Traditional vs. Modern Web Application

[Ailton da SIlva dos Santos Filhos]

Hello everyone, 

I have a question specifically to Erez Yalon and Inon Shkedy. However, as might help other researchers, I'm asking here in the group.

In "API Security Project OWASP Projects Showcase" slides you guys compare Traditional and Modern Web Applications and highlit how API based apps are different. 

I think we all agree with the statements, and empirically we know that they are true. However, I was not able to find any material (books, scientific articles, etc) that confirm those ideas and say the same thing.

So, my question is: do you have the sources that inspire the comparison made in these slides?

PS: I'm particularly interested in the source that confirms that, in API Based Applications, "More parameters are sent in each HTTP request (object ID’s, filters)".

Best regards,

Ailton

[Inon Shkedy]

Hi Ailton,

That's a great question, and I'm glad you asked it.

The creation process of the initial version of the OWASP Top 10 for APIs was a ten months process led by Erez, Paulo and me. 

Unfortunately, we had a limited amount of time to spend on the project (we all have full-time jobs). As you can imagine, this type of project requires a lot of research, and there are many ways to do it. We decided to focus our research by using the following inputs:

• Bug Bounty reports from the last 4-5 years.
• Blog posts from pen-testers and security researchers that talk about recent API breaches.
• White papers and documents from companies in the field of API security and next-generation firewalls.
• Reports from advisory firms.
• A lot of feedback and input from software developers, security engineers, and pen-testers from the amazing OWASP community.

Our goal was to create a useful and practical list for engineers who want to learn about API Security, not to write an academic paper. I'm positive that if we spend time reviewing technical books and theoretical documents from universities, we can find more scientific evidence for our hypothesis.

I would be more than happy to see that, but we preferred to invest our time on reviewing more practical inputs and on consulting with many experts in the industry.

I'm sorry I can't provide you with what you asked for, but here are two "non-scientific" resources that shed some light on the "More Parameters" aspect:

1. My Medium article ("Why is it so common in modern applications?" section):  
2. I attached a document I wrote a while ago for internal discussion with Erez (I didn't plan to publish it, so I'm sorry for any grammatical or spelling mistakes :) )

Thanks,

Inon

--
You received this message because you are subscribed to the Google Groups "API Security Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to api-security-pro...@owasp.org.
To view this discussion on the web visit https://groups.google.com/a/owasp.org/d/msgid/api-security-project/843fa706-f6c6-4ab1-a701-875084f4f9bd%40owasp.org.

[Adam Fisher]

Great article Inon.  Thanks for the insight.

Kind regards,
Adam

 
Adam Fisher | Principal Security Engineer |
CISSP, CCSP,  AWS Solutions Architect, MCP - Azure
Ad...@salt.security| o: +1 801-616-9031

---

From: Inon Shkedy <in...@traceable.ai>
Sent: Tuesday, April 28, 2020 9:47 PM
To: Ailton da SIlva dos Santos Filhos
Cc: API Security Project
Subject: Re: [api-security-project] Traditional vs. Modern Web Application

To view this discussion on the web visit https://groups.google.com/a/owasp.org/d/msgid/api-security-project/CANDL1u7ndq-r5aeAX7r8G%3DDMyG8Gg6%3DRC%3DF1e%3DfomsXBF4i%3DsQ%40mail.gmail.com.

[Ailton da SIlva dos Santos Filhos]

Hi Inon,

Thank you for your prompt reply and for the material that you are sharing with us.
I'm pretty sure that it is going to be useful to me and the community.
I'm confident that it's a matter of time to popping up scientific works that address these topics.

And congrats for your, Erez's, and Paulo's hard work in the  OWASP API Security project. It's an important project.

Best regards,

Ailton

--

Att. Ailton da Silva dos Santos Filho

Mestre em Ciência da Computação

Engenheiro da Computação

[P J]

Hey Everyone, 

I am interested in doing a presentation on API security. I am teaming up with my partner APISec and would like to do a demo of how their tool can be used to provide visibility into vulnerabilities for an API. Based on what I am trying to accomplish can you please provide some suggestions on which meetup or group would best work? This tool has the ability to identify RBAC and ABAC vulnerabilities and I think it is really cool. Thanks in advance for your help!

-Peter

To view this discussion on the web visit https://groups.google.com/a/owasp.org/d/msgid/api-security-project/CAL2Mnteb4w7ygcv9DQX3K41oG2Oy0jgJmRB4eLDHONq3LMoxYQ%40mail.gmail.com.

[Adam Fisher]

Peter,

I would suggest you look for your local Bsides security group(http://www.securitybsides.com/).  I just presented on the OWASP API Top 10 in my local virtual BSides conference in SLC in February.  

After that start looking at ISACA and ISSA security chapters.

Kind regards, Adam

Adam Fisher Principal Security Engineer CISSP, CCSP, AWS Solutions Architect

MCA - Azure Ad...@salt.security / +1 (801) 616 9031 https://salt.security

To view this discussion on the web visit https://groups.google.com/a/owasp.org/d/msgid/api-security-project/CAG7PD3nE8O9Pny8p1KFdS-kidgWePqsOnhmnYv%3DxinBvS0UEXg%40mail.gmail.com.

[prjam...@gmail.com]

Thanks Adam. Where can I find your latest talk?

-Peter

On May 4, 2020, at 11:50 PM, Adam Fisher <ad...@salt.security> wrote:



[Adam Fisher]

Hope this helps:  https://www.youtube.com/watch?v=6Nu1UU2ny2I&t=2s  

Kind regards, Adam

Adam Fisher Principal Security Engineer CISSP, CCSP, AWS Solutions Architect MCA - Azure Ad...@salt.security / +1 (801) 616 9031 https://salt.security

[Dmitry Sotnikov]

Local OWASP meetups and DevSecOps events can also be good. Lots of them are now gone online.

Here's my OWASP API Sec Top 10 talk from DevSecOps Days in Austin a few months ago: https://www.youtube.com/watch?v=xAKcE15fxdA

Dmitry

To view this discussion on the web visit https://groups.google.com/a/owasp.org/d/msgid/api-security-project/CADZTyAeNWu6RLakkDosB%2B9MhUSW_ri8a25ifoCBnsQBKHiY9Xg%40mail.gmail.com.

--

Dmitry Sotnikov

Chief Product and Marketing Officer
42Crunch
Cell: +1.949.303.9653, Skype: DSotnikov, Twitter, LinkedIn