Himanshu Pranami’s Post

Take control of your APIs with precise permission control! 🔒 API7's refined RBAC lets you assign roles & permissions for granular access, ensuring security & efficiency. ➡️ Read more: https://lnkd.in/dp7EJ8xG #apimanagement #rbac #enterprisesecurity

“When Log4j happened, we basically went around to every developer team and said ‘hey, got any suspicious looking .jar files?’” That’s what a security engineer at a Fortune 500 bank told me a few months after Log4Shell. Seems like we should just be able to search for the vulnerable package - just like a Google search, right? That’s exactly what FOSSA has enabled with their recently released Package Index. Check out the blog to see how it works. 

Discover how Drata, a leader in security compliance automation, is using Socket to: ✅ Automate threat detection processes with AI-driven insights ✅ Expand visibility into software supply chain risks ✅ Empower developers to make informed security decisions Case Study: https://lnkd.in/eBSrBhMB

https://lnkd.in/d_HAXkG3 How Rate Limiting Can Make APIs More Robust and Secure --------------------------------------------------- How Rate Limiting Can Make APIs More Robust and Secure Learn about rate limiting in APIs and its importance in ensuring stability, availability, and security. Discover the different rate limiting algorithms and best practices for implementation. Enhance the robustness and security of your APIs with rate limiting techniques. read full blog post...

🚀 We are beyond thrilled to announce 15 more connectors for ConnectorX! These new integrations connect into commonly used application security tools across all stages of the SDLC. They augment Cycode’s native scanning capabilities and leading Risk Intelligence Graph (RIG) to deliver unparalleled third-party application security visibility. This allows us to continue our mission as the industry’s only Complete ASPM Platform. Want to learn more about our connectors and how you can gain peace of mind? Read our blog now 👇 https://lnkd.in/eS5GdzMv #aspm #developersecurity #AST #ConnectorX #cycode

Most teams start their API security journey with a desire to simply understand what's being used today, or API discovery. When conducting API discovery, consider, for each API: Is it public or private? Is it external or internal? Who owns it? What kind of calls can it make? What is the intended use case? How is it written? (JSON, XML, GraphQL) What kind of data is it transmitting? And after discovery, the challenge turns to documentation, keep reading to learn more: https://bit.ly/4ezHvwY

#API security, #Kubernetes Authorization, #Data Sec, #CyberSec Request attributes used in authorization Kubernetes reviews only the following API request attributes: user - The user string provided during authentication. group - The list of group names to which the authenticated user belongs. extra - A map of arbitrary string keys to string values, provided by the authentication layer. API - Indicates whether the request is for an API resource. Request path - Path to miscellaneous non-resource endpoints like /api or /healthz. API request verb - API verbs like get, list, create, update, patch, watch, delete, and deletecollection are used for resource requests. To determine the request verb for a resource API endpoint, see request verbs and authorization. HTTP request verb - Lowercased HTTP methods like get, post, put, and delete are used for non-resource requests. Resource - The ID or name of the resource that is being accessed (for resource requests only) -- For resource requests using get, update, patch, and delete verbs, you must provide the resource name. Subresource - The subresource that is being accessed (for resource requests only). Namespace - The namespace of the object that is being accessed (for namespaced resource requests only). API group - The API Group being accessed (for resource requests only). An empty string designates the core API group. Request verbs and authorization

Top 12 Tips for API Security . . - Use HTTPS - Use OAuth2 - Use WebAuthn - Use Leveled API Keys - Authorization - Rate Limiting - API Versioning - Whitelisting - Check OWASP API Security Risks - Use API Gateway - Error Handling - Input Validation Follow Mohamed Rilwan for more insights Like | Share | Comment Credits: ByteByteGo

I few months ago I teamed with Frank Kilcommins to run a webinar on the practical aspects of implementing API security by design. It was a challenging exercise, putting together a story people can relate to and carefully crafting examples that tell the story while illustrating all the concepts we wanted to explain. We were updating the code until the very last minute 😅 But I think the result is awesome and I'm very proud of this webinar! The video reviews all the main security vulnerabilities, showcases them in the API design and implementation, and explains how to leverage the tooling ecosystem to tackle these problems. Overall I think this is a great illustration of how to shift left on your API security strategy. Thanks to SmartBear for facilitating the webinar! I hope you enjoy the video! #apisecurity #cybesecurity #apis .

❗API discovery and risk assessment are critical first steps to improving your API security. 😯🤔 And, discovery tools explicitly built for #APIs will help you get there! 🙌 Dive deep into the nature of API-based systems in this InfoWorld article, with #Graylog's Rob Dickinson. Rob digs into the "how" and "why" of creating an API inventory, tracking #API inventory changes, and quantifying API risks—in pursuit of the best API security. 🔐 There is no single “easy button” for API security, but mature tools that are purpose-built for API discovery and risk scoring are now available to help you get started. Learn more.👇 https://lnkd.in/gbznS5uN #APIsecurity