techniques used in the recent Optus Telecom incident where, we believe that four of the OWASP API Security Top 10s were exploited.

These techniques are commonly observed in customer environments, and they are eerily similar to the techniques used in the recent Optus Telecom incident where, we believe that four of the OWASP API Security Top 10s were exploited.

Shadow API Introduces API Security Risk

The incident unfolded as attackers discovered an API used for testing that was unknowingly exposed to the Internet. The exposed API, also known as a shadow or zombie API, did not require authorization or authentication, allowing both Personal Identifiable Information (PII) and Customer Proprietary Network Information (CPNI) to be exfiltrated. Added analysis shows how this series of events maps to four of the OWASP API Security Top 10 vulnerabilities.

Broken Object Level Authorization (API1)

In a public online forum, the Optus attacker mentioned that they enumerated the ‘contactid’ parameter object in the API to get unauthorized access to PII and CPNI data of other customers. This is a classic BOLA attack that has been observed at Fortune 500 customers protected by Cequence in varying volumes and complexity.

Broken User Authentication (API2)

Attackers discovered an unauthenticated REST API endpoint during their reconnaissance. The API was not meant to be exposed to the internet, and therefore was unauthenticated, leading to easy an automated exploit. Cequence has detected and mitigated similar automated attacks in real time for our customers. The majority of these events take advantage of credential stuffing, access token replay and Java Web Token (JWT) farming to initiate the attack.

Excessive Data Exposure (API3)

Attackers on the online forum mentioned that the exfiltrated data contains both PII and CPNI. Ideally, there should be logical separation and data custody controls when accessing customer sensitive data. This is only possible if the organization has access to real time analysis of their API posture which looks out for such exposure patterns. Cequence has successfully utilized API Sentinel to identify and mitigate exposure of our customer’s sensitive data.

Improper Assets Management (API9)

The public information shows that the targeted API was https://api.www.optus.com.au. To discover this API, the attacker may have used a common reconnaissance technique of enumerating the infrastructure by appending API to find unpatched and non-deprecated zombie APIs. As these APIs did not have security controls around them, they were an easy target for data exfiltration. The more common API path structure that development teams use would eliminate the www (api.optus.com.au). Customers are using the combination of Cequence API Spyder and API Sentinel to achieve both an outside-in (attacker’s view) and an inside-out (development view) of their API footprint and associated resources.

Leveraging API Security Gaps to Execute SIM Swapping Attacks?

The CQ Prime Threat Research Team has enough evidence to ascertain that a major factor behind the security event was to execute SIM swapping attack on mass scale. News reports indicate that compensating controls have been added to prevent SIM swapping.

Optus has temporarily paused its online or over-the-phone SIM swaps and replacements, as well as any change of ownership requests, to stop criminals from taking control of accounts. These processes can be completed in-store instead with the appropriate ID.

Using OWASP API Security Top 10 vulnerabilities to execute SIM swapping is not new to the CQ Prime Threat Research Team, having documented similar patterns earlier this year and most recently, in the API Protection Report.

A Fortune 500 telecom was hit with 9 million malicious requests from rotating residential proxies attempting to exploit API1. The attackers were looking to obtain information about a customer account by enumerating whether cell phone numbers could be transferred to an alternative provider’s network. Once the attacker discovered transferable phone numbers, they attempted to impersonate the true account owner and manipulate an employee into transferring the cell number onto a SIM card in the attacker’s possession. From there, the attacker can then take control of the victim’s sensitive accounts by completing SMS based two factor authentication.

OWASP API Top 10 is API Security Table-stakes

These API attacks highlight the need for organizations to take a holistic approach to API protection that expands beyond shifting left and the mentality that OWASP coverage is sufficient. It’s well documented that perfectly coded APIs are susceptible to business logic abuse and automated attacks. Security and development teams alike need to fully understand their entire API footprint and how those APIs – managed, shadow, or zombie, correctly coded or those with errors – can be attacked. Equally important it is the ability to detect and mitigate threats in real time, as opposed to relying on a WAF or other third-party solution.

Schedule your Free API Security Assessment Today

API Abuses and Related Data Breaches

Gartner has said that API attacks would be the most common attack vector in 2022, resulting in data breaches for enterprise web applications. Gartner also predicts that by 2024, API abuses and related data breaches will double.

For 2023, we don’t see any reason to doubt that APIs will continue to be a top target for attackers, resulting in theft, fraud, and business disruptions. The recent Optus Telecom API security incident shows new levels of analysis attackers are performing to understand how each API works, how they interact with each other, and what the expected outcome is. In another example of abusing the trust established by the API-host-to-user relationship, a local inventory search function used to enable Ulta Beauty customers to find and buy products nearby was hit by an attack that was 700X larger than average load.

Demand for API Protection Solutions

We predict a continued high demand for an API protection solution that works across the entire API protection lifecycle, protecting all APIs, across all API implementations, channels, and infrastructure environments, and all user groups and business use cases. Recent reports support this notion, observing that with the rising incidence of malicious attacks on APIs, the demand for API security solutions will grow at a compound annual growth rate (CAGR) of 26.3% between 2022 and 2032, totaling around $10B in revenue by 2032.

Talent Shortage

For 2023 we also predict that stretched IT security teams will continue to have insufficient time on their side to uncover API vulnerabilities. Adding insult to injury, we’ve observed that many security teams are put in a difficult situation of protecting their attack surface with constrained resources while dealing with the ongoing  talent shortage. And attackers are sophisticated and relentless using advanced tools, such as artificial intelligence, machine learning, and automation. We predict they will increasingly be able to expedite—from weeks to days or hours—the end-to-end attack life cycle, from reconnaissance through exploitation.

OWASP API Security Threats

We’ll see continued security incidents and data breaches highlighting how attackers are leveraging Open Web Application Security Project (OWASP) categorized security gaps to execute their attacks. The techniques observed in these incidents mimic those outlined in the API Protection Report where attackers are actively mixing and matching the OWASP API security categorized threats to bypass common security controls. In the year ahead, we will see attackers evolve to use the unholy trinity of OWASP identified API security gaps. This combination will continue to involve three different tactics–Broken User Authentication (API2), Excessive Data Exposure (API3) and Improper Assets Management (API9)–to bypass common security controls and achieve their end goal. The increased combination of these three threats indicates that attackers will be performing new levels of analysis to understand how each API works – including how they interact with one another and what the expected result will be.

Shadow APIs

Shadow APIs will continue to be the top threat challenging the industry. Attacks on shadow APIs are effective because they exploit innocuous mistakes in development and asset management control. These mistakes are frequently abused by bots, who rely on the lack of API visibility among the defenders. New research by the Cequence CQ Prime threat research team reported that 31%, or 5 billion malicious transactions observed in the first half of 2022 targeted unknown, unmanaged and unprotected APIs, commonly referred to as shadow APIs.

Consolidation of API Security Tool Vendors

We also predict further consolidation of API security tool vendors in 2023. As we have seen of late, in attempts to offer end-to-end application protection, web application firewall (WAF) vendors have been acquiring bot management companies. Examples of this activity include Imperva and Distil Networks, and F5 and Shape. Now their customers are looking to protect APIs with point products from a set of API security vendors, leading to vendor fatigue and alert fatigue. As we shift from an investment environment that rewarded “growth at any cost” to “sustainable growth towards profitability”, numerous API security startups are going to find themselves with no better option than to get acquired. Enterprises still struggling with acute talent shortage, despite the deadlines of tech layoffs recently, will look for vendor consolidation. Vendors providing a complete, comprehensive platform or solution to todays growing application and API security challenges will be rewarded in 2023. Enterprise API security needs will only be met by a solution that covers the entire API protection lifecycle which involves achieving visibility into all APIs, including public-facing, internal and unmanaged, and the mitigation of API vulnerabilities, ensuring API compliance, and the detection and prevention of attacks on APIs.

Regulatory Scrutiny of API Security

With the increasing number of high-profile breaches, we predict that there will be increased regulatory scrutiny of API security, resulting in more government regulations and industry certification requirements. For example, if a business uses APIs that carry any information regarding payment cards, that business and its technical partners must support these APIs to meet the requirements of the Payment Card Industry Data Security Standard (PCI DSS). In 2022 PCI DSS was updated to add more information and direction around the requirements to develop and maintain secure systems and software.

In Australia, recent data breaches have put a spotlight on API vulnerabilities, possibly driving the Australian Cyber Security Centre (ACSC) to add them to its influential Information Security Manual (ISM). The latest edition of the ISM, published by the ACSC, adds a new control “to ensure clients are authenticated when calling web application programming interfaces that facilitate access to data not authorized for release into the public domain.”

Targeting Telecom

In the light of data breaches in the telecommunications segment, we predict that in 2023, threat actors will seek to build off this momentum to exploit telecommunications companies that lack visibility into APIs due to their many sub-companies and partners. As telecom companies adopt new technologies, and associated use of APIs, we predict the potential for data breaches in these businesses that will impact millions of users’ information and result in theft, fraud, and disruption.

The Good News: API Protection Solution

While some of these predictions may seem dire or overwhelming to stretched IT security teams, there is good news. Cequence has taken the approach that an effective API protection solution can protect APIs across the entire lifecycle, leveraging a collaborative effort that includes developers, application owners and the security team to accomplish the following:

• Outside-in discovery: Gain an understanding of your public-facing API footprint to see what an attacker may see.
• Inside-out inventory: Complement an external view of your APIs and related resources with a comprehensive inside-out API inventory, including all existing APIs and connections.
• Compliance monitoring: Continually analyze existing and new APIs to keep them in compliance with specifications such as the OpenAPI specification and ensure high API coding quality, consistency, and governance.
• Threat detection: Even perfectly coded APIs can be attacked, so it’s critical to continuously scanning your entire API inventory for threats, including subtle business logic abuses and malicious activity that has not yet been observed.
• Threat prevention: It’s critical to be able to respond quickly and natively with countermeasures such as alerts, real-time blocking and even deception, without the need for added third-party data security tools.
• Ongoing API testing: Integrate API protection into development to complement API security efforts defined by shift left efforts within the organization, so risky code doesn’t go live.

For 2023, you can ensure an effective API protection program, and Cequence Security is here to help you start your journey beginning with an API security assessment.

Schedule Your Free API Security Assessment

Operational technology encompasses supervisory control and data acquisition (SCADA), industrial control systems (ICS), and distributed control systems (DCS). OT can be involved in critical processes that, if breached, could have catastrophic consequences, including loss of life. Water treatment plants, power distribution, traffic management, and other critical infrastructure rely on operational technology solutions to properly function.

The increase of OT devices used in these industries and others such as healthcare and life sciences has made cybersecurity more important. According to Gartner, over 80% of organizations have implemented OT technology, while 20% have detected OT-related security attacks within the last three years. According to the 2019 Ponemon Cyber Security in Operational Technology Report, over 60% of respondents mention concern about an attack against OT.

Operational Technology Security Challenges

Outside of B2B and B2C software, APIs are used heavily in OT, acting as the glue to communicate specialized data descriptions such as vibration, or pressure between equipment and control software. For example, in an OT scenario, a predictive maintenance application, as part of a SCADA system, running in equipment on a factory floor, could open a secure HTTPS connection to a server, requesting motor runtime data. Using an API, the factory equipment knows exactly how to connect to the server, obtain a list of available data resources, and read and write the values of those resources. The server would respond back to the predictive maintenance application with the motor’s run time and thus an indication of the next preventive maintenance schedule. Thus, if an API involved in these communications is exploited, data theft and disruption can result.

The OT security challenge doesn’t really present itself in disconnected or air-gapped systems but when all of it becomes available to the public internet. As more and more facilities rely on one another as part of the overall manufacturing process, the playing field for attackers becomes more interesting and sophisticated. Unfortunately, there is plenty of documentation, publicly available python libraries, and online tools to get an attacker up to speed in no time.

These systems aren’t all focused on manufacturing, the power generation, utility, transportation, and logistics companies utilize similar systems and similar methods. The basics are devices that communicate, gather data, make decisions, take action and allow for humans to make changes. Often these systems feed one another via some SaaS based overall “director” and can have many such systems tied together. Since production often requires fine tuning there are various places where there are human machine interface (HMI) points. These can be simple things like buttons to add a tiny bit more of an ingredient or as sophisticated as the primary director for the overall system.

Each point along the system can be attacked. Much like the attacks seen against web applications and APIs, attacking the central points of human interface is probably going to be the most impactful. When looking at web displays, is that tank really still full? What if that is a needed ingredient in the production process and when that item runs out, something breaks? If we bump up the saltiness of a whole run of potato chips, it might fail the whole batch in QA. Those kinds of communication signals can be disrupted, changed, or even manipulated when not protected properly.

Applying the OWASP API Security Top 10 to Operational Technology

When looking to make improvements to an operational technology or other types of controlled environments that engage with SCADA systems, more and more of the communication is standard TCP/IP and no longer on proprietary protocols but, rather, on standard HTTP API channels. Compounding rapid development and adoption of older technologies that weren’t designed with security in mind and we might be heading toward serious problems in these types of environments. Many of these systems weren’t built all at once, often older technology has been layered in. As our previous SCADA research taught us, credential reuse is constant on the factory floor and many of these systems have a weak point of a root or admin password being the same for every system installed by the same company.

The CQ Prime Threat Research Team recently posted about the API Security Unholy Trinity where attackers used multiple OWASP API Security Top 10 exploits to achieve their malicious end-goal. In the world of OT, the same threats are applicable.

• Improper Authentication (OWASP API 2): This flaw allows access or permitted credential stuffing. When applied to OT, authentication is critical and shouldn’t be a shared credential.
• Excessive Data Exposure (OWASP API 3): APIs communicating data they shouldn’t transport often leaking data through standard http response analysis. In the OT world, the assumption may have been that the communications would never be exposed so masking and encryption were not considered.
• Finally, we are seeing that many API endpoints in use aren’t well known to the organization, known as Improper Assets Management (OWASP API 9). These are 3^rd party APIs, SCADA or DCS APIs published outside of a documented process with little or no oversight.

These aren’t the only API flaws that get regularly abused but definitely are the worst if they exist together. We do see API business logic abuse outside of OWASP categories as well, making it critical to cast a broad view of threat landscape, looking beyond just those threats defined by OWASP.

Addressing API Security Challenges for Operational Technologies

So, what can be done? The same thing that can be done on APIs for web applications. Instrumentation and understanding what you have is important. Instrumenting the HMIs will allow for you to see the transactions, data gathering, and allow for alerting or taking enforcement on anomalies.

If you are interested in looking at what your APIs on OT, SCADA, and ICS are doing, instrumentation will allow you to see what transactions are taking place, what data is out there and if the transactions are problematic. Having an additional point of data and having thresholds that shouldn’t be crossed will allow for your environment to operate safely.

Shadow functionality needs to be uncovered before it is exploited by an attacker. This includes APIs that help your OT, SCADA, and ICS run smoothly. Knowing the unknown with regards to all those hundreds of APIs used by your organization is critical.

We can help. You can find out what APIs are in your OT, SCADA, and ICS using API Spyder.

Schedule Your Free API Security Assessment

Research by the CQ Prime Threat Research Team documents how attackers bypass API security to target third-party and partner eco-system APIs to achieve their end-goals. In the latest research report, attackers hit APIs supporting a financial services partner eco-system, ApplePay and a third-party inventory lookup.

Third-party and Eco-system APIs are not New

Long before APIs exploded into mainstream use, organizations used them to support and grow their partner ecosystem. Third-party APIs enable app-to-app connectivity for functions such as log aggregation and analysis, and integrations between consumer banking applications to enable cross-account visibility. They tie customer relationship management (CRM) and marketing automation together and provide a wide range of services across many industries. Recent research from the Postman State API Report noted that 27% of the respondents use APIs to enable partner relationships.

These trends are not surprising, given the move towards the cloud, adoption of SaaS solutions, the ubiquity of mobile devices and the flexibility that APIs provide. The growth in usage is not without its risks – APIs can be used as a malware delivery vector as seen in supply chain attacks, like SolarWinds. A more recent example can be seen in the LoNg4J variant of Log4j, where susceptible servers were found through API-connected (and trusted) third-party applications such as logging and SIEM solutions.

Third-party APIs are often brought into the organization without security teams being aware of them. One theory is that the partner team or business group managing the third party relationship is dealing with a secure API. In other cases, their implementation may have subtle flaws or a vulnerability that can be exploited. Even perfectly coded and implemented third-party APIs can be a target by threat actors hiding in plain sight. Furthermore, as certain third-party ecosystems grow, by their nature they become a valuable single point in the digital supply chain where an attacker could use a trusted API to target many victims. In an analysis of by 24 known supply chain attacks done by European Union Agency for Cybersecurity (ENISA), 62% of the attacks leveraged the implicit customer trust established by the digital connection.

Partner Ecosystem APIs Targeted by Bots

In an example from the Cequence API Protection Report, ecosystem APIs hosted by a financial services organization were targeted to simultaneously attack multiple partners using the APIs. The (mitigated) attack was a coordinated credential stuffing campaign where attackers cycled their malicious traffic through the partner API. The targeted API enabled consumer-friendly money management features including cross-account visibility, retirement planning, and net-worth tracking.

Attackers were aware of this one-to-many connection in the institutions’ supply chain and they knew that these API calls likely came from allowing trusted applications, originating from the attackers’ ultimate target – the banks themselves. Therefore, instead of attacking the bank directly, the attackers targeted the trusted API ecosystem and by proxy, the partner banks. The attack was identified and blocked based on the following behaviors:

• Known malicious infrastructure: Traffic originated from 250,000 geo-distributed residential proxy IP’s belonging to Bulletproof proxy providers in the Middle East, North Africa, Korea, Russia, the Philippines, and Indonesia.
• High session rotation: Each IP address showed high session rotation.
• No business dealings: Traffic was originating from countries where genuine user interaction is limited or non-existent.
• High login failure count: The attack showed a high rate of login failures per IP address.

The combination of known malicious infrastructure and identifiable behaviors was picked up immediately with over 50 million requests blocked within a single week.

Perfectly Coded (Apple Pay) and Secure API Under Attack

Margins in the sneaker resale markets have tightened along with a general decrease in asset prices across stocks, crypto currencies, and trading cards. While the tighter margins have weeded out some of the attackers, it has also made those remaining in the game much more dedicated to finding a competitive edge against others. To that end APIs such as Apple Pay are a perfect target for attackers, as they are designed for a frictionless purchasing experience for humans, which bots will readily abuse in attempt to steal data and disrupt a business.

Certain bot tools and communities that try to obtain the latest models of sneakers from Nike and Adidas and others, known as cook groups, aim to limit their membership to a small group of users. This ensures that they do not tip their hand on second-rate products and gives defenders an insight into their strategy. They effectively save their bullets for the most important launches. During a 3-hour launch for a highly anticipated sneaker, a large footwear and apparel retailer detected and mitigated a bot attack that was 50X normal, coming from more than 200 million unique IPs.

The attack did not end there with the next phase incorporating one of the aforementioned attack secrets. One cook group had discovered the existence of a shadow API which invoked the Apple Pay functionality on the retailers’ platform. To avoid detection for as long as possible, the attackers held onto this trick until the last minute, and as soon as the launch began, the (shadow) Apple Pay API was hit with more than 100 million malicious API requests, all from high-quality residential proxies. While the attack was successfully mitigated using shadow API specific ML models and policies, it highlights how third-party payment APIs (e.g., Apple Pay, Google Pay, PayPal, etc.), typically managed by the business groups can fall outside of the security team’s view. These APIs are coded correctly, but their shadow classification, and lack of protection makes them more susceptible to an attack.

Third-party API Hammered by High Volume Enumeration Attack

In another example of abusing the trust established by the API-host-to-user relationship, a local inventory search function used to enable Ulta Beauty customers to find and buy products nearby was hit by an attack that was 700X larger than average load.

The attack originated from high-quality residential proxy IP addresses rotating through more than 153,000 unique product and SKU combinations while scraping 61,000 ZIP codes and 33,000 products. These proxies rendered traditional web application firewall (WAF) and CDN mitigation efforts ineffective. With the attack volume increasing, the inventory search API supplier notified the Ulta Beauty security team of the sudden traffic surge, requesting help to stop the attack or to renegotiate their financial terms. The investigation mapped the attack to OWASP API4 (Lack of Resources and Rate Limiting) and API5 (Broken Function Level Authorization).

The Cequence CQ Prime Threat Research team worked closely with the Ulta Beauty security team to put policies in place to block 85.9 million total requests resulting in $80,000 saved in infrastructure and loss prevention. At the height of the attack, policies were blocking upwards of 17 million requests based on the following behaviors:

• Aggressive enumeration: The attack cycled through ZIP codes to find areas with a greater concentration of products with higher retail values impacting resources and infrastructure.
• Web-to-mobile shift: Initially, attackers targeted the web API, but quickly pivoted to the analogous mobile API which provides similar information.
• Direct-to-API: The attack was designed to target the inventory API directly, without hitting any other app or web function. Typical behavior would show the user traversing multiple APIs.
• Volumetric threshold: The attacker used enumeration to rotate through the inventory at such a volumetric rate that it represented 90% of ALL the customer traffic at the time.
• Outdated browser used: The attack was built to use very outdated or anomalous versions of Chrome.
• Single cookie generation: Each attack generated a single cookie whereas typical users would generate upwards of 40-50 cookies as they browsed the inventory.

API Security and Bot Protection are Inextricably Connected

The rapid growth in API attacks and the corresponding, dedicated API security solutions market has led to a confusion that stopping bots and API security do not belong together. The truth is APIs and bots are inextricably connected. The same characteristics that developers love about APIs – flexibility, speed, ease of use – are also loved by attackers who, as shown in above, either find coding errors to exploit, or use bots to attack trusted, perfectly coded third-party APIs, or a combination of both.

Complete API protection will be illusive unless security and development have a complete understanding of how APIs – both correctly coded or those with errors – can be attacked. This includes how a risk is discovered, the tactics, tools, and procedures attackers use to exploit it, and how attackers will react to resistance. This means not only making sure that your APIs are not susceptible to the OWASP API Security Top Ten as a starting point, but also to look at what can be defined as API10+, a category that encompasses the many ways that a perfectly coded API might be abused.

Schedule your third-party API protection demo today.

The ability to prevent an API attack in real-time, without relying on integration with a WAF, or other tool is a must-have API security requirement. Native, or real-time API threat prevention ensures you respond to the attack as quickly and efficiently as possible. The difference between relying on a third-party and real-time prevention is like setting a signal fire to alert rescuers that you are lost vs a park ranger arriving in a Jeep to save you. Let me explain.

Imagine you are hiking and become disoriented. You’re about ready to set a signal fire to alert rescuers, when a park ranger drives up in a Jeep, offering you a ride home. Which option would you choose? The obvious choice is the one that gets you to safety most quickly. Now, shifting gears to API protection, let’s apply the same scenario.

Your APIs are under attack, and your existing web application firewalls (WAF) and other security tools cannot keep up, so you look to the wide array of API security offerings who bill themselves as being able to mitigate API attacks. Yet when many of these full lifecycle API products detect an attack, they rely on signaling another tool, most often a WAF, to initiate mitigation. This is an important, and somewhat ironic point that bears repeating. The API security offerings that came to market because WAFs are not able to detect sophisticated attacks against APIs, rely on signaling WAFs to block the same attacks that WAFs miss. Which do you want? A signal fire, or a guaranteed ride home?

History Repeats Itself

A quick review of the evolution of web app protection shows us that many of the testing and protection tools that exist today came to be some time after web applications existed. These tools were developed because web apps were being deployed with gapping security holes. Testing efforts helps reduce the number of vulnerabilities, but attacks persisted, leading to the introduction of WAFs as a way to protect your web app from a known threat using signatures. This moved protection out of development to where the attacks were targeted. Location matters when it comes to mitigation.

That same scenario exists with API security. The tools that exist today were borne out of the need to find and fix API errors sooner and the existing web testing tools could not adapt. Existing API security tools are heavily focused on the development side, which means they tend to be deployed more deeply in an organization’s infrastructure. So while they may see the end result of an API specific attack, their location within the infrastructure makes them ill-suited to take an action, requiring that they send a signal to a third-party tool (like a WAF) that is located nearer to the perimeter.

Real-Time Protection Means Being Proactive – Not Passive

Mitigating an attack means being proactive, responding to malicious actions immediately. Some of the more modern, AI-based WAFs are deployed in an active mode, most WAFs still rely on static signatures and rules based on vulnerability findings. The result is a high false positive rate and an equally high operational overhead to keep them in sync with application changes. This means that many WAFs are deployed in a passive mode which allows users to pass PCI and other compliance requirements but makes them unable to mitigate an attack directly. This challenge, coupled with additional management challenges and signaling delays highlights the importance of being able to see an attack in real time, and mitigate the attack in real time with policy-based actions. The Cequence Unified API Protection solution uses hundreds of predefined policies that can be enabled to mitigate attacks out-of-the-box based on a wide range of dynamic criteria including malicious infrastructure and thousands of attacker behavioral patterns.

Location Matters for Real-Time API Threat Prevention

Just as location matters when trying to be rescued, so too does it matter when it comes to mitigating an API attack. The move to an API first methodology world changed how the perimeter is viewed. WAFs are typically deployed at the perimeter, as part of a CDN (Content Delivery Network) offering or in the form of a dedicated cloud based WAF. The perimeter location dictates that all API traffic in need of protection be routed though the CDN.

The challenge arises with the fact that APIs typically generate and exchange dynamic content, minimizing the need for content caching. Rather than route APIs through a CDN, API gateways are now considered to be the new (API) perimeter. Acting as management and access control layer, multiple API gateways, sometimes from different vendors are often distributed across an organization. This means that if an API security offering detects an attack on an API, the WAF to be used for blocking may not be able to block the attack because it is not in the line of traffic. In contrast, the Cequence UAP solution integrates with a wide range of API gateways, CDNs and proxies to ingest all your API traffic to uncover and respond to attacks regardless of the location.

Real-Time Protection Means Now

Much like a signal fire may mean a rescue, albeit delayed, so too does signaling a WAF with an ongoing attack. But prior to the attack mitigation conversation, there are several other areas of delay to consider.

• The first delay to consider is the effort to integrate the two solutions and validate it will function properly in a business-critical capacity. If a WAF goes down because of a faulty integration, or the connection itself fails, what is the recourse?
• Integration validation of third-party tools is time consuming and never a one and done scenario. It must happen each time the two respective tools are updated, adding to the overburdened dev team workload.
• Do the two products speak the same language? Will the WAF accept an IP address as a blocking target or is there a more involved process of creating a signature in the (typically) proprietary WAF signature language. The critical consideration here is to ensure that the detection and mitigation fidelity matches.

Finally, the process of initiating a block may be delayed by the need to manually validate the attack and any network congestion that may exist between the API security tool inside the dev environment and the WAF located at the CDN/perimeter. Real time mitigation, without the need to signal a third-party is a core feature of the Cequence UAP, enabling customers to quickly detect, analyze if needed and respond to an automated attack or vulnerability exploit.

Reliance on Third-Party Signaling Impacts Efficacy and Feedback

At the end of the day, your security tools are only as good as the efficacy rates they deliver in finding and blocking attacks. Whereas known, CVE-based vulnerabilities have corresponding signatures that may deliver successful blocking via your WAF, attacks on perfectly coded APIs may appear to be legitimate traffic resulting in false positives and low(er) efficacy. To maintain high efficacy against ever changing attack, your API security solution should include predefined, yet customizable policies that can be enabled for immediate protection. These policies should be fully developed, ready to use, and be based on:

• User behaviors leveraging a threat research database of observed patterns over time
• Known malicious infrastructure and tools collected from customer environments
• Stolen, or compromised credentials as posted on the wide range of criminal repositories

While out-of-the-box, high efficacy policies are critically important, every environment and attack is different, so it is equally critical that your security team be able to view the traffic analysis and policy results to extract details and apply modifications to maintain protection. In depth analysis based on the result is not possible when your analysis is performed separately by the API security offering and your response is performed by a WAF. These capabilities are exactly what the Cequence UAP includes as part of its centralized management dashboard.

Response Flexibility Enhances Real-Time Protection

There may be scenarios where you want to go beyond blocking as your mitigation response. You may want to send a deceptive response to the attacker, or respond based on a set of behaviors. This mitigation flexibility is elusive when you rely on signaling a WAF for a number of reasons including:

• The third-party solution response options may be limited to simple IP addresses and basic WAF rules, which attackers can easily bypass.
• Depending on the network architecture, the third-party solution may not see the same API traffic as your API Security solution, making it useless from a response point of view.
• The signaling provided may not include any context surrounding the attack behavior or actions, thereby forcing you to make a block or not decision.

Having flexibility in your response options is critically important to your real-time API threat prevention strategy. Simply blocking API requests is not always an ideal response as it may encourage attackers to try different methods and may not be feasible from a business point of view. For example, a business may detect a data governance issue with a business-critical API, so blocking access to that API may not be an option. The Cequence UAP solution allows you to detect and block attacks on legitimate APIs while the DevOps team develops and rolls out a fix.

Learn More About Real-Time Protection with Cequence UAP

Whether you are just starting your API protection journey, or you are deeply entrenched in an API-first methodology, on-box, real time mitigation is a critical capability that should not be overlooked. Being able to see the attack traffic, analyze it, respond, and adjust based on the results is not something that can easily be accomplished when using two different solutions, with disparate management interfaces, and possibly located in different parts of your network. Learn more about the Cequence UAP solution.

<![endif]–>Schedule Your Free API Security Assessment <!–[if mso]>

Cequence Unified API Protection integrates with the leading content delivery network (CDN) solutions such as Akamai, Amazon, CloudFlare, and Fastly, complementing their basic API security features to ensure all APIs are discovered, analyzed and protected, regardless of location.

CDNS were originally designed to help organizations optimize their public facing web and API-based application content delivery. Over time, CDNs added application security like web application firewalls (WAFs), bot prevention, and distributed denial of service (DDoS) protection to increase their revenue streams and to provide these additional customer benefits:

• Reduced Infrastructure Cost: Stopping volumetric threats at the edge means reducing hosting and bandwidth cost.
• Improved Performance: Single-pass architecture reduces multiple hops necessary for different security solutions, thereby improving performance and latency characteristics of the apps.
• Reduced Security Workload: Most WAAP or cloud WAF solutions are offered as managed security solutions, thereby helping the already struggling security staff.
• Delivering web application security at the CDN layer made perfect sense with industry analysts supporting the architecture by creating the web application and API solution category (WAAP).

API Security Challenges Introduced by CDNs

Developers have come to love APIs because of their inherent flexibility and power – each API includes all necessary commands, payload, and data to produce engaging user interactions. As organizations continue to move aggressively towards an API-first development methodology to support their public facing applications, the solution architecture becomes more complex while the customer benefits delivered by all-in-one CDN and WAAP offerings are lessened. Some of the API security challenges CDNs face include:

• Increased costs: APIs do not require caching, and routing that traffic it through a CDN merely increases costs.
• Latency: Widespread API adoption often means incorporating cloud-based services, microservices and API gateways outside of the CDN, introducing latency from traversing multiple cloud resources.
• Lack of API visibility: The distributed nature of API development and the wide variations in use cases means CDNs may never see some of the APIs.
• Low efficacy bot protection: The clientless nature of an API means that CDN-based JavaScript and SDK integration-dependent bot protection cannot be implemented effectively.
• Weak API risk analysis: CDNs lack in-depth analysis required to uncover coding errors that can lead to vulnerabilities easily exploited by bad actors.

To improve API security without losing the caching benefits of a CDN, an alternative approach is to route the API traffic to a dedicated, SaaS-based API protection solution where it can be inventoried, analyzed, and protected.

Check out our Growing List of Technology Integrations

Cequence Unified API Protection and CDN Integration

The Cequence Unified API Protection (UAP) solution addresses the API security challenges of a CDN-based approach with full API protection lifecycle coverage. Deployed as a SaaS or as a hybrid architecture, the Cequence UAP integrates with leading CDN offerings from Akamai, CloudFlare, Amazon CloudFront and Fastly to provide customers full API protection without losing the benefit of CDN web content caching. Cequence UAP features include:

• Discover Public Facing API Attack Surface: API development and deployment is often distributed across many groups, introducing the risk of APIs deployed outside of a CDN purview. The Cequence UAP solution solves that challenge by continuously assessing your public facing APIs and resources to provide an attackers view of your organization’s attack surface, including cloud hosting services, any associated API endpoints, and servers that may be vulnerable to Log4j and LoNg4j exploits.
• Centralized Inventory Tracking of Known and Unknown APIs: The Cequence UAP solution integrates with CDNs and a range of API gateways to provide centralized API visibility and inventory tracking of all the APIs deployed and managed by the respective API gateways. Unregistered or unknown APIs are also discovered, allowing security and development to migrate those shadow APIs to the respective API gateway to ensure security and governance policy consistency.
• Strengthen Compliance and Data Governance Controls: Cequence helps organizations enforce compliance and governance controls with proactive API risk analysis and remediation. Predefined and custom risk assessment rules help organizations teams find and remediate coding errors that introduce sensitive data handling and authentication vulnerabilities that can lead to data governance and compliance violations.
• Detect Sophisticated API Attacks: Going beyond basic protections that CDNs can provide, Cequence UAP analyzes your APIs using ML-based analysis based on a threat database with millions of records and behavioral fingerprinting to detect and continually track sophisticated API attacks as they retool to evade detection.
• Flexible, Real time Mitigation Responses: Real time responses to API attacks range from basic block and rate limiting to HTTP header insertion and deception, all executed in real time, per policy or per app, without reliance on integration with third-party WAFs.

Review the API gateway integration guides from Akamai, CloudFlare, Amazon CloudFront, and Fastly to learn how the Cequence UAP can protect your APIs and reduce your CDN expenditures.

Schedule Your Free API Security Assessment

API threat research by the Cequence CQ Prime Threat Research team confirms shadow APIs are the top threat challenging the industry with 31%, or 5 billion malicious transactions observed in the first half of 2022 targeted unknown, unmanaged and unprotected APIs, commonly referred to as shadow APIs.

Top API Threat Research Findings

The data, drawn from the CQ Prime Threat Research team reviewing roughly 20 billion customer API transactions from the first half of 2022 focuses heavily on active API exploit attempts, delivered by bots, and natively mitigated. Some of these findings may appear new to the API security industry, yet these patterns have been in use consistently by attackers for years.

Shadow APIs are the #1 Attack Vector

Roughly 31%, or 5 billion of the 16.7 billion malicious transactions targeted unknown, unmanaged and unprotected APIs, commonly referred to as shadow APIs and categorized as OWASP API9 (Improper Asset Management). Shadow APIs are relatively easy for attackers to discover by analyzing an organization exposed APIs and then simply fuzzing or modifying the values, enumerating through other API endpoints on different versions, under different hostnames to find other API variants.

API10+: Perfectly Coded APIs Abused by Bots

An unofficial extension to the OWASP list, API10+ was the second largest API security threat with 3.6 billion malicious requests mitigated during the first half of 2022. API10+ highlights how attackers target perfectly coded APIs that either do not cleanly fall into any of the OWASP API Security Top 10 threats or use a combination of them to achieve their goal. The 3.6 billion malicious requests were made up of shopping bots, gift card fraud, fake account creation and comment spam.

The Unholy Trinity: Credential Stuffing, Sensitive Data Exposure and Shadow APIs

The first half of 2022 showed roughly 100 million malicious requests using a combination of OWASP categorized threats to execute their attack.

• • API2 (Broken User Authentication): Attackers used a credential stuffing attack to target the authentication mechanism protecting user integrity. The attack included functionality to test the user confirmation API to determine what sensitive data was returned during the login process.
  • API3 (Excessive Data Exposure): When the user confirmation APIs returned more data than necessary, the attackers then stole the data or looked for variations of the same API to target.
  • API9 (Improper Assets Management): attackers enumerated the victim’s infrastructure using known API patterns that were susceptible to the same API2 and API3 risks, but they were invisible to the security team (improper assets management).

In an example of research mimicking real life, the use of multiple OWASP categorized threats is nearly identical to what was found in the recent Optus Telecom API security incident. The combined use of these threats shows new levels of analysis attackers are performing to understand how each API works, how they interact with each other, and what the expected outcome is.

These attacks are perfect examples of why APIs have become the attackers target of choice and why APIs and bots are inextricably connected. The same characteristics that developers love about APIs – flexibility, speed, ease of use – are also loved by attackers who either find coding errors to exploit, or use bots to attack perfectly coded APIs, or a combination of both. The uptick in API usage and bots to attack perfectly coded APIs is likely one of the reasons that Forrester included API Security and Bot Management as two technologies CISOs must have on their list to invest in their recently published Security Risk Planning Guide.

Steps to Take Now to Protect Your Organization and End Users

APIs have been in use for many years; however only recently have their use cases emerged from deep within IT to being the cornerstone of all things digital. This shift makes API protection a key initiative for the business, not just the business unit or security and development teams. As shown in this report:

• APIs are under attack from many different vectors, directly impacting a company’s bottom line driven by lost customers, brand damage, IT infrastructure cost overruns, compliance violations and more.
• The view that API protection can be addressed by a shift left, development focused effort with the OWASP API Security Top 10 list is a start but threat actors do not adhere to a top 10 list, and perfectly coded APIs are susceptible to attacks, as shown in the category we define as API10+.
• Alternatively, protecting APIs is not solely the responsibility of the security team. Here too, the high volume of attacks on shadow APIs highlights the obvious – you cannot protect what you cannot see. API Protection needs to be treated holistically, with a uniform approach that begins with discovering, identifying, and inventorying your API footprint.

Get Your Copy of the Report

To learn more, download the full report API Protection Report: Shadow APIs and Automated Abuse Explode and view the Infographic and watch the video. Lastly, if you’re interested in seeing how our Unified API Protection Solution can assist you, request a free API Protection assessment.

In another example of pandemic influenced actions, the largest Canadian pizza chain was targeted by a credential stuffing attack that was successfully mitigated resulting in a $1.6M savings.

Most people would not imagine pizza as a cybercrime target but remarkably Canada’s largest retail pizza chain had been experiencing just that, a set of ongoing cyberattacks and retail API security challenges that disrupted their business. This pizza chain had just moved a key application to the cloud that now was being targeted by cybercriminals. This was a mission-critical API application because it processed all customer orders, regardless of the ordering method which could be done by a mobile app, calling a 1-800 number, or at a brick-and-mortar store.

Existing Security Solutions Couldn’t Rise to Meet the Challenge

When the pandemic hit, they saw a dramatic uptick in web and mobile traffic, which they attributed to work from home orders but in fact the majority of the traffic was malicious API traffic. Cybercriminals had discovered a new target and were executing automated credential stuffing attacks that were not only attempting to gain access to user accounts but also were now affecting web and app performance that was disrupting the experience of their users.

This is what the security team was looking for in a new API protection vendor:

• Collaborative partnership: They wanted to partner with an API protection vendor to work collaboratively together to proactively discover and defend against new attacks.
• Machine learning: A solution that used machine learning to automatically discover attacks without the need of an analyst to piece together an impending attack.
• Move from reactive to proactive: Avoid being constantly reactive and move to a more proactive mode, where the security team could stay ahead of their attackers.

Cequence Retail API Security Enters the Picture

Cequence Unified API Protection (UAP) was introduced to the pizza chain’s security team and tipped the balance of power between the cybercriminals and the company. After implementing the Cequence UAP solution, this pizza chain was able to do the following:

• Fraud Prevention: Blocking credential stuffing attacks ensured that account compromise and fraudulent purchases were prevented with near-zero false-positive rate.
• Moved to proactive security: Where in the past the security team was constantly responding to attacks as they happened, they could now move to a more proactive mode where they had time to investigate further.
• Positive user experience: In the past, customers could encounter performance issues due to the high level of malicious traffic that attempted to access the web and mobile application. Now with Cequence, customers have uninterrupted access to get their favorite pizza.

Cequence Unified API Protection Dashboard

Pizza Worth $1.6 Million?

Working together, the pizza chain and Cequence put policies in place that have successfully blocked over 5,800 Account Takeover (ATO) attacks that resulted in over $1.6 million in savings in potential account losses. This ensured moving forward that this pizza chain was able to enable ongoing API protection that could automatically mitigate future attacks that targeted their mission-critical application and allow the company to continue to sell pizza to hungry Canadians uninterrupted.

Learn more about Retail API Security and how Cequence helped this pizza chain achieve API protection.

Get a Free API Security Assessment of Your API Attack Surface 

Free API Security Assessment

Executive Summary

Cequence Security assisted the Ulta Beauty CTI team to mitigate a persistent, high-volume inventory API scraping attack. While the goal of the attack was initially uncertain, potential motivations included enabling real-world shoplifting opportunities by mapping popular inventory. The attack was executed across a third-party local-inventory search API, and mitigating it saved Ulta Beauty significantly across infrastructure and inventory costs.

Enumeration Attack Against Third-Party APIs

The attack unfolded as the volume of requests against local-inventory search APIs spiked at 700x normal volumes rotating through more than 153,000 unique product and SKU combinations while scraping 61,000 zip codes and 33,000 products. The local-inventory search API supplier notified the Ulta Beauty team of the sudden traffic surge, and an investigation uncovered an enumeration attack with the following characteristics:

• High-quality, residential proxy IP addresses were used to make IP blocking at the edge difficult.
• The attack enumerated through ZIP codes to find high concentration of specific products with high retail values.
• Initially, a web API was targeted but that quickly pivoted to the analogous mobile API which provides similar information.

Collaborative Efforts Save $80,000

Working together, the Ulta Beauty CTI and the CQ Prime threat research team put policies in place that have successfully blocked 85.9M total requests since April 1st resulting in $80,000 saved in infrastructure and loss prevention. Cequence was deployed fully on AWS with multiple availability zones and Auto Scaling groups enabling Ulta Beauty to scale up and down automatically as needed. At the height of the attack, policies were blocking upwards of 17M requests as shown in the following chart.

Policies block traffic that exhibit the following behaviors:

• Direct-to-API: The attack was designed to target the inventory API directly, without hitting any other app or web function. Normal behavior would show the user traversing multiple APIs.
• Volumetric threshold: The attacker used enumeration to rotate through the inventory at such a volumetric rate that it represented 90% of ALL the customer traffic at the time.
• Outdated browser: The attack was built to use very outdated or anomalous versions of Google Chrome.
• Single cookie generation: Each attack generated a single cookie whereas normal users would generate upwards of 40-50 cookies as they browsed the inventory.

A Win for All Parties

The rapid response and teamwork in blocking this attack resulted in a win for Ulta Beauty to the tune of $80,000 and a win for the local-inventory search API vendor, which no longer needed to bear the increased infrastructure costs. It’s also a win for the CQ Prime threat research team who mobilized quickly to identify the attack, motives, and behaviors and respond with appropriate blocking policies.

Customer Profile

Poshmark is a leading online marketplace that enables users to buy and sell new and secondhand styles for women, men, kids, homes, and more. Founded in 2011 in Redwood City, California, Poshmark has over 100 million registered users in its vibrant community across the U.S., Canada, Australia, and India. Today, there are more than 200 million available listings on its platform.

Increased Account Takeover Attempts Alongside Rapid Growth

Poshmark, a prominent social commerce marketplace, enables users to buy and sell new and secondhand styles on their the Poshmark website and mobile app. The ease, simplicity, and fun of the buying and selling experience has enabled millions of people around the world to bring their closet online with just a phone. As the marketplace grew, it attracted malicious activity that needed to be addressed to protect the company’s brand reputation and preserve the end user experience. Poshmark’s security team noticed an increase in the variety of new automated account takeover (ATO) attacks that used credential stuffing to compromise end user accounts. They saw this increase in attacks across both their web and API applications, neither of which had any API protection to detect or block these types of automated attacks.

