ose pull request iyo inowedzera kana kuchinja endpoint inoshandura nzvimbo yako yekurwisa yeAPI. Zvishandiso zvakawanda zvekuchengetedza zveAPI hazvioni kusvika endpoint iyoyo yavepo uye yatove kutora traffic. Panguva iyoyo, kugadzirisa hakuchisiri kuchinja kwemutsetse mumwe chete muongororo yekodhi, ihurukuro yekupindura zviitiko.
Kuchengetedzwa kweAPI inzira yekutsvaga nekuvhara njodzi dzekuti application inofumura sei magumo ayo: ndiani anogona kuafonera, ruzivo rwaanodzosera, uye kana achiita zvinotaurwa nemagwaro kuti anoita.
Zvizhinji zvezvishandiso zvakavakirwa dambudziko iri zvinoedza API panguva yekumhanya, kubva kunze, nenzira imwecheteyo ingaita munhu anorwisa. Maitiro iwayo anoshanda, asi anoshanda chete mushure mekunge API yaiswa. Xygeni inotora nzira yekutanga: inoverenga kodhi yako yetsime uye marongero eAPI yako isati yasvika pamugumo wechirongwa chimwe chete.
Nzira Ina Dzekuyedza API, Uye Zvinopindurwa Neimwe Neimwe
Mapurogiramu mazhinji ekare anoshandisa zvinopfuura chimwe chezvizvi:
- Kuedza kwakasimba inoongorora kodhi yekodha uye maAPI asati ashandiswa. Inopindura kuti "chii chatachangobva kuburitsa pachena?" Iyi ndiyo nzira iri kutariswa nechinyorwa chino.
- Kuedza kweDynamic (DAST) Inotumira traffic chaiyo paAPI iri kumhanya uye inoona kuti inopindura sei. Inopindura kuti "chii chiri kusvikika uye chinogona kushandiswa pari zvino?"
- Fuzzing Inokanda zvinhu zvisina kurongeka kana zvisingatarisirwi pamagumo ekupedzisira kusvika pakudonha kwepamusoro uye kukundikana kwemakona emucheto. Inopindura kuti "ndeapi maburiro atisina kutarisira?"
- Kuedzwa kwekupinda nemaoko Inopa pfungwa dzevanhu kuti vawane zvikanganiso zvepfungwa, zvishandiso zvemagetsi zvinokundikana. Inopindura kuti "murwisi akangwara angabatanidza sei?"
Hapana chimwe cheizvi chinotsiva zvimwe. Zvinopindura mibvunzo yakasiyana panguva dzakasiyana muhupenyu hwese, uye musiyano uripo muzvirongwa zvakawanda ndiwo wekutanga.
Nei Zvishandiso Zvizhinji zvekuchengetedza zveAPI Zvichiona Njodzi Yakanyanya Kunonoka
Kuongororwa kwekuchengetedza kweRuntime API kunotumira traffic paapplication iripo uye kunoona kuti inopindura sei. Idanho repamutemo uye rinodiwa. Zvakare, nekugadzirwa, chiratidzo chekunonoka: nzvimbo yekupedzisira inofanira kuvapo, kuiswa, uye kusvikika usati wagona kushandisa runtime scanner kutaura chero chinhu nezvazvo. Chero chawawana chaive chatoonekwa kwenguva yakareba zvisinei nekuti zvakatora nguva yakareba sei kuti scan ishande.
Pane imwe nzvimbo iri pakati pedambudziko renguva iyoyo. Maturusi eRuntime anogona kungoedza zvavanoziva kuti zviripo. Kana nzvimbo yekupedzisira isina kumbonyorwa, kana kuti OpenAPI spec yakasiya nguva panguva yakatumirwa nzira itsva, runtime scanner haina nzira yekuziva kuti iripo. Inoedza mepu, kwete nzvimbo.
Kuongororwa kwekuchengetedzwa kweStatic API kunovhara mipata yese nekufambisa cheki kuenda kwakatarwa endpoint: kodhi yako uye API yako specification, usati waisa. pull request chinopa mugumo ndicho pull request izvo zvinoisa njodzi yacho panjodzi yacho.
