Original Post: Choosing API Security Tools
The article discusses the challenges of selecting API security tools amidst the expanding market since 2021. It underscores the importance of identifying your specific needs based on your AppSec program, developer engagement, SDLC methodology, development environment, and application types (API/microservice vs. older models).
The article covers common API security tool features, including:
- Inventory (enumeration): Identifies all live APIs to catch any unguarded ones.
- Fuzzing/dynamic automated testing: Sends requests to APIs to detect problematic responses.
- Web Application Firewall (WAF): Blocks malicious API traffic.
- API Gateway: Handles authentication, authorization, throttling, and is crucial for public APIs.
- Context feature: Provides detailed information about the API and issues for prioritization.
- Static analysis and API Linters: Aids in code quality and ensuring schema completeness.
- Dynamic Automated Testing (DAST): Emphasizes API-specific tools for better accuracy over traditional web app scanners.
- Software Composition Analysis (SCA): Monitors dependencies, similar to web apps.
Additionally, the article recommends the must-have API gateway and the continued use of SAST and SCA tools for regular and API-specific applications. For dynamic scanning, an API-specific tool is preferable unless one is willing to invest significant time in customization. The core message is to first determine what’s most critical to your needs, then conduct a proof of concept (POC) with shortlisted tools before finalizing your choice.
Lastly, it suggests adopting OpenAPI for new APIs for broader tool compatibility and concludes with light hearted encouragement for those in the market for API security tools.
Go here to read the Original Post