Goals

• Inline Blocking: Real-time blocking of all malicious bot traffic with a very low false positive rate, ensuring that only real user traffic reaches the application.
• Reduce CAPTCHA: No longer rely on CAPTCHA as the primary way to identify bot activity.
• Fast, Easy Deployment: Quickly implement a new solution without disruption to buyers and sellers. Avoid integrating JavaScript SDKs into web and mobile applications which increase software and QA cycles for every product release.

Traditional Methods Disrupted User Experience

To identify and block suspected automated attacks, the security team had implemented a CAPTCHA challenge that disrupted the user experience and increased friction for user signup and login.

Poshmark needed a security solution that could block automated fraud attacks while improving the experience for buyers and sellers. Poshmark partnered with Cequence to deploy the Cequence Unified API Protection platform.

Immediate Bot Mitigation with Zero User Friction

After implementing Cequence, Poshmark was able to block malicious bot traffic in real time before it reached their application. This also enabled Poshmark to dramatically reduce CAPTCHA challenges, streamlining the user experience and ensuring that only legitimate users were on their platform. Additionally, Cequence was deployed fully on AWS with multiple availability zones and Auto Scaling groups enabling Poshmark to scale up and down automatically as needed during important sales events or high-volume attacks.

Poshmark is now able to do the following:

Results

• Real-time Blocking: Inline blocking of malicious bot traffic, ensuring that only legitimate user traffic reached their mission-critical applications.
• Prevent Fake Accounts: Block fake account creation used to conduct malicious activity across mobile and web sites.
• Block ATO Attacks and Malicious Signups: Significantly improve reliability and uptime while reducing fraud.
• Preserve Marketplace Social Integrity: Ensure comments originate from legitimate users on listed items and prevent fake comments from bots.
• Minimize User Experience Friction: Improve user experience by limiting CAPTCHA challenges to suspicious traffic, preventing malicious bot activity.

Success Metrics

• Reduced cancellations due to a decrease in malicious activity.
• Mitigated operational impacts like performance, reliability, and uptime.
• Improved the end user experience, reducing CAPTCHA challenges by 99.3%! Challenges were reduced from 2,600,000 logins to only 18,000 per week.
• Blocked over 609K attempted ATO attacks, saving an estimated $2,192,400* in potential account losses.
• Reduced hours spent by internal team members on manually battling malicious cyber attacks.

*Based on a $3.60 account loss per account LexisNexis® True Cost of Fraud™ Study.

A Leading Provider of Consumer Lease and Loan Solutions

Snap Finance provides a suite of very popular lease-to-own (LTO) and installment loan options for millions of consumers. The company serves a two-sided marketplace ─ with consumers on one side, merchants on the other. Snap Finance provides a high degree of customer engagement, a flexible consumer product line, as well as an optional virtual card. Its risk-based machine learning models allow for very fast decisions, simplifying the purchase process for consumers as well as the retail organizations they frequent.

IT and Business Challenges

Snap Finance is a cloud-forward organization. The company’s IT team manages some on-premises infrastructure at the company’s headquarters in Salt Lake City, UT, and a secondary center in Costa Rica, but all internet and business-facing applications are now in the cloud.

Gaurav Kohli, Snap Finance’s CTO, is responsible for managing all digital properties across both physical sites and in the cloud, with an emphasis on security and scalability. “We have several thousand API endpoints,” Kohli explained. “Not only do we serve our consumers through our own digital properties, we also have direct integrations with marketplaces and other large merchants that interact directly with our APIs. Making sure all of this data is secure is no easy task.”

Maria Ng is the company’s CISO. When she joined Snap Finance in 2022, her mandate was to optimize the company’s digital properties, using API-first approaches. She is now responsible for protecting all of Snap Finance’s corporate, customer, and merchant data. She also manages the company’s privacy, governance, risk and compliance, and cyber security programs. “Our strategy is to be omnichannel,” she explained. “We want to meet the customers wherever they are—whether that’s Android, iOS, desktop, or browsers. We recently launched our new mobile app and it has already surpassed 500,000 downloads with a 4.9 rating. This is why protecting our APIs is so important to us.”

Before moving to Cequence, Snap Finance used a collection of disparate fraud protection technologies. The company’s security team was able to identify and block many potential threats with those solutions, but they were unable to perform bot management in an easy and effective manner

Snap Finance started looking for an automated bot management solution two years ago. “We needed to find a partner with a broad understanding of the API and security space,” said Kohli. “We also wanted to work with a vendor that provided a managed service, rather than having to employ more security personnel to cover all of these necessary functions.”

Challenges

• Wanted to improve and automate bot management

Solution

Cequence Bot Management

Benefits

• Enhanced API security with better defense at the perimeter
• Effective bot management reduced the number of reportable threats to zero
• Eliminated the need to hire two full-time security professionals

Choosing Cequence Bot Management

Snap Finance chose Cequence after evaluating several potential bot management vendors. A module of the Cequence Unified API Protection platform, Cequence Bot Management was first deployed to protect Snap Finance’s consumer application portal – the platform consumers use to see if they are qualified, and where returning customers can log in and apply for new loans or leases.

“We haven’t found another bot protection solution in the market today that can compete with what Cequence is offering,” admitted Kohli. “None of them have a story that’s as compelling or a solution as robust as the Cequence Unified API Protection platform.”

The Cequence bot management and fraud prevention solution protects an organization’s web, mobile, and API applications from the full range of bot attacks to prevent data loss, theft, and fraud. Powered by an ML-based analytics engine that determines in real time if application and API transactions are malicious or legitimate, Cequence Bot Management natively mitigates attacks and eliminates harmful business impacts such as downtime, brand damage, skewed sales analytics, and increased infrastructure costs. Bot Management is available standalone or as part of the Cequence Unified API Protection platform.

Improved API Security Posture with Defense at the Perimeter

“In terms of bot protection, my philosophy is to ‘keep the fight outside my lawn’,” explained Ng. “I don’t want to have any interactions with threat actors on my edge — I want to push that perimeter out as far as I can. Cequence is able to intercept bad traffic from threat actors outside of our perimeter. With this capability, our threat posture has been significantly improved.”

Automating Bot Management

“The Cequence managed service has definitely reduced the number of things our security team needs to pay attention to,” noted Ng. “Cequence provides consistent, detailed reports on what threats were received, how much traffic was blocked, which threats were automatically mitigated, the ones advanced to manual review, and any threats we were notified on. The Cequence managed service gives us much more breathing room. By taking care of bot management for us, we can now focus on other strategic IT projects.”

Reducing the Number of Reportable Breaches to Zero

One of Ng’s responsibilities as CISO is to provide regular security updates to the company’s board of directors. “I inform them of any reportable breaches and attempted attacks,” said Ng. “At our last meeting, I was happy to inform them that we’ve had no reportable breaches since deploying Cequence.”

“When I first joined Snap Finance, there were some bad actors trying to use our applications to obtain confidential information,” Ng shared. “Fortunately, we were able to use Cequence to mitigate that attack, avoiding any availability or data loss issues.”

Benefits

• No CAPTCHA Needed Network-based approach requires no agents, JavaScript, or SDK integration
• Native Mitigation Attack identification and blocking without relying on third-party infrastructure such as WAFs
• Rapid Time to Value Deploys quickly and is immediately effective
• Flexible Deployment Model Supports on-premises, SaaS, or hybrid deployments
• Fraud Prevention Customizable, granular policies for organization-specific use cases

Reducing IT Expenses

Cequence is also enabling Snap Finance to reduce IT time and expense. “If we didn’t have the Cequence managed service, we would have to hire two full-time security professionals, in addition to purchasing and deploying another solution that would enable us to perform bot management by ourselves,” Kohli said.

Recommending Cequence to Others

When asked if he would recommend Cequence to other companies, Kohli replied, “Yes, absolutely. We have a very strong partnership with Cequence—they were right there with us all along the way. Our Cequence account rep meets with us regularly to discuss our deployment and listen to any suggestions we might have for future product enhancements. Unlike other partners or vendors, our relationship with Cequence did not end after we signed the sales agreement. They really care about our ongoing success with bot management. With Cequence, we worry less about malicious or suspicious traffic reaching our applications.”

About Snap Finance

Snap Finance harnesses the power of data to empower consumers of all credit types to get what they need. Launched in 2012, Snap’s technology utilizes more than a decade of data, machine learning, and non-traditional risk variables to create a proprietary platform that looks at each customer through a more holistic, human lens. Snap’s flexible solutions are changing the face and pace of consumer retail finance. For more information, visit snapfinance.com.

A Highly Successful Athletic-Inspired Fashion Retailer

Hibbett has grown rapidly in both size and popularity since opening its first store in Alabama in 1945. The company distinguishes itself from other retailers with its wide network of convenient locations in smaller cities that aren’t typically served by the larger brand stores, its personalized customer service, and comprehensive access to coveted footwear, apparel, and equipment from the nation’s top brands. In addition to its vast network of retail outlets located across the United States, Hibbett also supports a large on-line presence. Hibbett’s loyal customers can choose between visiting stores located in their own communities, or the convenience of ordering products from the company’s website (hibbett.com).

Challenges

• Needed better visibility into APIs to reduce the risk of data loss, theft, fraud, and business disruption
• Looking for a solution that was easy to deploy, without the need for third-party tools
• Wanted the ability to detect and remediate API vulnerabilities before moving new apps into production

IT and Business Challenges

Lee Morris has worked for Hibbett for over 30 years and is now the company’s Senior Director of Security and Infrastructure Architecture. “Security is no longer the department of ‘no’,” said Morris. “With all of the powerful technology solutions we have in place, we are now recognized as a business enabler.”

Hibbett relies on a hybrid IT environment for its retail and online operations. Several of the company’s critical services are supported on-premises, while others are now transitioning to the Oracle cloud, with a suite of SaaS products and Azure Identity Services. “Hibbett has gone from just a few API processes moving data between a couple of applications, to an environment where almost everything we do is through API communications,” said Stephen Scandrett, Senior Security Engineer at Hibbett Sports. “There’s a lot of data moving between all of our internal applications and external systems. Managing that communication from a security perspective is the ultimate priority for our team, given the importance of protecting our revenue stream, along with our proprietary and confidential customer information.”

Before implementing the Cequence solution, Hibbett was looking to strengthen their API security and bot management solutions. “We only have a modest number of APIs now, but that will increase rapidly as we move more of our infrastructure to the cloud,” explained Scandrett. “We needed a way to make sure everything was secure and built into the system before ramping up our API usage. We didn’t want to wait until it got beyond our control and became a headache to manage.”

Results

• Gained the ability to easily discover and protect all internal and external APIs
• Achieved a fast and seamless deployment, without needing third-party integration tools
• Obtained multiple API protection features with just one, integrated solution
• Increased data security by identifying and fixing API vulnerabilities before launch
• Gained the ability to create custom policies for mitigating and blocking bot attacks

Ensuring Availability

One of the IT team’s biggest challenges is protecting application availability during new solution deployments. “Everything needs to be operational 24×7, or it will have a negative impact on our business,” noted Scandrett. “Availability is a huge component of security, and I didn’t want any new security measures to affect our revenue streams or business partnerships in any way, shape, or form. We had to make sure any systems we implemented wouldn’t cause latency or throughput issues with our APIs or the data that’s transferred between them.”

Searching for a Way to Improve API Security

Morris and Scandrett started the search for an API protection solution by listening to peer reviews and reading industry analyst reports. They looked at the most recent Gartner Peer Insights data to identify the top API security companies.

Morris and Scandrett then created a list of the API security and bot management capabilities that were essential for their organization. “Discovery was the most important functionality for us because we had limited visibility into our internal and external APIs,” explained Scandrett. “The second criterion was the testing capabilities of the solution. Many of our APIs were developed in-house and we needed to strengthen the static and dynamic code analysis scanning to proactively identify vulnerabilities. We needed the ability to test all of our code and fix any issues before new applications were pushed out to production.”

Why Cequence Security?

After a thorough review of available offerings, including watching demos and attending several vendors’ presentations, Hibbett chose the Cequence Unified API Protection Platform. “Cequence was the only solution that met all of our criteria,” said Morris. “In addition to being named as an API protection technology leader in the industry analyst reports, Cequence had very positive customer reviews — not only for its API security products and capabilities, but for its high level of customer service as well.”

Another reason Hibbett chose Cequence was its out-of-the-box integrations with over 300 third-party APIs. “All of the other vendors’ solutions required some type of third- party tool to perform blocking actions for runtime protection,” Scandrett explained. “Whether a WAF or an API gateway, they all needed additional software to provide the necessary functionality. Cequence was the only vendor that was able to do everything we needed without requiring us to purchase and deploy any additional software.”

A Fast and Easy Deployment

The Cequence API protection solution was also very easy to deploy, requiring no changes to Hibbett’s on-premises, cloud, or SaaS infrastructure. Cequence was deployed fully on AWS with multiple availability zones and Auto Scaling groups enabling Hibbett to scale up and down automatically as needed. Traffic flowed in through the customer CDN, into AWS Cloud, through Amazon Route 53 DNS service, and into one of several Availability Zones. Within the Availability Zones, traffic flowed through a public subnet containing application load balancers and into a private subnet with an Auto Scaling group. From there, traffic was directed by a network load balancer and into the customer environment. All of this occurred within the Cequence AWS Cloud instance, ensuring a simple and straightforward deployment. “All we had to do was make a quick public DNS change to route our traffic through Cequence,” explained Scandrett. “It was as simple as that. We didn’t have to change any of our internal coding, and we experienced no down time or latency during the installation.”

Gaining Visibility into all APIs

Every API that Hibbett has is now going through Cequence. “One of the biggest benefits we’ve obtained with Cequence is the ability to identify all of our APIs and detect any flaws in our code before launching a new solution,” said Morris. “We see API breaches in the news all the time now, and this was an area where we really didn’t have enough insight. The Cequence Unified API Protection Platform is enabling us to ensure our critical services are adequately protected before deployment, allowing us to continue to grow and prosper in the highly competitive retail market.”

Saving IT Time and Accomplishing Multiple API Protection Goals

The Cequence solution has also eliminated the need for Hibbett’s security administrators to spend a lot of time on API management. “To put a number to the actual IT time savings we’ve obtained would have been impossible prior to deploying Cequence,” admitted Scandrett. “If we had attempted to do everything manually or seek out separate tools to accomplish what Cequence provides, it would have taken a huge amount of time. And even then, our efforts would have accomplished only a small portion of the work that Cequence can do as part of its comprehensive, API protection solution.”