Zvinoreva Static API Security Chaizvo
Xygeni inovaka zvinhu zvako zveAPI kubva kuzvinhu zviviri: source code yeapplication yako uye maAPI specifications ako, anosanganisira OpenAPI neSwagger.
Inventory ye spec-only inoratidza ma endpoints anodiwa nemunhu kuti anyore. Inventory ye code-only inoratidza zviripo asi kwete kuti zvaifanirwa kushandiswa sei. Kuverenga zvese izvi kunokupa mufananidzo wakakwana: ma endpoints akanyorwa nechikwata chako, uye ayo asina zvakaitwa nevamwe.
Zvinhu izvozvo ndizvo zvinovakirwa pane zvimwe zvese:
- MaAPI ese akawanikwa, uye midziyo iri panjodzi yakayerwa zvichienderana nekutanga
- Mapoinzi ekupedzisira akapatsanurwa nenzira yeHTTP
- Nyaya dzakarongwa zvichienderana nebasa
- Poindi yega yega ine nzira yayo, nzira, sevhisi, module, mamiriro ekusimbisa uye chikero chengozi
Vatungamiriri vako veinjiniya vanoona chimiro chenzvimbo yako yeAPI vasina kuvhura tikiti rimwe chete.
Poindi yega yega Xygeni yaiwana, nenzira yayo, mamiriro ekusimbisa uye chibodzwa chenjodzi, yakavakwa kubva pakodhi uye zvirevo pamwe chete.
Production note Bvisa panel yeAI Triage kubva pane chero skrini yeAPI Security.
Yakagadzirwa neOWASP API Security Top 10
Zvakawanikwa zvinoratidza hurongwa hwatoshandiswa nemapoka ekuchengetedza enyu nevaongorori venyu. Xygeni inoona njodzi muOWASP API Security Zvepamusoro 10 (2023):
Chimwe chikamu hachipo nemaune. API6, Unrestricted Access to Sensitive Business Flows, inoda kunzwisisa zvinofanirwa kubvumidzwa nemaitiro ebhizinesi, uye hapana static analyzer inoona izvozvo nenzira yechokwadi. Chero mutengesi anotaura zvakasiyana ari kukutengesa bhokisi rekutarisa. Iro rinoramba riri ne threat modeling yako uye penetration testers yako.
Hazvisi Zvese Zvakawanikwa Zvakafanana: Kunzwisisa Data uye Musanganiswa Une Chepfu
Rondedzero isina kurongeka yezvakawanikwa inobata nzvimbo yekuongorora hutano isina kusimbiswa yakafanana nenzvimbo yekuongorora hutano isina kusimbiswa inodzosera zvinyorwa zvevatengi. Izvo hazvisi dambudziko rakafanana, uye modhi yekuisa zvinhu zvakakosha inovapa mamakisi akafanana inodzidzisa zvikwata zvako kuti zvisateerere runyorwa.
Xygeni inoronga data riri muchikamu chega chega che endpoint, ichiisa chiratidzo chePII, PCI nePHI muzvikumbiro uye mumhinduro, uye inoisa pamwe chete ne endpoint's authentication state.
Zvinobatanidzawo zvakawanikwa zvinowira panzvimbo imwe chete uye zvinowedzera kuoma kana zvikawedzera. Kubuda kwePII mumhinduro chinhu chakakomba chega. Kubuda kwakadaro panzvimbo imwe chete kusingadi kusimbiswa kwakakosha, uye puratifomu inoiwana nenzira iyoyo pachinzvimbo chekusiya kubatana kuti mumwe munhu azvione nemaoko.
Mapoinzi eZombie neNherera: Kufamba Pakati peKodhi neSpec
Nekuti Xygeni inoverenga kodhi yako neAPI yako specification padivi nepadivi, inoona pavasingabvumirani. Kuchinja uku kunoratidza semapatani matatu anozivikanwa:
- Magumo asina kunyorwa. Vanogara mukodhi uye havana kumbowedzerwa kune spec.
