Automating API security
When we consider all the possible ways in which an API can be vulnerable to attack, it may feel like a lost cause—with so many attack vectors, frameworks, access-control schemes, coding flaws, and so on, where do we even start?
The really good news is that a vast number of flaws are easily detectable using automated tools during the development lifecycle. A typical distribution of flaw occurrence (by count) against the difficulty of detection is shown here:
Figure 8.11 – Sweet spot for flaw detection
The sweet spot is where most of the low-hanging fruit exists—these are very basic flaws that can be detected easily. For example, all the OpenAPI definition flaws identified in the previous section can be detected in real time, with precision, at various stages in the lifecycle (IDEs, repositories, and CI/CD pipelines). Next, let us take a look at some quick wins from the integration API security checks into...