Creating Custom Policies for Mitigation

“Our security team works with Cequence’s threat intelligence professionals in to create custom policies for mitigation and blocking bot attacks,” said Scandrett. “That’s another reason we chose Cequence. As far as I know, none of the other API protection vendors provide a 24/7 threat monitoring service. This visibility enables us to fine-tune our security policies based on threats that could potentially harm our operations. Knowing what’s out there and gaining the ability to proactively block malicious traffic is obviously helping us mitigate risk.”

Recommending Cequence to Others

When asked if he would recommend the Cequence solution to his peers, Scandrett replied, “Absolutely. Cequence is a great fit for any organization that doesn’t want to dedicate a lot of extra IT resources to deploying API protection using a mix of third-party tools. Cequence does everything we need in just one comprehensive, integrated tool.”

Final Thoughts

“At Hibbett, IT has been able to transform from being simply a cost center, to a strategic arm of the organization that is contributing to the bottom line,” concluded Morris. “We are now creating efficiencies in the processes that we couldn’t provide without the infrastructure and the systems we have in place. The Cequence Unified API Protection Platform is one of the key technologies that is enabling our IT security team to become a much larger contributor to our company’s success.”

TL;DR: Agentic AI security vendors protect agents that plan, call tools, and act on enterprise systems. Cequence is best for comprehensive agent containment, Zenity for SaaS agent governance, Noma for homegrown agents, Prisma AIRS for platform consolidation.

What Is an Agentic AI Security Solution and How Should You Evaluate One?

Evaluating agentic AI security vendors requires looking past marketing demos to assess core capabilities like data-layer controls, runtime behavior monitoring, and shadow AI discovery. Unlike conventional applications, agents may dynamically choose which APIs to call, access sensitive data, generate code, or modify external systems. This creates security risks that cannot always be addressed with fixed access controls or application security tools.

These vendors typically secure the full agent lifecycle. Their products may discover deployed agents, monitor prompts and tool calls, enforce permissions, detect prompt injection, restrict access to sensitive data, and log agent actions for investigation and compliance. Some also evaluate agents before deployment by testing how they respond to malicious inputs, excessive permissions, compromised tools, and other attack scenarios.

Key evaluation criteria

Use these five dimensions to compare vendors on the same terms:

• Agent and AI discovery: Whether the platform finds every agent, MCP server, tool, and model in the environment, including ones deployed without approval.
• Identity and least-privilege access control: Whether each agent gets its own scoped identity and permissions tied to your identity provider.
• Runtime enforcement at the tool and API layer: Whether the platform inspects and blocks individual tool calls and API calls inline, across a full session.
• Visibility, audit logging, and compliance evidence: Whether the platform attributes every action and retains it in a form auditors and incident responders can use.
• Deployment model and enterprise scale: Whether the platform fits your deployment constraints, throughput, and licensing model without rewriting agents.

Solutions covered in this guide:

Agentic AI Security Platforms

• Cequence Security: Inline agent identity, least-privilege access, tool-call enforcement, and AI discovery.
• Zenity: Agent discovery, posture management, and runtime enforcement across SaaS, cloud, and endpoints.
• Noma Security: Discovery, access control, runtime detection, and red teaming across homegrown, SaaS, and endpoint agents.
• HiddenLayer: Model, AI supply chain, runtime, and agentic security with attack simulation.

Enterprise Security Platforms with Agentic AI Coverage

• Palo Alto Networks Prisma AIRS: AI discovery, agent identity, runtime protection, red teaming, and AI gateway controls.
• Cisco AI Defense: Network-level AI guardrails, MCP security, AI discovery, and supply chain risk management.
• CrowdStrike Falcon Guardian: Endpoint-focused agent discovery, prompt-to-action tracing, runtime detection, and containment.
• Microsoft Entra Agent ID: Managed agent identities, Conditional Access, lifecycle governance, and agent registry capabilities.

In this article:

• Why Organizations Need Dedicated Security for Agentic AI
• How to Choose an Agentic AI Security Vendor
• Common Agentic AI Security Platforms and How They Meet the Criteria
• Notable Agentic AI Security Vendors

Why Organizations Need Dedicated Security for Agentic AI

Autonomous Decision-Making Expands the Attack Surface

Traditional applications generally follow predefined execution paths. AI agents can select actions dynamically based on their instructions, available context, model output, and intermediate results. The same input can therefore lead to different sequences of tool calls and system interactions.

Security teams need visibility into these decision paths rather than only the initial prompt and final response. Controls should detect unexpected actions, enforce boundaries at runtime, and prevent an agent from exceeding its intended role even when its reasoning or planning changes.

Agents Can Access Tools, APIs, and Sensitive Systems

Agents become more consequential when connected to databases, SaaS applications, internal APIs, code repositories, browsers, or infrastructure. An agent with broad credentials may be able to read confidential information, modify records, send messages, execute code, or change system configurations.

Security should apply least-privilege access to each agent and tool. It should also validate tool parameters, control credential use, restrict sensitive operations, and require additional authorization for high-impact actions. Monitoring should connect each action to the agent, user, tool, and data involved.

Prompt Injection Can Influence Multi-Step Workflows

Prompt injection occurs when malicious instructions alter how an AI system behaves. For agents, those instructions may come directly from a user or indirectly from content the agent retrieves, such as a web page, document, email, or tool response.

The risk extends beyond producing an incorrect answer. A successful injection can influence later planning and tool use, potentially causing data disclosure or unauthorized actions. Effective defenses combine input and content inspection with permission boundaries, tool-call validation, data controls, and monitoring throughout the workflow.

How to Choose an Agentic AI Security Vendor

Each criterion below covers a distinct control. Work through them in order, because discovery limits what identity can scope, identity limits what runtime enforcement has to catch, and logging determines what you can prove afterwards.

1. Agent and AI Discovery

Agents enter an enterprise from several directions at once. Engineering teams build them on cloud model platforms, business users assemble them in low-code tools, and employees connect coding assistants to MCP servers without telling security. A platform cannot protect agents it never sees, so discovery sets the ceiling for every other control in the stack. It also determines whether your inventory is a real picture of the estate or only a list of what was registered voluntarily.

Evaluation criteria:

• Does it find agents across cloud, SaaS, endpoint, and homegrown environments?
• Does it inventory MCP servers, tools, skills, and LLM providers, not just agents?
• Does it map each agent's connections, permissions, and data access paths?
• Does it surface shadow AI deployed without security approval?
• Does discovery run continuously rather than as a one-time scan?

2. Identity and Least-Privilege Access Control

An agent operating with a broad service account or an inherited user token can reach far more than its task requires. Many agent incidents involve permissions that were technically valid at every step. Controls here decide what an agent can touch before any detection is needed, so weak scoping pushes the entire burden onto runtime enforcement. Scoping should be per agent and per tool, not per platform.

Evaluation criteria:

• Does each agent get its own identity rather than sharing a human or service account?
• Does it integrate with your existing identity provider, including OAuth 2.0 or 2.1?
• Can permissions be scoped per agent, per tool, and per API?
• Does it manage token issuance, refresh, and revocation?
• Can agent access be time-bound and reviewed like any other account?

3. Runtime Enforcement at the Tool and API Layer

Prompt filtering stops some attacks, but agents cause damage through the actions they take. The meaningful control point is the call an agent makes to a tool, an MCP server, or an API. Enforcement should happen inline in that path and across a full session, because a chain of individually authorized calls can still add up to an outcome nobody approved. Detection alone is not enough if the platform cannot halt the agent.

Evaluation criteria:

• Does it inspect and block individual tool calls, not only prompts and responses?
• Does it evaluate a full session rather than one request at a time?
• Does it cover MCP traffic, direct API calls, and model routing?
• Can it halt an agent mid-execution, revoke access, or terminate a session?
• Does it detect prompt injection arriving from retrieved content, not just user input?

Related content: Read our guide to the top MCP security risks and how to prevent them

4. Visibility, Audit Logging, and Compliance Evidence

After an incident, the question is which agent did what, on whose behalf, with which tool, against which data. The same record carries the compliance load. The EU AI Act obliges deployers to monitor high-risk systems in operation, retain logs for at least six months, and report serious incidents, and auditors expect an inventory alongside them. Logs that stop at the prompt answer neither question.

Evaluation criteria:

• Is every tool call attributable to an agent, a user, and a data set?
• Do logs reconstruct the full action chain, not just fire alerts?
• Are logs retained long enough for your regulatory obligations?
• Does it export to your SIEM and existing investigation workflows?
• Does it produce inventory and policy reports auditors will accept?

5. Deployment Model and Enterprise Scale

Inline enforcement sits in the request path, which turns throughput, latency, and availability into security questions. Deployment effort matters just as much, because a control that requires rewriting agents or standing up new infrastructure tends to arrive long after the agents do. Licensing deserves the same scrutiny, since token and credit models behave differently from per-user pricing as adoption grows.

Evaluation criteria:

• Does it support SaaS, on-premises, or hybrid deployment to match data residency rules?
• Does onboarding require code changes to agents or applications?
• What latency does inline enforcement add, and is there a high-availability path?
• Are there separate pre-production and production modes?
• Is it licensed by tokens, agents, users, or traffic volume?

Common Agentic AI Security Platforms and How They Meet the Criteria

The table below summarizes how each platform measures up against the five criteria. Each one is explored in detail underneath, with a criteria-fit table of its own.

Category Solution How It Meets the Criteria Agentic AI Security Platforms Cequence Security Strongest on identity and inline enforcement at the agent-to-application path, with OAuth 2.1 integration, Agent Personas, and policy applied to every tool call. Discovery, audit trails, and SaaS or on-premises deployment are built in.  Agentic AI Security Platforms Zenity Broad discovery and posture across SaaS, cloud, and endpoint agents, with Runtime Boundaries that allow, block, or terminate an action in real time. Compliance evidence is less developed than detection and enforcement.  Agentic AI Security Platforms Noma Security Covers discovery, access control, red teaming, and runtime detection across three agent environments from one platform. Identity capability layers on the existing IdP rather than issuing agent credentials.  Agentic AI Security Platforms HiddenLayer Deep on model and supply chain security with agentless runtime defense and attack simulation. Little native identity or least-privilege scoping for agents, and deployment is reported as engineering-heavy.  Enterprise Security Platforms with Agentic AI Coverage Palo Alto Networks Prisma AIRS Covers all five criteria in one platform, including shadow AI discovery, agent identity, an AI Gateway, and posture management. Some modules are newer, and credit-based licensing complicates cost forecasting.  Enterprise Security Platforms with Agentic AI Coverage Cisco AI Defense Network-level guardrails and MCP scanning with no agents or libraries to deploy, plus standards alignment for audit. Agent identity sits in separate Cisco products, and coverage depends on Cisco network infrastructure.  Enterprise Security Platforms with Agentic AI Coverage CrowdStrike Falcon Guardian Runtime detection and containment at the point of execution, tying agent actions to endpoint telemetry. Coverage is anchored to managed endpoints, and the AI gateway capability is not yet available.  Enterprise Security Platforms with Agentic AI Coverage Microsoft Entra Agent ID Strongest on agent identity, lifecycle governance, and registry inside the Microsoft estate. Enforcement works at the identity and network layer rather than inspecting individual tool calls.

Notable Agentic AI Security Vendors

How we selected these solutions: We shortlisted agentic AI security platforms based on agent and AI discovery, agent identity and access control, runtime enforcement over tool and API calls, audit logging and compliance evidence, and enterprise deployment options.

Agentic AI Security Platforms

1. Cequence Security

Best for: Connecting agents to enterprise APIs and SaaS applications

Strengths: Agent Personas, trusted MCP registries, inline tool-call policy

Things to consider: Initial policy tuning takes time in large, complex estates

The Cequence AI Gateway sits between AI agents and the applications and data they reach. It authenticates the agent and then verifies every action the agent takes, enforcing policy inline in the request path for the duration of a session rather than at a single checkpoint.

The gateway treats an agent as a privileged insider rather than a tool. Access is bound to a written job description, and behavior is judged in context rather than on authentication alone. The product also converts existing internal, external, and SaaS APIs into MCP-compatible tools without code, which is how agents reach a catalog of more than 200 enterprise applications such as Salesforce, Jira, Slack, and Confluence.

Key features include:

• Agentic zero trust architecture: The gateway authenticates each agent and then verifies every subsequent action, applying policy inline in the request path across the full session and on each tool call.
• Agent Personas: An agent's job description, written in plain English, generates a persona carrying only the tools, APIs, skills, and permissions that job needs, with boundaries and guardrails applied automatically from that scope.
• Trusted registries and guardrails: The platform maintains registries of vetted MCP servers, APIs, LLMs, and skills. Prompt Guard screens prompts for injection, jailbreak, and system-prompt-extraction patterns, and organizations can add custom rules.
• End-to-end authentication and authorization: Integration with OAuth 2.1-compliant identity infrastructure applies organizational identity policies to agents, with built-in token lifecycle management and session binding that locks authenticated sessions to originating IP addresses.
• Monitoring and audit logging: Real-time visibility into AI-to-tool traffic records which applications agents access and which API calls they make, with tool-level and agent-level audit trails and SIEM integration.
• Sensitive data protection: DLP scanning is applied to agent requests and MCP server responses, with monitoring, redaction, and blocking across more than 100 out-of-the-box detection types, plus coverage across a sequence of calls rather than a single hook.
• AI Discovery and spend controls: The platform surfaces shadow MCP servers, agents, and LLM providers enterprise-wide from existing SIEM logs, and enforces token limits per minute, day, and month alongside monetary spend caps per team.

Criterion Solution Fit Key Considerations Agent and AI discovery AI Discovery surfaces sanctioned and shadow agents, MCP servers, and LLM providers enterprise-wide from existing SIEM logs, alongside API discovery and inventory. Discovery draws on SIEM log sources, so coverage tracks what those logs already capture.  Identity and least-privilege access control OAuth 2.1 IdP integration with token lifecycle management and RBAC. Agent Personas generate least-privilege scopes from a written job description. Personas need an accurate job description up front to scope an agent correctly.  Runtime enforcement at the tool and API layer Policy is enforced inline in the request path, for the full session, on every tool call. Prompt Guard, automated tool risk scoring, rate limits, and spend limits apply at the same point. Reviewers note that tuning detection and policy configuration takes time in large environments.  Visibility, audit logging, and compliance evidence Logs every user, agent, and tool action, with tool-level and agent-level audit trails that export to your SIEM. Cequence shares supporting documentation under NDA to help customers meet EU AI Act obligations. Confirm log retention periods and SIEM export formats match your regulatory obligations.  Deployment model and enterprise scale SaaS-based and on-premises deployment, horizontal scaling, no-code MCP enablement in minutes, continuous environment monitoring, and separate pre-prod and prod modes. Inline enforcement adds a single hop to the request path, so validate latency at peak agent traffic.