- Magumo eZombie. Zvinonzi hazvina basa kana kuti hazvina kushanda, uye zvichiri kusvikika.
- Nherera dzinoguma. Hapana ari muchikwata chiripo iye zvino ane simba nazvo.
Hapana chimwe cheizvi chinowanikwa muzvinhu zvakatsanangurwa chete, nekuti zvinhu zvakatsanangurwa ndizvo chaizvo zviri kushaikwa.
Uchapupu Hwaunogona Kuita Nezvahwo, Kwete Tiketi Yekuferefeta
Kutsvaga kwese kunongedzera kune mubati chaiye ane basa: faira, kirasi, nzira, uye mutsetse chaiwo wakaunza chikanganiso, nekodhi yekukanganisa yakapihwa padivi payo. Imwe neimwe inewo kuoma kwayo, chikamu chayo cheOWASP API Security Top 10, CWE yayo, mamiriro ekusimbisa endpoint, uye kupatsanurwa kweruzivo rwunobatanidzwa.
Kuwana mazita ekupedzisira kunotuma mugadziri wepurogiramu kuti atsvage kuburikidza necodebase asati atanga kugadzirisa chero chinhu. Kuwana mazita emutsetse kunovaisa pakugadzirisa ipapo ipapo.
Zvakawanikwa zvinotumirwa kunze seJSON, CSV, Markdown uye SARIF 2.1.0, saka zvinowira mu tmapoka ako atove kushanda.
Mubati, mutsetse, uye kodhi zvakaunza kuratidzwa. Haisi tikiti rekuongorora.
Nei Izvi Zvichigara Mupuratifomu Imwe, Kwete Imwe Console
Xygeni inomhanya neAPI Security padivi payo SAST, SCA, Kuchengetedzwa Kwezvakavanzika, IaC uye DAST mukati mepuratifomu imwe chete, yakabatana kuburikidza ASPM, pachinzvimbo chekuitumira sechishandiso chakasiyana nechayo login uye mhedzisiro yayo.
Izvi zvinokosha nekuti zvakawanikwa zvisingachinji uye zvakawanikwa panguva yekumhanya zvinopindura mibvunzo yakasiyana nezve endpoint imwe chete, uye zvinobatsira zviri pamwe chete pane zvakaparadzana. Static inokuudza kuti endpoint ine njodzi isati yatumirwa. DAST inosimbisa kuti chii chinogona kusvikwa uye kushandiswa kana chatanga kushanda.
Kuparadzanisa izvozvo pakati pemaconsoles maviri uye njodzi dzakabatana dzinova zvinhu zviviri zvisina hukama. Hapana anodzigadzirisa, uye mugumo usina magwaro uye usina chokwadi hausi mumutsara.
Ona nzvimbo yako chaiyo yekurwisa API. Kuchengetedzwa kweAPI kunowanikwa se Enterprise kuwedzera papuratifomu yeXygeni, uye scan inomhanya ichipesana nedura rako riri mukati mezvivakwa zvako.
FAQ
Inogona here kuziva kuti ndeapi magumo anobata data rakakosha?
Ehe. Xygeni inoratidza PII, PCI nePHI muzvikamu zve endpoint uye mhinduro, uye inoshandisa kupatsanura ikoko kuronga zvakawanikwa nekutarisa chaiko.
Inogona kumhanya pane ese pull request?
Ehe. Kuskena kwakawedzera kunoongorora ma endpoints akachinja chete, uye manifest yainogadzira inogona kutarisa DAST scan inotevera pama endpoints iwayo, saka kuyedza kwe static uye kumhanya kunoramba kwakabatana nechakanyatsofamba.
Kodhi yangu inosiya nharaunda yangu here?
Kwete. Kuskena kunoshanda muzvivakwa zvako wega. Mhedzisiro chete ndiyo inoiswa, inodzivirirwa mukufambisa uye pakuzorora.
Ndingawana sei API Security?
Kuchengetedzwa kweAPI kunowanikwa se Enterprise wedzera. Kumbira PoC uye ichashandiswa newe.
