Ka tipu haere te mata o tō whakaeke API i ia pull request, ā, ko te nuinga o ngā taputapu haumarutanga API ka kite noa i te wā e ora ana, e whiwhi ana i ngā tāngata. Ka kitea e Xygeni ia pūwāhi me ōna mōrearea i roto i te waehere, i mua i te tukunga.
E wātea ana hei Enterprise tāpiri-ake
Tō Mata Whakaeke API, kua Maheretia, kua Whakarārangitia hoki.
Ka hangaia e Xygeni tō rarangi API mai i te waehere pūtake tono me ngā whakatakotoranga o tō API, tae atu ki a OpenAPI me Swagger, kia kite ai koe i te mata katoa: ngā pūwāhi i tuhia e ō tīma, me ērā kāore anō kia mahia e tetahi.
Kua maherehia ngā kitenga ki te OWASP API Security Top 10 (2023): te whakamanatanga taumata ahanoa me te mahi pakaru, ngā pito mutunga kāore i whakamanahia, te nui rawa o te whakaaturanga raraunga, te tohatoha papatipu, te whirihoranga hē o te JWT me te CORS, ngā rohenga tere ngaro, te SSRF, me ngā pito mutunga zombie.
Kei ia kitenga te āhua manatoko o te pūwāhi me te tairongo o ngā raraunga e whakahaerehia ana e ia, kia whakatikahia ai e ngā tīma te mea ka taea e te kaiwhakaeke te toro atu, kaua ki te mahi i tētahi rārangi kore rerekē.
Ngā Pūtake Katoa. Ngā Mōrearea Katoa. I mua i te Hanganga.
Ngā API katoa, ngā rawa kei te mōrearea ki tētahi tūāpapa, ngā pito mutunga mā te tikanga, me ngā take mā te ratonga. Ko ia pito mutunga kua whakarārangihia me tōna tikanga, ara, ratonga, kōwae, āhua manatoko, me te kaute mōrearea.
Te kimi puta noa i te OWASP API Security Top 10 (2023), nō reira, ko ngā kitenga e whakaatu ana i te anga e whakamahia ana e tō rōpū haumarutanga me ō kaitātari.
Ka whakarōpūtia e Xygeni ngā raraunga e whakahaerehia ana e ia pito whakamutunga, e tohu ana i te PII, PCI, me te PHI i roto i ngā tawhā me ngā whakautu. Ehara i te mea kotahi te raruraru o tētahi pito whakamutunga kāore i whakamanahia e whakahoki mai ana i ngā raraunga whaiaro ki tētahi pane CORS whakaae, ā, kaua e rite te āhua ki tētahi pane.
Nā te mea ka pānuihia e Xygeni te waehere me ngā whakaritenga o tō API, ka puta te rerekētanga i waenga i a rāua: kei roto ngā pito i te waehere engari kāore i te kitea i roto i ngā whakaritenga, kei te taea tonu te toro atu ki ngā ara kua kore e whakamahia, ā, kāore tetahi e pupuri ana i ngā pito pani.
Ka hono a Xygeni i ngā kitenga i te pito kotahi, ā, ka whakanui ake i te kaha ina piki haere. He mea nui te turuturu PII i roto i tētahi urupare. He mea nui te turuturu PII i runga i tētahi pito kāore e hiahiatia he manatoko, ā, e kī ana a Xygeni koia tēnā.
Ka tohu ia kitenga ki te kaiwhakahaere tika: te kōnae, te akomanga, te tikanga, me te waehere i whakauru mai, me te hapa kei runga i te raina. Ka whiwhi ngā kaiwhakawhanake i tētahi mea ka taea e rātou te whakatika, ehara i te tīkiti me rangahau tuatahi e rātou.
Kimihia, ka whakatikahia hoki ngā mōrearea API i roto i te waehere i mua i te taenga ki te whakaputanga.
Mā te haumarutanga o te API wā-oma ka whakaaturia he pito whakamutunga ina mahi ana i ngā waka. Ka kitea e Xygeni i roto i te waehere, i roto i te pull request, ahakoa he utu tonu te whakatika commit.
Kei te taha tonu o te haumarutanga API SAST, SCA, ngā mea ngaro, IaC, me te DAST i roto i te tūāpapa kotahi, kia noho tahi ai tō mōrearea API me te toenga o tō mōrearea tono, kaua i roto i tētahi taputapu motuhake me tana ake login.
Pūmau. Ka tātarihia e Xygeni tō waehere tono me ngā whakatakotoranga API hei kimi i ngā whakaaturanga i mua i te whakatinanatanga. Mō te whakamātautau wā-oma o tētahi tono e rere ana, ka hipokina e Xygeni DAST tēnā, ā, ka mahi tahi ngā mea e rua.
Mai i ngā pūtake e rua: tō waehere pūtake tono, me ngā whakatakotoranga o tō API, tae atu ki a OpenAPI me Swagger. Mā te pānui i ngā mea e rua ka taea e Xygeni te whakaatu i ngā pito mutunga kāore i tuhia, kāore hoki i pania.
Ngā mōrearea puta noa i te OWASP API Security Top 10 (2023), tae atu ki te whakamanatanga taumata ahanoa pakaru (BOLA), te whakamanatanga taumata mahi pakaru (BFLA), ngā pito mutunga kāore i whakamanahia, te nui rawa o te whakaaturanga raraunga, te tohatoha papatipu, te whirihoranga hē o te JWT me te CORS, te herenga tere ngaro, te SSRF, me ngā pito mutunga zombie.
Āe. Ka tohua e Xygeni te PII, te PCI, me te PHI i roto i ngā tawhā me ngā urupare mutunga, ā, ka whakamahia hei whakarōpū i ngā kitenga mā te whakaaturanga tūturu.
Āe. Ka tātarihia e te matawai tāpiripiri ngā pito whakamutunga anake i rerekē, ā, ka taea e te whakaaturanga e puta mai ana te arotahi i tētahi matawai DAST e whai ake nei ki aua pito whakamutunga anō.
Kāo. Ka whakahaerehia ngā matawai i roto i tō ake hanganga. Ko ngā hua anake ka tukuatuhia, ka tiakina i te wā e tukuna ana, e waihotia ana rānei.
Kei te wātea hei Enterprise tāpiritanga. Kōrero mai ki a mātou, ā, mā mātou e arotake tahi.
me te Pūhara Xygeni All-In-One AppSec
me te Pūhara Xygeni All-In-One AppSec