2. Zenity

Best for: Governing agents across SaaS platforms, cloud, and endpoints

Strengths: Runtime Boundaries, intent-aware AIDR, exposure validation

Things to consider: No documented sandboxed execution environment for agents

Zenity builds its platform around the moment an agent makes a decision, rather than around the prompt or the response. The architecture has three layers that operate as one system: Surface, Enforce, and Protect.

Surface builds a live inventory of agents, evaluates how each is configured, and tests which attack paths are actually exploitable. Enforce acts at the point a decision is made, allowing a safe action through or stopping an unsafe one. Protect watches what happens afterwards, reconstructing execution paths and turning each investigation into a sharper rule.

Coverage spans three agent types: agents embedded in SaaS products such as Salesforce Agentforce and Copilot Studio, homegrown agents on AWS Bedrock and Google Vertex AI, and personal or coding agents running locally.

Key features include:

• AI Observability: Builds a live inventory of agents across SaaS, custom, and endpoint deployments, and tracks the data each agent touches.
• AI Security Posture Management: Evaluates agent configuration and permissions against policy before an agent goes live, catching misconfigurations pre-deployment.
• AI Exposure Management: Validates which of an agent's attack paths are genuinely exploitable, scores each one, and produces a fix that can be applied directly in Runtime Boundaries.
• Runtime Boundaries: Evaluate every action an agent takes in real time and determine whether it proceeds, is blocked, or the agent is terminated, including for long-horizon agents running multi-step tasks over hours or days.
• Agentic Identity: Correlates enforcement with the credentials an agent actually holds, so a deactivated or over-scoped role is caught before it can be exploited.
• AI Detection and Response: Monitors execution step by step, reads a sequence of tool calls and retrievals together rather than in isolation, and maps findings to OWASP and MITRE ATLAS.
• MCP Security and DFIR: Covers MCP connections as a distinct control surface, while AI-powered forensics reconstruct the full decision chain when something gets through.

Criterion Solution Fit Key Considerations Agent and AI discovery AI Observability maintains a live inventory across SaaS, cloud, custom, and endpoint deployments, including shadow agents built on low-code platforms. Published peer review volume is limited, so coverage is best validated against your own estate in a trial.  Identity and least-privilege access control Agentic Identity correlates enforcement with each agent's actual credentials and flags deactivated or over-scoped roles. Works alongside an existing identity provider rather than issuing agent credentials itself.  Runtime enforcement at the tool and API layer Runtime Boundaries evaluate every action inline and allow, block, or shut down the agent. AIDR reads full execution chains rather than single events. No sandboxed execution environment for agents is publicly documented.  Visibility, audit logging, and compliance evidence Digital forensics reconstruct the full decision chain after an incident, and Guardian Agents convert investigations into policy. Compliance evidence automation is less developed than the detection and enforcement layers.  Deployment model and enterprise scale SaaS delivery covering SaaS agent platforms, cloud and homegrown agents, and local agents via lightweight monitoring. Available through cloud marketplaces. Coverage is broadest in Microsoft and SaaS-heavy estates; confirm depth for custom stacks.

3. Noma Security

Best for: Homegrown, SaaS, and endpoint agents from one platform

Strengths: AI-SPM, access control, red teaming, and runtime detection

Things to consider: Little independent review coverage to validate claims

Noma divides the enterprise AI estate into three environments and covers each with the same set of controls. Endpoint agents are the coding assistants and personal agents employees run on their own machines, connected to MCP servers that reach production code and internal APIs. Homegrown AI covers applications engineering teams build on AWS Bedrock, Azure AI Foundry, Databricks, LangChain, and CrewAI. SaaS agent platforms cover agents that business teams assemble in Copilot Studio, Agentforce, and ServiceNow.

Four products share intelligence across those environments. Discovery context makes access policies more precise, and a vulnerability found during red teaming becomes an enforced pattern in production.

Key features include:

• AI-SPM: Discovers every agent, MCP server, skill, and model across the three environments, then surfaces misconfigurations and combinations of agent capabilities that are risky together.
• Agent risk map: Shows each agent's blast radius, covering its connections, permissions, and data access paths, so cascading risk scenarios are visible before deployment.
• Access control: Policies govern which MCP servers, skills, and tools an agent may use, keyed to IdP groups or applied organization-wide by tool sensitivity, with a live registry of what is approved and blocking for everything else.
• AI-DR: Detects prompt injection, data exfiltration, scope violations, and agents drifting from their intent, evaluating each action against the session around it, the identity behind the agent, and behavior over time.
• Graduated response: Based on policy, runtime detection alerts, blocks, masks data, or routes an action to a human rather than applying a single response to every finding.
• AI red teaming: Compounds attack techniques into multi-turn campaigns that escalate at each turn, with prebuilt scan profiles and compliance presets, and findings feed directly into AI-DR runtime policies.
• Compliance and supply chain coverage: Produces inventory, framework mappings, test results, and audit trails, and scans models, MCP servers, tools, and packages across the AI supply chain.

Criterion Solution Fit Key Considerations Agent and AI discovery AI-SPM discovers every agent, MCP server, skill, and model across endpoint, SaaS, and homegrown environments, with an agent risk map of connections and data access. Discovery routinely surfaces far more assets than teams expect, which requires triage capacity at rollout.  Identity and least-privilege access control Access control policies are keyed to IdP groups or applied by tool sensitivity, and agentic identity use cases tie actions to the identity behind the agent. Layers on the existing identity provider rather than issuing scoped agent credentials itself.  Runtime enforcement at the tool and API layer Access control blocks unapproved MCP servers, skills, and tools. AI-DR evaluates each action in session context and can alert, block, mask data, or escalate. Enforcement depth varies by environment, so test in the one where your agents actually run.  Visibility, audit logging, and compliance evidence Compliance and reporting cover inventory, framework mappings, red team results, and audit trails from a single control plane. Independent review coverage is sparse, so reference calls carry more weight than published ratings.  Deployment model and enterprise scale One platform spanning three environments, with SaaS or self-hosted options and policies applied organization-wide or per group. Breadth across three environments can mean less depth than a specialist in any single one.

4. HiddenLayer

Best for: Model-level and AI supply chain security across the lifecycle

Strengths: Agentless runtime defense, attack simulation, model scanning

Things to consider: Deployment reported to need ML and infrastructure engineers

The HiddenLayer AISec Platform covers four modules across the AI lifecycle: AI Discovery, AI Supply Chain Security, AI Runtime Security, and AI Attack Simulation. Its origin is model security, and the platform still works closest to the model, validating integrity before deployment and detecting attacks against models in production.

Agentic coverage sits on top of that foundation. Agentic and MCP security protects autonomous agents from prompt injection, unsafe tool use, and harmful autonomous actions, and Agent Harness Security adds runtime visibility and inline enforcement for AI coding agents.

The platform is model-agnostic and agentless, and it operates without access to model weights, prompts, training data, or customer data. Native connectors cover cloud platforms, CI/CD, data platforms, SIEM and SOAR, API gateways, and MLOps tooling.

Key features include:

• AI Discovery: Builds a living inventory of AI across the environment, including shadow AI, showing where models are used, by whom, and with what level of access.
• AI Supply Chain Security: Scans models for malware, vulnerabilities, backdoors, and unknown components before they reach production, validating integrity and supply chain provenance.
• AI Runtime Security: Detects and responds to attacks in production without requiring access to intellectual property, weights, prompts, or customer data.
• AI Attack Simulation: Runs adversarial simulations continuously against AI systems rather than as a periodic exercise, uncovering weaknesses as the systems change.
• AI Guardrails: Enforce policies that prevent prompt injection, data leakage, and unsafe AI behavior in real time across applications, models, and business units.
• Agentic and MCP security: Protects autonomous and tool-using systems from misuse, privilege escalation, and cross-system exploitation, with Agent Harness Security covering AI coding agents specifically.
• Governance and posture: Provides organization-wide visibility into every model, applies consistent governance rules, classifies risk, and monitors posture against security and regulatory standards.

Criterion Solution Fit Key Considerations Agent and AI discovery AI Discovery builds a living inventory of AI assets across environments, including shadow AI, with visibility into how and where models are used. Inventory centers on models and AI assets more than the agent-to-application call path.  Identity and least-privilege access control Runtime controls prevent unauthorized tool usage, but agent identity issuance and permission scoping are not part of the platform. Requires a separate identity layer for agent credentials and least-privilege scoping.  Runtime enforcement at the tool and API layer AI Runtime Security detects and responds in production. Agentic and MCP security covers prompt injection, unsafe tool use, and harmful autonomous actions, with inline enforcement for coding agents. Reviewers report the integration is hard to deploy and demanding to maintain.  Visibility, audit logging, and compliance evidence Governance and posture features give organization-wide visibility, risk classification, and policy monitoring, with native SIEM and SOAR connectors. Peer review volume is low, so compliance reporting is best validated during a trial.  Deployment model and enterprise scale Model-agnostic and agentless, deployable across any architecture without exposing weights, prompts, or customer data. SaaS, on-premises, air-gapped, and hybrid are supported. Reviewers describe deployment as requiring a sizeable ML and infrastructure engineering effort.

Source: HiddenLayer

Enterprise Security Platforms with Agentic AI Coverage

5. Palo Alto Networks Prisma AIRS

Best for: Consolidating AI security inside a Palo Alto Networks estate

Strengths: Discovery, posture, red teaming, runtime, and AI Gateway

Things to consider: Some modules are early stage; credit-based licensing

Prisma AIRS organizes AI security into three stages: discover shadow AI, assess new risks, and protect against threats at runtime. The platform covers AI agents, applications, models, and data from development through deployment, and its modules can be adopted individually or together.

Agent coverage runs through two components. Agent Security verifies each agent identity and enforces real-time controls to stop unauthorized actions as deployments move from pilot to production. The AI Gateway acts as a control plane for enterprise AI activity, governing and securing how applications and agents reach models and services.

Deployment modes include Network Intercept and API Intercept, and a managed AI Runtime Security option removes the setup work for containers, applications, and cloud infrastructure.

Key features include:

• Agent Security: Verifies every agent identity and enforces real-time controls over agent actions, with defenses against prompt injection, tool misuse, and memory manipulation.
• AI Gateway: Serves as the enterprise AI control plane, discovering, governing, and securing AI activity across applications, agents, models, and services.
• AI Runtime Security: Monitors AI behavior during live interactions and enforces safeguards against manipulation, data exposure, and unsafe actions, with a managed option available.
• AI Red Teaming: Simulates real-world attacks continuously against AI agents and applications, including multi-turn attacks, multi-agent systems, and agentic target profiling.
• AI Model Security: Scans third-party models for tampering, malicious scripts, and deserialization attacks before they are adopted.
• AI Posture Management: Covers the data used for training and inference, the integrity of agents and applications, and access to deployed models.
• Discovery and reporting: Provides visibility into every AI agent, app, and model and how they connect, including endpoint and browser-based agents, plus API violation views and threat snippets in reporting.

Criterion Solution Fit Key Considerations Agent and AI discovery Discovers shadow AI and inventories every AI agent, app, and model, mapping how they connect across cloud, SaaS, endpoint, and browser environments. Deepest value comes when other Palo Alto Networks products are already in place.  Identity and least-privilege access control Agent Security verifies each agent identity and enforces real-time controls to stop unauthorized actions at production scale. Agent identity governance is newer than the model and runtime modules.  Runtime enforcement at the tool and API layer AI Runtime Security enforces safeguards during live interactions, and the AI Gateway governs agent access to models and services. Network Intercept and API Intercept are both supported. Reviewers describe some features as early stage, with a learning curve to use them well.  Visibility, audit logging, and compliance evidence AI Posture Management covers data, agent and app integrity, and model access, with API violation views and threat snippets in reporting. Reviewers report alerts and reports need extra tuning to fit a specific environment.  Deployment model and enterprise scale Managed AI Runtime Security reduces deployment friction, and the platform secures containers, multicloud environments, and high-throughput systems. Credit and token-based licensing makes cost forecasting harder at variable volumes.

Source: Palo Alto Networks

6. Cisco AI Defense

Best for: Network-level AI enforcement in Cisco-run environments

Strengths: Agentless guardrails, MCP scanning, Talos threat intelligence

Things to consider: Documentation reported as hard to navigate

Cisco AI Defense covers two paths: organizations using third-party AI applications, and organizations developing their own AI applications and agents. Both run through the same discover, detect, and protect sequence.

The distinguishing choice is where enforcement lives. Cisco applies AI security at the network level, without agents or libraries in the application, which separates AI development from the security controls around it. That same network position provides visibility into AI traffic across distributed environments.

Agentic coverage extends to the Model Context Protocol. The platform scans MCP servers for compromised or malicious assets, enforces runtime protections across MCP requests and responses, and detects agent-specific threats including memory poisoning, tool misuse, privilege escalation, intent hijacking, and deceptive agent behavior.

Key features include:

• AI Runtime Protection: Embeds guardrails in the network to block adversarial attacks and harmful responses in real time, covering prompt injection, model denial of service, code detection, and off-topic attacks.
• AI Model and Application Validation: Uses algorithmic red teaming to identify safety and security vulnerabilities across models at scale, with results returned in seconds.
• AI Cloud Visibility: Inventories AI models and connected data sources across distributed environments to show usage and gauge risk.
• AI Access: Surfaces third-party AI applications in use across the organization and enforces policies that manage employee access and limit sensitive data exposure.
• AI Supply Chain Risk Management: Identifies malicious code, poisoned data, unsafe tools, compromised components, and high-risk MCP assets using Cisco threat intelligence and proprietary scanning.
• Standards alignment: A single integration maps to NIST, MITRE ATLAS, and the OWASP LLM Top 10, with a published AI safety and security taxonomy.
• Threat intelligence and Explorer Edition: Detections are informed by Cisco's AI research lab and Talos, and a self-service Explorer Edition provides red teaming for agentic workflows and model testing.

Criterion Solution Fit Key Considerations Agent and AI discovery AI Cloud Visibility inventories AI workloads, applications, models, data, and users across distributed cloud environments. AI Access surfaces third-party AI applications in use. Discovery relies on network-level visibility, so activity outside Cisco's path is harder to see.  Identity and least-privilege access control AI Access monitors and manages access to third-party AI applications and enforces policies on that access. Agent identity itself is handled by Duo and Cisco Identity Intelligence rather than by AI Defense.  Runtime enforcement at the tool and API layer Guardrails embedded in the network block adversarial attacks in real time. MCP requests and responses are protected, and agent threats such as memory poisoning, tool misuse, and privilege escalation are detected. Reviewers report the features are powerful but hard to understand how to use correctly.  Visibility, audit logging, and compliance evidence A single management plane covers all AI, with Cisco Security Cloud integration and alignment to NIST, MITRE ATLAS, and the OWASP LLM Top 10. Reviewers describe documentation as difficult to navigate.  Deployment model and enterprise scale Enforcement runs at the network level with no agents or libraries to install, integrating with Cisco Security Cloud and Splunk data. Value depends on already running Cisco network and security infrastructure.

