This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP API Security Project"

From OWASP
Jump to: navigation, search
m
(Description)
Line 15: Line 15:
 
==Description==
 
==Description==
  
<!-- Instructions are in RED and should be removed from your document by deleting the text with the span tags.-->
+
While working as developers or information security consulting, many people have encountered APIs as part of a project. While there are some resources to help create and evaluate these projects (such as the OWASP REST Security Cheat Sheet), there has not be a comprehensive security project designed to assist builders, breakers, and defenders in the community.
<span style="color:#ff0000">
 
This section must include a shorter description of what the project is, why the project was started, and what security issue is being helped by the project deliverable. This description will be used to promote the project so make sure the description represents your project in the best way possible.  
 
</span>
 
  
By helping developers create verifiably secure APIs, and helping security assessors understand the subtle risks an API may entail, the goal of this project is to bring security to an increasingly programmatic world.
+
This project aims to create:
  
'''Although this is a sample template, the project is real! [http://owasp.github.io/Security-Principles Please contribute to this project.]
+
* The OWASP Top Ten API Security Risks document, which can easily underscore the most common risks in the area.
'''
+
* Create a documentation portal for developers to build APIs in a secure manner.
 
+
* Work with the security community to maintain living documents that evolve with security trends.
Over the course of my career, I have come across and collected a number of security ''aphorisms.'' These aphorisms constitute the fundamental principles of information security.
 
 
 
None of the ideas or truths are mine, and unfortunately, I did not collect the citations. Initially, I would like to identify the correct citations for each aphorism.
 
 
 
Additionally, many are re-statements of the same idea; thus, the 'collection of ideas' defines a fundamental principle. As such, I would also like to reverse engineer the principles from the aphorisms where appropriate, as well.
 
  
 
==Licensing==
 
==Licensing==

Revision as of 17:53, 20 October 2015

OWASP Project Header.jpg

OWASP API Security Project

This project seeks to address the ever-increasing number of organizations that are deploying potentially sensitive APIs as part of their software offerings. These APIs are used for internal tasks and to interface with third parties. Unfortunately, many APIs do not undergo the rigorous security testing that would render them secure from attack.

The OWASP API Security Project seeks to provide value to software developers and security assessors by underscoring the potential risks in insecure APIs and illustrating how these risks may be mitigated. In order to facilitate this goal, the OWASP API Security Project will create and maintain a Top 10 API Security Risks document, as well as a documentation portal for best practices when creating or assessing APIs.

Description

While working as developers or information security consulting, many people have encountered APIs as part of a project. While there are some resources to help create and evaluate these projects (such as the OWASP REST Security Cheat Sheet), there has not be a comprehensive security project designed to assist builders, breakers, and defenders in the community.

This project aims to create:

  • The OWASP Top Ten API Security Risks document, which can easily underscore the most common risks in the area.
  • Create a documentation portal for developers to build APIs in a secure manner.
  • Work with the security community to maintain living documents that evolve with security trends.

Licensing

The OWASP API Security Project documents are free to use!

The OWASP API Security Project is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

What is the OWASP API Security Project?

The OWASP API Security Project seeks to deliver actionable documentation on creating and deploying verifiably secure web APIs, as well as illustrating the major risks and shortfalls that APIs may encounter. By helping developers create resilient software, and helping assessors understand the subtle risks an API may entail, the goal of this project is to bring security to an increasingly programmatic world.

Presentation

The OWASP API Security Project will be presented in 2016.

Project Leader

Related Projects

Quick Download

Once API Security documents are created, they will be available for direct download here.

News and Events

There has not yet been press coverage of this project.

In Print

There are no current print materials for this project.

Classifications

New projects.png Owasp-builders-small.png
Owasp-breakers-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg