Jayesh Ahire
speaker
67 appearances
1 recordings
1 series
first heard Oct 2024
last heard Oct 2024
Jayesh Ahire’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
Hello, listeners. Today, we are kicking off an amazing series for Cybersecurity Awareness Month, aka Halloween, entitled The Haunted House of APIs, sponsored by our friends at Traceable AI. In this series, we are building awareness around APIs, their security risks, and what you can do about it.
Traceable AI is building one platform to secure every API so you can discover, protect, and test all your APIs with contextual security, enabling organizations to minimize risk and maximize the value APIs bring to their customers. Our episode for today is entitled The Witch's Brew, Stirring Up OWASP Vulnerabilities in API Testing.
We'll be talking with Jayesh Ahire, an expert in API testing and OWASP, who will guide us through the brew of common vulnerabilities that haunt API ecosystems. He'll share how organizations can use API security testing to spot and neutralize these vulnerabilities before they become major exploits.
By focusing on proactive security measures, Jayesh will offer insights into creating a strong API testing framework that keeps malicious actors at bay. Jayesh, thank you for being on the show today.
Thanks for having me.
Glad to be here. Really excited to jump into OWASP vulnerabilities and API testing, the witch's brew. Before we jump into that, though, tell me a little bit, and my audience, tell me and my audience a little bit about you.
Yeah, I'm Jaish. I run product management here at Traceable. Been here for almost five years now, playing to the API security world. Before this, I was running my own venture in machine learning, cloud ops, DevOps. I read a lot. Since last few years, I have been doing 100 books a year. It's been interesting going through the list and reading around a lot of different things.
that's one part other thing i also write poems in my mother tongue in english depending on the mood also published few books around it and so some technical ones i like to write as well i used to play guitar and piano but yeah reading writing poetry that's a jam for these days
That gives a picture of a well-rounded individual, and I appreciate you sharing all that. Let's dive into it then. So we're talking about OWASP vulnerabilities and API testing. Diving into the witch's brew, we're calling it. What are some of the most common vulnerabilities in APIs that align with the OWASP top 10? And tell me why they're so dangerous.
When we talk about APIs, right? One of the things which is prominent these days is every single thing we are building, like every single product, every single software, every single app is running on APIs. And that's where we talk about vulnerabilities. The impact also increases because everything is an API at the end of the day.
And that's why I categorize these vulnerabilities or even dangers into three broad categories. One is the access control. We are building these APIs, but sometimes you just left the door open. And that door can be exploited by attackers to get the information. In access control, there are vulnerabilities like BOLAs.
Nowadays, in the new OWASP API top 10, we have BOPLA, which is Broken Object Properties Authorization. Then there's always BAFLA, which is Broken Function Level Authorization. Not to just throw some terms, but essentially when the API was built, the authentication authorization was not configured properly. And that's where somebody else can get access to somebody else's information.
Which is, again, problematic when literally we are dealing with banks, dealing with health care, where all of the information is pretty sensitive and pretty critical. But access control part is the most prominent one and most exploited one we have seen in the last few years at the very least. It's first in OWASP API doctrine. The second part of that is data privacy.
That's where the excessive data exposure comes into picture, where we are actually showing the information in plain text or in responses or in places in the UI where it shouldn't be there. We have seen a bunch of news articles coming around this part where the social security numbers of thousands of people leaked or millions of people leaked at bad points.
And all of that is due to that information already being exposed in place or in response where it shouldn't be. Because everything, as I said earlier, everything is driven around data and data is gold so it becomes critical for these applications for the services for the softwares to actually secure it properly and as everything is exposed via api it comes to the api layer again
Third part, and I'll talk about this in the later sections more on, but the third part is inventory management. It's all building a lot of APIs just days, but sometimes we don't even know what we have built over the period. There are a lot of APIs which were retired, but still being used, still publicly accessible.
Payment gateways, you're using validation platforms and you're actually sending the sensitive information to those platforms and making sure like what you're sending, what you're what you should be sending, what you should not be sending, and having proper filters for that. That also becomes pretty critical when we are dealing with the huge number of APIs we are dealing with these days.
So actually knowing what you have and making sure to act every single action or every single thing which is being performed with the APIs you have and the issues with those APIs is also a very critical thing. When I talk about all of these three categories, everything is part of OWASP API Doctrine.
Sure. All that makes sense. And I hear what you're saying. We're sitting in a world where everything is built on top of APIs, and that makes API testing in general critical. But why is API security testing crucial for detecting these types of vulnerabilities that you just mentioned early? And how does it differ from traditional security testing?
I could probably extract a couple of things from a few things you pointed out, but I'm curious to hear what you have to say holistically.
Showing 1–20 of 67 · page 1 of 4
Next →