Incepta’s API Security Assessment

This success story showcases how we partnered with a Canadian fintech company to enhance its API security posture through a comprehensive API Security Assessment. Faced with increasing risks related to cyber threats and data breaches, the client sought our expertise to identify vulnerabilities in their external-facing APIs and implement a robust security framework to protect sensitive data.

The objective of this engagement was to address the following –

1. Minimize risk of external facing APIs
2. Minimize the risk of sensitive data extraction
3. Protect APIs and critical assets from cyber attacks
4. Enrich current tools and workflows with API-centric data and alerts
5. Develop, protect, and enhance revenue streams and client relationships

Incepta was engaged to assess the current state of the client’s

Our client is a Canadian fintech company that specializes in sales financing and payment solutions. With over 10+ years in business, they provide fast and flexible financing solutions, aiming to be the leading provider of point-of-sale financing in Canada.

Industry: FinTech

The client is in the finance industry where data security is paramount. Our client was unsure if they have proper security measures in place, how many APIs they have, how many are external facing, and which ones might be an easy target for the hackers. Enlisted are challenges that made securing their APIs tough:

• Poor visibility into the API landscape
• Data Loss Prevention measures were not in place
• API Gateways and WAFs are only covering rigid policies
• API Security is unfamiliar territory – need to build playbooks and best practices

Incepta’s API security assessment provides a comprehensive view of traffic, code, and configurations to assess the organization’s API security posture.

The proposed API security solution comprises-:

• API Security Testing – Adopt developer-centric API security testing for early, frequent and robust API testing.
• Posture management – Continuous and context-aware API security risk management – API asset inventory, change detection, configuration control, and vulnerability.
• Runtime Protection – Simple, sophisticated protection for APIs and prevention of sensitive data theft, fraud, and misuse from API abuse.

Incepta conducted a complete API security assessment. The findings of the assessment were shared with the client. Some of the sample stats are listed below-

• Number of APIs found – 65
• API Type – REST
• Discovered data types – 15
• Issues found – 33
  • Posture Management Issues – 17
  • Runtime Issues – 16

Incepta suggested security measures to address the issues found and created a desired future state for the client. A sample of the suggested target state architecture is shown below –

Technology Used:

• Splunk
• NOW
• Noname
• MuleSoft Cloud Hub

API Security Assessment Business Outcomes

Incepta API Security assessment provided the consolidated report with detailed feedback, target architecture, and a roadmap to achieve the future target state. The suggested future state would result in:

• Robust defense and protection of customer data
• Enhanced revenue stream due to better customer confidence
• The better reputation of the company in terms of security measures
• Protection of critical assets and APIs from cyber attacks
• Continuous security posture management

API Security Best Practices to follow 

Incepta suggests organizations use security best practices while designing and building APIs such as-

• Hide sensitive data from all logs
• Encrypt sensitive information like passwords in the properties file
• Remove vulnerable components
• Apply security policies over all APIs in the production environment
• Continually enhance the API security posture
• Enrich current tools and workflows with API-centric data and alerts

Proactive Cybersecurity is the need of the hour. It includes everything you do before an attack takes place. If you want to protect your business from the devastating effects of cyber-attacks then talk to our Cybersecurity experts today to ensure API and data security at every stage.

[sidebar name=”Lead generation automation”]