Source: Cisco

7. CrowdStrike Falcon Guardian

Best for: Securing endpoint and computer-use agents at execution

Strengths: Shadow AI discovery tied to existing Falcon endpoint telemetry

Things to consider: AI gateway capability announced but not yet available

Falcon Guardian applies AI detection and response at the point where agents execute. The argument behind it is that computer-use agents reach identities, data, files, browsers, shells, and system settings while acting with user permissions, so behavior at the endpoint is indistinguishable from legitimate user activity unless the AI context is attached to it.

The product connects agent activity to endpoint telemetry, tracing how a user prompt leads to downstream processes and system actions. It runs on the same Falcon sensor that CrowdStrike already deploys for endpoint protection, so no separate agent is required where Falcon is in place.

Coverage extends beyond endpoints to cloud and SaaS environments, and includes both workforce use of AI tools and homegrown agents and workloads.

Key features include:

• Shadow AI discovery: Identifies workforce AI use and endpoint agents, showing what is in use, who is using it, token consumption, and where unmanaged risk exists.
• Prompt-to-action tracing: Connects agent activity with endpoint telemetry to establish how a prompt led to specific processes and system actions.
• AI usage and access governance: Turns governance policy into enforceable controls over how users interact with AI tools and which AI agents are permitted to run.
• Prompt injection detection: Inspects AI interactions at runtime for direct and indirect prompt injection spanning more than 200 techniques, blocking malicious interactions before they manipulate an agent.
• Sensitive data controls: Identifies sensitive data in AI interactions and applies runtime controls to redact, encrypt, or block it before exposure.
• Runtime containment: Detects compromised agents, reconstructs what happened, determines blast radius across affected agents and systems, and deploys containment actions.
• SIEM integration: AI telemetry is brought together with endpoint, identity, cloud, SaaS, and third-party data in Falcon Next-Gen SIEM for unified detection and investigation.

Criterion Solution Fit Key Considerations Agent and AI discovery Discovers shadow AI agents on endpoints and across cloud and SaaS, showing what is running, who uses it, and token consumption. Coverage is anchored to managed endpoints, so unmanaged hosts fall outside scope.  Identity and least-privilege access control Governs how users interact with AI tools and defines which AI agents are permitted to run. Governs permission to run rather than issuing scoped identities and per-tool permissions.  Runtime enforcement at the tool and API layer Inspects AI interactions for direct and indirect prompt injection across more than 200 techniques, and deploys containment actions at the point of execution. Published detection and latency figures come from internal benchmarks, so test with your own traffic.  Visibility, audit logging, and compliance evidence Traces prompts to downstream processes and system actions, reconstructs incidents, and determines blast radius, with native ingestion into Falcon Next-Gen SIEM. Investigation workflows assume Falcon is already the telemetry backbone.  Deployment model and enterprise scale Runs on the existing Falcon sensor, so no separate agent is needed where Falcon is already deployed. The AI gateway capability is announced but not yet available.

Source: CrowdStrike

8. Microsoft Entra Agent ID

Best for: Giving agents managed identities inside the Microsoft estate

Strengths: Conditional Access, lifecycle governance, agent registry

Things to consider: Capabilities gated behind specific licensing tiers

Microsoft Entra Agent ID extends existing identity and access management to AI agents, treating each agent as a first-class identity that can be authenticated, governed, and protected in the same way as an employee account.

The controls are the ones Microsoft-centric security teams already run. Conditional Access evaluates each access attempt, identity governance automates the lifecycle from deployment to expiry, identity protection flags suspicious activity, and network controls log and restrict what agents can reach.

Agent ID capabilities are delivered through Microsoft Agent 365, the control plane for agents. Agent 365 maintains a unified registry covering agents from Microsoft AI platforms, partner agents registered through its SDK, and self-registered agents from platforms it does not manage.

Key features include:

• Agent identities at scale: Every agent receives a built-in identity that enables authentication, policy enforcement, and integration with existing organizational policies.
• Conditional Access for agents: Real-time policies evaluate agent access to resources, block risky agents, and apply granular access controls based on configured security attributes.
• Identity governance: Automates governance from deployment to expiration, assigns and maintains sponsors, and enforces access assignments that are intentional, auditable, and time-bound.
• Identity protection: Detects and flags unusual or unauthorized agent activity, traces agents with compromised tokens, and supports remediation of compromised agents.
• Network controls: Log agent network activity for audits and threat detection, apply web categorization to APIs and MCP servers, restrict file uploads and downloads, and automatically block malicious destinations.
• Unified agent registry: Agent 365 maintains an inventory of the agent fleet with usage insights and visual mapping of agent activity and connections.
• Integrated security stack: Access control and identity protection come from Entra, security posture and threat protection from Defender, and data security and compliance from Purview.

Criterion Solution Fit Key Considerations Agent and AI discovery Agent 365 provides a unified registry covering Microsoft AI platform agents, partner agents via SDK, and self-registered agents, with usage insights and activity mapping. Agents created before Entra agent registration existed cannot be assigned an Agent ID retroactively.  Identity and least-privilege access control Each agent gets a first-class identity with Conditional Access, lifecycle governance, assigned sponsors, and time-bound access assignments. Several controls require specific Microsoft 365 licensing tiers before they take effect.  Runtime enforcement at the tool and API layer Identity Protection flags unusual agent activity and compromised tokens. Network controls apply web categorization to APIs and MCP servers and block malicious destinations. Enforcement sits at the identity and network layer rather than inspecting individual tool calls.  Visibility, audit logging, and compliance evidence Logs agent network activity for audits and threat detection, with Purview covering data security and compliance for agents. Evidence gathering is strongest for agents inside the Microsoft estate.  Deployment model and enterprise scale Foundational capabilities come with Microsoft Cloud subscriptions; premium capabilities require an Agent 365 license or Microsoft 365 E7. Third-party agents that do not integrate the Agent 365 SDK remain unmanaged.

Source: Microsoft

Conclusion

Agentic AI security requires controls that follow agents from discovery and identity through runtime execution and audit. Organizations should evaluate whether a platform can find shadow agents and connected tools, assign or enforce least-privilege access, inspect consequential actions at runtime, and reconstruct activity for investigations and compliance. Deployment architecture also matters because inline controls must provide adequate performance and coverage without creating excessive integration work as agent adoption grows.

TL;DR: Agentic AI security tools control what AI agents do at runtime, which tools they call, and what data they reach. Cequence AI Gateway is best for governing agent access to apps and APIs, Zenity for multi-platform agent governance, Prisma AIRS for Palo Alto environments, and Lakera for real-time prompt and data guardrails.

What Are Agentic AI Security Tools?

Securing autonomous AI agents requires inline agentic AI security controls and runtime monitoring to manage permissions, block goal hijacking, and prevent data leaks. Traditional security assumes human users, but AI agents move at machine speed and use valid credentials.

Unlike traditional LLM applications that mainly generate content, agents can interact with APIs, databases, browsers, code execution environments, and other systems. This creates security risks beyond prompt and model behavior. Protecting them requires a focus on two main areas:

Runtime behavior and tool use:

• Detect unexpected or malicious agent behavior by monitoring execution traces for suspicious actions and policy violations.
• Restrict which tools agents can use based on identity, role, task, environment, and authorization context.
• Validate tool calls before execution to block unauthorized operations, suspicious arguments, and high-risk requests.
• Control tool parameters and allowed actions by limiting functions, resources, parameter values, destinations, and data scopes.
• Monitor MCP servers and external integrations for excessive permissions, unexpected tool changes, sensitive data exposure, and suspicious activity.

Data access:

• Apply least-privilege data access by limiting permissions according to the resource, operation, session, or task.
• Enforce agent identity and authorization so access reflects both the agent's permissions and those of the user it represents.
• Restrict access to sensitive data sources such as customer records, credentials, financial information, and production data.
• Detect sensitive data in prompts and responses and redact, mask, block, or restrict it when required.
• Prevent unauthorized data exfiltration by inspecting outbound tool calls, network requests, messages, uploads, and generated responses.

In this article:

• Agentic AI Security Tools at a Glance
• How Agentic AI Security Tools Secure Runtime Behavior, Tool Use, and Data Access
• Notable Agentic AI Security Tools for Runtime Behavior, Tool Use, and Data Access

Agentic AI Security Tools at a Glance

The table below summarizes the key differences between the agentic AI security tools covered in this guide. We explore each tool in more detail in the sections that follow.

Category Solution Best For Key Strengths Things to Consider Agent Runtime Governance and Access Control Cequence AI Gateway Governing agent access to enterprise apps, APIs, and MCP tools Agent Personas, inline tool-call enforcement, DLP on MCP traffic Initial setup and policy tuning can take time  Agent Runtime Governance and Access Control Zenity Securing agents across SaaS, cloud, and endpoint environments Intent-based detection across full agent execution paths Enforcement depth varies by platform; no public pricing  Agent Runtime Governance and Access Control Noma Security Discovery, access control, and runtime detection for AI agents Session-level behavioral context, IdP-keyed tool policies Integration into complex AI environments; pricing on request  Agent Runtime Governance and Access Control Prisma AIRS Agent Security Palo Alto Networks customers securing agents across the lifecycle Central control of tool calls, LLM traffic, and MCP connections Some features feel early-stage; tied to Palo Alto ecosystem  Runtime Guardrails and AI Threat Detection Lakera AI Agent Security Real-time guardrails on agent inputs, outputs, and actions Prompt attack detection in 100+ languages, sub-50 ms latency Multimodal inspection limited to text in some integrations  Runtime Guardrails and AI Threat Detection Prompt Security (SentinelOne) Governing workforce AI use, agents, and MCP servers together Shadow MCP discovery, least-privilege agent scope, audit log Full coverage may need extension, agent, and proxy setup  Runtime Guardrails and AI Threat Detection Lasso Intent-based runtime protection with discovery and red teaming Inline enforcement at proxy, API, or gateway; 3,000+ attacks Requires CI/CD and platform integration; few user reviews  Runtime Guardrails and AI Threat Detection HiddenLayer AI Runtime Security Runtime detection and enforcement for agents and MCP traffic Tool-use inspection and session reconstruction Needs SDK, proxy, or gateway instrumentation

How Agentic AI Security Tools Secure Runtime Behavior, Tool Use, and Data Access

Securing Agent Runtime Behavior and Tool Use

Agentic AI security tools apply controls while an agent is running, rather than relying only on safeguards built into the model or application. They observe agent decisions, tool calls, inputs, outputs, and interactions with external systems. This makes it possible to detect and block unsafe actions before they execute.

1. Detect Unexpected or Malicious Agent Behavior

Security tools can monitor an agent's execution trace for behavior that violates expected patterns or defined policies. Examples include:

• Repeated access attempts
• Unusual tool sequences
• Attempts to retrieve unrelated sensitive data
• Actions triggered by prompt injection

Runtime monitoring can combine fixed policies with behavioral detection. When suspicious activity occurs, the security layer can block an action, terminate the agent session, require human approval, or generate an alert for investigation.

2. Restrict Which Tools Agents Can Use

Agents should only have access to tools required for their assigned tasks. Security controls can enforce allowlists or deny lists based on the agent's:

• Identity
• Role
• Task
• Environment
• Current authorization context

These restrictions reduce the impact of compromised or incorrectly behaving agents. For example, a research agent might be permitted to search internal documentation but prevented from executing shell commands, modifying production databases, or sending external messages.

Related content: Read our guide to agentic AI governance

3. Validate Tool Calls Before Execution

Security tools can intercept tool calls before they reach the target system. The security layer can check whether the requested tool, operation, and context comply with policy before allowing execution.

Validation can also detect malformed requests, suspicious arguments, or calls produced after an untrusted instruction enters the agent's context. High-risk operations can be rejected or routed to a human for approval instead of executing automatically.

4. Control Tool Parameters and Allowed Actions

Allowing access to a tool does not mean an agent should be allowed to perform every operation that tool supports. Controls can restrict:

• Individual functions
• Resources
• Parameter values
• Destinations
• Data scopes

For example, an agent might receive read access to a database while write and delete operations remain blocked. A messaging tool could allow communication only with approved domains, while a file tool could limit access to directories. Parameter-level controls provide finer-grained protection than tool-level permissions alone.

5. Monitor MCP Servers and External Integrations

Model Context Protocol (MCP) servers can expose data sources and tools to agents through a common interface. Security tools can inspect MCP connections, tool definitions, requests, responses, and authorization decisions to identify risky or unauthorized activity.

Monitoring is also important when MCP servers or other integrations are operated by third parties. Controls can detect unexpected tool changes, excessive permissions, sensitive data exposure, and suspicious responses. Organizations can then enforce policies at the integration boundary instead of trusting every connected server or service implicitly.

Securing Agent Data Access

Agentic AI security tools control which data an agent can retrieve, process, and disclose. These controls are especially important because agents may combine information from databases, files, SaaS applications, APIs, and other sources while completing a task.

6. Apply Least-Privilege Data Access

Agents should receive only the data permissions required for their current tasks. Instead of giving an agent broad, persistent permissions, security tools can limit access by:

• Resource
• Operation
• Session
• Task

For example, an agent that summarizes support tickets may need read access to selected ticket fields but not billing records or account credentials. Narrow permissions reduce the amount of data exposed if the agent is manipulated or behaves unexpectedly.

7. Enforce Agent Identity and Authorization

Security controls can assign each agent or agent session a distinct identity and evaluate authorization before granting access to protected resources. This avoids relying on shared credentials that make it difficult to determine which agent performed an action.

Authorization can also include the identity and permissions of the user the agent represents. An agent should not gain access to information simply because its service account has broader privileges than the requesting user.

8. Restrict Access to Sensitive Data Sources

Organizations can define policies that prevent agents from accessing specified:

• Databases
• Files
• Applications
• Data classifications

Access may also depend on the agent's role, environment, task, or approval status. These controls create boundaries around high-risk sources such as customer records, credentials, financial information, and production data. Sensitive sources can be blocked entirely or exposed through interfaces that return only approved fields.

