Ke ulu nei kāu ʻili hoʻouka API me kēlā me kēia pull request, a ʻike wale ka hapa nui o nā pono hana palekana API iā ia ke ola a lawe i ke kaʻa. ʻIke ʻo Xygeni i kēlā me kēia hopena a me kona mau pilikia i loko o ke code, ma mua o ka hoʻokuʻu ʻia ʻana.
Loaʻa ma ke ʻano he Enterprise hoʻopau hou
ʻO kāu ʻIli Hoʻouka API, i Palapala ʻia a i Kūlana ʻia.
Kūkulu ʻo Xygeni i kāu waihona API mai ke code kumu noi a mai kāu mau kikoʻī API, me OpenAPI a me Swagger, no laila ʻike ʻoe i ka ʻili piha: nā hopena i hoʻopaʻa ʻia e kāu mau hui, a me nā mea i hana ʻole ʻia e kekahi.
Ua hoʻohālikelike ʻia nā mea i loaʻa i ka OWASP API Security Top 10 (2023): ka ʻae ʻana o ka pae hana a me ka mea i haki, nā hopena i hōʻoia ʻole ʻia, ka hōʻike ʻikepili nui ʻana, ka hoʻokaʻawale nui ʻana, ka hoʻonohonoho hewa ʻana o JWT a me CORS, nā palena helu nalowale, SSRF, a me nā hopena zombie.
Loaʻa i kēlā me kēia ʻike ke kūlana hōʻoia o ka endpoint a me ka ʻike o ka ʻikepili āna e lawelawe ai, no laila hoʻoponopono nā hui i ka mea hiki i ka mea hoʻouka ke hiki ma kahi o ka hana ʻana i kahi papa inoa like ʻole.
Kēlā me kēia Hopena. Kēlā me kēia Pōpilikia. Ma mua o ka Hana ʻana.
ʻO nā API āpau, nā waiwai i pilikia i kahi kumu mua, nā hopena ma ke ʻano hana, a me nā pilikia ma ka lawelawe. ʻO kēlā me kēia hopena i helu ʻia me kāna ʻano hana, ala, lawelawe, module, kūlana hōʻoia, a me ka helu pilikia.
ʻO ka ʻike ʻana ma o ka OWASP API Security Top 10 (2023), no laila e hōʻike ana nā ʻike i ke ʻano hana a kāu hui palekana a me kāu mau mea loiloi e hoʻohana nei.
Hoʻokaʻawale ʻo Xygeni i ka ʻikepili a kēlā me kēia endpoint e lawelawe ai, e hōʻailona ana iā PII, PCI, a me PHI ma nā palena a me nā pane. ʻO kahi endpoint i hōʻoia ʻole ʻia e hoʻihoʻi ana i ka ʻikepili pilikino ʻaʻole ia he pilikia like me kahi poʻomanaʻo CORS ʻae, a ʻaʻole pono e like me ia.
Ma muli o ka heluhelu ʻana o Xygeni i ke code a me kāu mau kikoʻī API, hōʻike ia i ka ʻokoʻa ma waena o lākou: noho nā endpoints i loko o ke code akā nalowale mai ka spec, hiki ke hiki aku i nā ala i hoʻopau ʻia, a me nā endpoints makua ʻole nona kekahi.
Hoʻopili ʻo Xygeni i nā ʻike ma ka hopena like a hoʻonui i ke koʻikoʻi ke hui pū lākou. He koʻikoʻi ka PII leak i loko o kahi pane. He mea koʻikoʻi ka PII leak ma kahi hopena ʻaʻole pono ka hōʻoia ʻana, a ʻōlelo ʻo Xygeni pēlā.
Kuhi kēlā me kēia ʻike i ka mea lawelawe pololei: faila, papa, ʻano hana, a me ke code i hoʻolauna iā ia, me ka hemahema ma ka laina. Loaʻa i nā mea hoʻomohala kahi mea hiki iā lākou ke hoʻoponopono, ʻaʻole kahi tikiki e pono ai lākou e noiʻi mua.
E huli a hoʻoponopono i nā pilikia API i loko o ke code ma mua o ko lākou hiki ʻana i ka hana.
Hōʻike ka palekana o ka Runtime API iā ʻoe ua hōʻike ʻia kahi endpoint ke lawelawe mua ia i ke kaʻa. Loaʻa iā Xygeni ia mea ma ke code, ma ka pull request, ʻoiai ke kumukūʻai o ka hoʻoponopono ʻana commit.
Aia ka palekana API ma ka ʻaoʻao o SAST, SCA, nā mea huna, IaC, a me DAST ma kahi kahua hoʻokahi, no laila e noho pū ana kāu pilikia API me ke koena o kāu pilikia noi ma kahi o kahi mea hana kaʻawale me kāna ponoʻī login.
Paʻa. Nānā ʻo Xygeni i kāu code noi a me nā kikoʻī API e ʻike i nā hōʻike ma mua o ka hoʻolaha ʻana. No ka hoʻāʻo ʻana i ka manawa holo o kahi noi e holo ana, uhi ʻo Xygeni DAST i kēlā, a hana pū nā mea ʻelua.
Mai nā kumu ʻelua: kāu code kumu noi, a me kāu mau kikoʻī API, me OpenAPI a me Swagger. ʻO ka heluhelu ʻana i nā mea ʻelua ka mea e hiki ai iā Xygeni ke hōʻike i nā wahi hopena i palapala ʻole ʻia a makua ʻole ʻia.
Nā pilikia ma waena o ka OWASP API Security Top 10 (2023), me ka ʻae ʻana i ka pae mea i haki ʻia (BOLA), ka ʻae ʻana i ka pae hana i haki ʻia (BFLA), nā hopena i hōʻoia ʻole ʻia, ka hōʻike ʻikepili nui ʻana, ka hāʻawi nui ʻana, ka hoʻonohonoho hewa ʻana o JWT a me CORS, ka palena helu nalowale, SSRF, a me nā hopena zombie.
ʻAe. Hōʻailona ʻo Xygeni iā PII, PCI, a me PHI ma nā palena a me nā pane o ka hopena, a hoʻohana i kēlā e hoʻonohonoho i nā ʻike ma o ka hōʻike maoli.
ʻAe. Nānā wale ka scanning incremental i nā hopena i loli, a hiki i ka manifest āna e hana ai ke kālele i kahi scan DAST ma hope ma kēlā mau hopena like.
ʻAʻole. Holo nā scan i loko o kāu ʻōnaehana ponoʻī. Hoʻouka wale ʻia nā hopena, pale ʻia i ka wā e lawe ʻia ai a i ka wā e waiho ʻia ai.
Loaʻa ia ma ke ʻano he Enterprise mea hoʻohui. E kamaʻilio mai iā mākou a e nānā pū mākou me ʻoe.
me ka paepae Xygeni All-In-One AppSec
me ka paepae Xygeni All-In-One AppSec