9. Detect Sensitive Data in Prompts and Responses

Security tools can inspect prompts, retrieved context, tool outputs, and model responses for sensitive information. Detection can cover:

• Credentials
• API keys
• Personally identifiable information
• Financial records
• Source code
• Organization-specific data classifications

When sensitive content is detected, policies can redact or mask values, block the request, restrict the response, or require additional authorization. Applying these checks throughout the agent workflow helps prevent sensitive information from moving between systems unnoticed.

10. Prevent Unauthorized Data Exfiltration

Agents may have legitimate access to sensitive data and external communication tools at the same time. An attacker can exploit this combination by using prompt injection or other techniques to make the agent send protected information to an unauthorized destination.

Security tools can inspect outbound tool calls, network requests, messages, uploads, and generated responses before data leaves a trusted boundary. Policies can block unapproved domains, destinations, or data types and require human approval for high-risk transfers.

Notable Agentic AI Security Tools for Runtime Behavior, Tool Use, and Data Access

How we selected these tools: We shortlisted agentic AI security tools based on their ability to monitor agent runtime behavior, validate and restrict tool calls, secure MCP connections, enforce agent identity and least-privilege access, and detect or block sensitive data exposure.

Agent Runtime Governance and Access Control Platforms

1. Cequence AI Gateway

Best for: Governing agent access to enterprise apps, APIs, and MCP tools

Strengths: Agent Personas, inline tool-call enforcement, DLP on MCP traffic

Things to consider: Initial setup and policy tuning can take time

Cequence AI Gateway sits between AI agents and enterprise applications, translating agent requests into native API calls while applying security and governance controls. The gateway authenticates each agent and then verifies every action it takes, enforcing policy inline in the request path, for the full session, on every tool call.

The gateway maintains trusted registries of MCP servers, APIs, LLMs, and skills that agents are allowed to reach. Teams can turn existing APIs into MCP-compatible tools by uploading OpenAPI specifications. It runs as a SaaS service or on-premises, and connects to Cequence API Security and Bot Management for enhanced API specs and protection against agent-driven abuse.

Key features include:

• Agent Personas: Teams describe an agent's job in plain English, and the gateway generates a persona that limits the agent to the tools, APIs, skills, and permissions that job requires. Least-privilege access policies are generated from these job descriptions.
• Inline tool-call enforcement: Proxies both MCP tool calls and direct API calls through one control point. Behavioral identity judges each action by who the agent is and what it is doing, with rogue agent containment, anomaly detection, and kill-switch controls.
• Authentication and authorization: Integrates with OAuth 2.1-compliant identity providers and includes token lifecycle management and RBAC. Session binding locks authenticated sessions to the originating IP address to block token theft and reuse.
• Sensitive data protection: Applies DLP scanning to agent requests and MCP server responses, with more than 100 built-in detection types for monitoring, redacting, or blocking sensitive data. Detection covers data moving across a sequence of tool calls and integrates with existing DLP infrastructure.
• Prompt Guard and runtime guardrails: Screens prompts for injection, jailbreak, and system-prompt-extraction patterns before they reach the model, with support for custom rules. Additional guardrails include automated tool risk scoring, rate limiting, and token and spend limits by team.
• AI discovery: Surfaces shadow MCP servers, agents, and LLM providers across the enterprise using existing SIEM logs.
• Monitoring and audit trails: Logs user, agent, and tool behavior, including which applications agents access and which API calls they make. Tool-level and agent-level audit trails capture agent identity, data accessed, user context, and request and response flows, exportable to SIEM.

Limitations (as reported by users on G2):

• Requires traffic to flow through it for governance: Organizations need to set up and maintain traffic flows through the AI Gateway for it to govern the agentic AI traffic.
• Prompt injection protection capabilities face arms race: As these types of attacks evolve, the Prompt Guard feature will have to evolve as well for protection.
• Learning curve for advanced configuration: Full use of all the features may take time as the platform covers a lot of ground in security and governance.

2. Zenity

Best for: Securing agents across SaaS, cloud, and endpoint environments

Strengths: Intent-based detection across full agent execution paths

Things to consider: Enforcement depth varies by platform; no public pricing

Zenity is an AI agent security and governance platform covering agents embedded in SaaS tools, homegrown agents in cloud environments, and personal and coding agents on end-user devices. The platform has three layers: Surface builds an inventory and evaluates exposure, Enforce acts when an agent makes a decision, and Protect detects, investigates, and responds to threats.

Supported platforms include Microsoft Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, Salesforce Agentforce, ServiceNow, Amazon Bedrock, Google Vertex AI, ChatGPT Enterprise, and Claude Enterprise. Threat detections are mapped to OWASP and MITRE ATLAS.

Key features include:

• AI observability: Builds a live inventory of agents across SaaS, custom, and endpoint deployments. It tracks agent ownership, what each agent can access, and the data it touches.
• AI security posture management: Evaluates agent configurations and permissions against policy before agents go live, so over-permissioned agents are flagged before runtime.
• AI exposure management: Validates which of an agent's attack paths are exploitable, scores each one, and generates a fix that can be applied through Runtime Boundaries.
• Intent-based detection and response: Examines the full execution path, including tool calls, memory access, data usage, and control flow. This identifies malicious or unintended outcomes even when the inputs look harmless.
• Runtime enforcement: The Enforce layer lets safe actions through and stops harmful actions before they complete. Capabilities include Boundaries, Agentic Identity, and MCP Security.
• Contextual incident response: Correlates configuration, permissions, and runtime behavior into intent-driven signals, and gives investigators context on agent execution paths.

Limitations (based on publicly available sources):

• Enforcement varies by platform: Public analyses note that the depth of runtime enforcement differs across the agent platforms Zenity supports.
• Framework coverage not fully listed: Public product pages do not name some open source agent frameworks, such as LangChain, CrewAI, and AutoGen.
• Deployment options: Public materials present Zenity as a hosted SaaS platform and do not document a self-hosted or air-gapped edition.
• Pricing not published: Standard pricing is not available on public pages.
• Agent-focused scope: The platform does not cover general data loss prevention for human activity unrelated to agents, such as ordinary email or browser uploads.

3. Noma Security

Best for: Discovery, access control, and runtime detection for AI agents

Strengths: Session-level behavioral context and IdP-keyed tool policies

Things to consider: Integration into complex AI environments; pricing on request

Noma Security is an AI security platform covering three environments: endpoint agents such as Claude Code and Cursor, homegrown AI built on AWS Bedrock, Microsoft Foundry, or frameworks like LangChain, and agents built on SaaS platforms such as Copilot Studio, Agentforce, and ServiceNow. It consists of four products: AI-SPM, Agent Access Control, AI-DR, and AI Red Teaming.

The four products share context. Discovery data informs access policies, and red teaming findings become enforced patterns in production. Noma tracks the full chain of agent actions across a session, so it can link an agent reading customer records in one step with emailing a summary to an external address in a later step.

Key features include:

• AI asset discovery and risk map: Finds agents, MCP servers, skills, and models across endpoint, SaaS, and homegrown environments. The agent risk map shows each agent's connections, permissions, and data access, and flags misconfigurations and toxic combinations of capabilities.
• Agent access control: Defines which MCP servers, skills, and tools each agent can use and enforces the policy when the agent acts. Policies can be keyed to IdP groups or applied organization-wide by tool sensitivity, with a live registry of approved items and everything else blocked.
• AI detection and response: Detects prompt injection, data exfiltration, scope violations, and agents that drift from their intent. Each action is evaluated with its surrounding session, the identity behind the agent, the data involved, and behavior over time.
• Policy-based response actions: Depending on policy, the platform alerts, blocks the action, masks data, or routes the action to a human for review.
• Agentic identity: Tracks who an agent is acting as, what it is allowed to do, and whether its actions match the user's intent.
• MCP and AI supply chain security: Discovers, assesses, and governs MCP servers, detects tool poisoning and supply chain attacks, and scans models, tools, and packages.
• AI red teaming: Runs multi-turn attack campaigns with prebuilt scan profiles and compliance presets. Findings feed AI-DR runtime policies.

Limitations (based on publicly available sources):

• Integration effort: Deployment requires integration into complex AI development and deployment environments.
• Dependence on detection updates: Threat detection effectiveness relies on continuous updates to keep pace with new AI attack techniques.
• Pricing on request: Pricing details are not published and are provided upon request or consultation.

4. Prisma AIRS Agent Security

Best for: Palo Alto Networks customers securing agents across the lifecycle

Strengths: Central control of tool calls, LLM traffic, and MCP connections

Things to consider: Some features feel early-stage; tied to Palo Alto ecosystem

Prisma AIRS Agent Security is part of the Palo Alto Networks Prisma AIRS AI security platform. It covers the agent lifecycle, from discovering agents and scanning their code before deployment to verifying agent identities and enforcing security policies on agent actions at runtime.

Palo Alto Networks is integrating Portkey's AI Gateway into Prisma AIRS to provide one control plane that monitors agent actions, verifies agent identity, and applies runtime policies. Coverage includes agents on SaaS platforms, cloud services, low-code tools, and custom environments.

Key features include:

• Agent discovery and visibility: Discovers AI agents across SaaS platforms, cloud services, low-code tools, and custom environments. It shows what agents are doing, what they can access, and how they make decisions, including shadow and third-party agents.
• Agentic supply chain scanning: Scans agent code, MCP servers, and skills for supply chain vulnerabilities before deployment and provides remediation guidance.
• Agent behavior testing: Tests how agents behave in real-world conditions using a library of attacks or a dynamic red teaming agent.
• Over-privilege detection: Identifies excessive access and revokes unnecessary privileges to reduce the reach of compromised or misconfigured agents.
• Agent identity verification: Inventories and validates agent identities, defines agent ownership and permissions, and enforces least-privileged access.
• Runtime protection: Protects agents from prompt injection and agent-specific risks such as tool misuse, and enforces policies to prevent sensitive data exposure.
• Centralized AI traffic management: Controls tool calls, LLM interactions, and MCP connections from one place, with granular policies on how agents interact with systems.

Limitations (as reported by users on Gartner Peer Insights):

• Early-stage features: Some reviewers find that certain features still feel limited or not fully developed.
• Learning curve: Users mention that it takes time to understand how to get full value from the platform.
• Alert and report tuning: Some alerts and reports need manual adjustment to fit a specific environment.
• Platform dependency: Reviewers note that the product works best within the Palo Alto Networks ecosystem, which can limit its use elsewhere.

Source: Palo Alto Networks

Runtime Guardrails and AI Threat Detection Tools

5. Lakera AI Agent Security (Check Point)

Best for: Real-time guardrails on agent inputs, outputs, and actions

Strengths: Prompt attack detection in 100+ languages with sub-50 ms latency

Things to consider: Multimodal inspection limited to text in some integrations

Lakera AI Agent Security, now part of Check Point, inspects what goes into AI agents, controls what comes out, and governs the actions agents take. It discovers agents and MCP-connected tools, assesses their risk, and enforces protection at runtime without changes to models or prompts.

The platform connects to cloud, low-code, and custom environments and rates each agent based on its configuration, tools, data access, MCP servers, and level of autonomy. Detection covers over 100 languages, and runs with sub-50 ms latency.

Key features include:

• Agent and MCP discovery: Finds agents and MCP-connected tools across the environment, including agents that teams did not explicitly build or register. It identifies which data, APIs, and systems each agent can access.
• Agent risk assessment: Scores each agent based on its configuration, tools, data access, MCP servers, and autonomy.
• Prompt attack protection: Blocks prompt injection, jailbreaks, and adversarial instructions before they reach the model.
• Indirect injection blocking: Blocks injected instructions arriving through MCP-connected tools before agents act on them.
• Tool use and action governance: Uses policy and runtime enforcement to control what agents can access, call, and do. It contains unsafe actions, tool abuse, and connected system risk at runtime.
• Data and access protection: Detects sensitive data in prompts and responses and flags unauthorized agent access.
• Policy violation detection: Flags harmful or non-compliant outputs and agent actions that go beyond defined policies.

Limitations (based on publicly available sources):

• Text-only inspection of multimodal content: In some gateway integrations, only text segments of multimodal requests are inspected, and image and embedding outputs cannot be inspected.
• Sensitivity to integration structure: Passing system instructions inside user messages is a common cause of false positives, so integrations need to separate system and user content.
• Response handling left to the application: The Guard API returns a flagged result, and the application decides whether to block, confirm with the user, or only log the event.

Source: Lakera

6. Prompt Security (SentinelOne)

Best for: Governing workforce AI use, agents, and MCP servers together

Strengths: Shadow MCP discovery, least-privilege agent scope, audit log

Things to consider: Full coverage may need extension, agent, and proxy setup

Prompt Security, part of the SentinelOne Singularity Platform, covers employee AI tools, developer code assistants, homegrown AI applications, and autonomous agents. It provides AI governance, data leakage prevention, and threat protection, with policies enforced at the point of interaction.

The Agentic AI Security module maps the agents and MCP servers in an environment and governs what they can do. Policies and AI risk visibility are managed from the same console that covers SentinelOne endpoint, cloud, identity, and data security.

Key features include:

• Agent and MCP discovery: Automatically discovers shadow MCP servers and unsanctioned agent deployments.
• Least-privilege agent access: Enforces access policies so agents operate only within their defined scope.
• Agent action audit log: Keeps a searchable log of every agent action, decision, and interaction with enterprise systems.
• Real-time AI firewall: Blocks adversarial prompts and scrubs sensitive data from outputs of AI applications at runtime.
• Pre-deployment testing: Tests AI applications for prompt injection, jailbreaks, and data poisoning before deployment, and converts red teaming findings into production guardrails on a shared policy fabric.
• Role-based usage policies: Sets granular controls over who can use AI, how, and with what data.

Limitations (as reported by users on Gartner Peer Insights):

• Deployment effort for full coverage: Some reviewers find that achieving full coverage in complex environments requires coordinating a browser extension, an agent, and proxy configuration.
• Reliance on browser extension: Reviewers note that dependence on the browser extension introduces coverage risk.
• Detection consistency: One critical review reports decreased reliability and detection gaps over time.
• Dashboard and settings: Users mention limited reporting dashboard customization and advanced settings that can feel overwhelming.

Source: Prompt Security

7. Lasso

Best for: Intent-based runtime protection with discovery and red teaming

Strengths: Inline enforcement at proxy, API, or gateway; 3,000+ attack tests

Things to consider: Requires CI/CD and platform integration; few user reviews

Lasso is an AI security platform that connects discovery, AI risk management, automated red teaming, and runtime protection in a continuous loop. It analyzes the intent behind an agent's actions instead of relying only on fixed patterns, and checks whether agentic applications behave within their intended scope.

Lasso discovers agents through platform integrations and finds homegrown applications through CI connections. Runtime policies are enforced inline at the proxy, API, or AI gateway layer, and threat detections are mapped to MITRE and OWASP.