Automatically discover and secure your APIs with Wiz Dynamic Scanner

Wiz enhances its Dynamic Scanner to detect publicly exposed, unauthenticated APIs

5 minutes read

The adoption of APIs has become exponential as businesses race to join the API economy. Today, developers can deploy APIs on an hourly or daily basis in a fully automated way on the different clouds they use. 

This paradigm shift comes with its own set of new risks, as researched by The OWASP Foundation, as errors can be made in the rush to publish these APIs, including: 

  • Library versions used that contain known vulnerabilities 

  • Bad configurations that impact API security 

  • Excessive data exposure 

  • Broken authentication 

  • Improper asset management 

  • and more 

APIs play a central role in enabling communication and data exchange between different applications and services. They act as the gatekeepers to an organization's valuable assets, such as customer data, financial information, and intellectual property. It is critical to monitor and secure them against potential threats and vulnerabilities with the same proactive approach as your cloud workloads in order to: 

  1. Prevent data breaches: APIs are often the entry point for attackers looking to gain access to an organization's sensitive data. By securing APIs, organizations can prevent unauthorized access and protect against data breaches. This is particularly important in the case of regulated industries, such as finance and healthcare, where data breaches can result in significant legal and financial repercussions. 

  2. Protect intellectual property: APIs can also be used to access an organization's intellectual property, such as proprietary algorithms and business processes. By securing APIs, organizations can protect their intellectual property from being stolen or copied by competitors. 

  3. Ensure regulatory compliance: Many industries, such as finance and healthcare, are subject to strict regulations regarding the handling and protection of sensitive data. By securing APIs, organizations can ensure that they are compliant with these regulations and avoid potential fines and legal penalties. 

  4. Enhance customer trust: In the digital age, customers are increasingly concerned about their privacy and the security of their personal data. By securing APIs, organizations can demonstrate their commitment to protecting customer data and enhance trust with their customers. 

The challenges of securing shadow APIs

API security is essential for organizations looking to protect their valuable assets and maintain the integrity and confidentiality of their data and systems. However, existing solutions fall short in catching shadow APIs, as they are mostly based on 

  • Agents  

  • Network scanners (in band or out of band) 

These technologies are often based on two approaches such as the Web Application Firewall or API Gateway. In both cases, it is very complicated to get complete visibility because either an agent must be deployed or the flows must go through the API Gateway. This leaves security teams with blind spots on what APIs actually exist and prevents the application of good security practices. 

Wiz brings an agentless, contextual approach

Wiz brings a different approach to API security with its agentless scanning for all major cloud providers and deep cloud risk assessment. This approach gives customers complete visibility of its cloud environments in minutes. Wiz then analyzes all the layers of the cloud (configuration, network, identity) and what is running on workloads to uncover toxic combinations of risk that create attack paths into your cloud. This allows customers to identify all resources exposed to the Internet, including APIs, and to understand the potential blast radius exploiting other risks such as malware, vulnerabilities, misconfiguration, IAM configuration allowing lateral movement, or sensitive data exposure to ensure the most effective prioritization and response.  

With Wiz, customers can now simply answer the question of where do I have exposed APIs in my environment with all the context associated with the API execution environment. 

Wiz Security Graph shows a complete overview of all your APIs with full context

Secure your APIs in 5 easy steps with Wiz

1. Wiz continuously discovers APIs in the Wiz Inventory 

Wiz, via its API connectors and without agents, scans all the assets of the cloud in order to discover and inventory all the technologies used, whether it is OS, databases, code libraries, and more.  

You gain full visibility into both managed and unmanaged APIs, allowing cloud and security teams to quickly identify what is at risk and who owns it.

Wiz inventory of all APIs that are detected and effectively exposed to internet

2. Wiz analyzes and validates externally exposed APIs using the Dynamic Scanner 

You can take it a step further with the Dynamic Scanner to answer simple questions like: Is my API actually exposed to the Internet? If so, what information will an attacker find? 

Wiz automatically and dynamically scans from the outside to give you an attacker’s perspective. It will analyze and validate ports and protocols (HTTP, FTP, and more), give information on the status of the port (opened or closed), and show the HTTP status and status code.  

Dynamic scanner shows insights on port status, HTTP status, and more

3. Detect unauthenticated APIs that expose secrets or sensitive data 

Next, detect secrets and sensitive data that are sent back by the HTTP request, allowing security teams to quickly identify the resources at risk.  You will be able to proactively correct these problems and prevent malicious actors from gaining a foothold in your infrastructure, moving laterally within it, or gaining access to sensitive information. 

Wiz Security Graph showing two APIs are effectively exposed to the internet with exposed secrets

In this example, as you can see from the screenshot taken by Dynamic Scanner during its analysis. This is a high-priority issue to remedy because a secret is publicly exposed and can compromise your cloud environment. 

Dynamic Scanner provides a screenshot of the attacker’s view of an exposed secret

And that's not all, Wiz will also be able to warn you if the Dynamic Scanner detects data exposure when analyzing HTTP responses. 

An AWS Lambda is effectively exposed to the internet and exposes sensitive data

4. Proactively reduce the attack surface using the full context of your APIs 

Wiz with the Dynamic Scanner allows you to have a complete view of the security posture of your APIs, with the rich context of the cloud environment, including: 

  • What resource is it hosted on? 

  • Does the container, virtual machine, or serverless function have known vulnerabilities? 

  • Is it possible to make lateral movements if this API is compromised? 

By analyzing all possible attack vectors, you have a complete view of all your risks and what it means if actions are not taken. 

In this example, we can see that the API is hosted by a function that itself stores a secret that allows lateral movement via the use of an IAM user with high privileges. 

An AWS Lambda is exposing an API to the internet and also stores a secret that allows lateral movement

5. Automate alerts when non-compliant APIs are detected 

Finally, Wiz comes with out-of-the-box controls that will trigger automated alerts and remediation workflows as soon as an API that violates your policies is detected. You can also create custom controls to ensure policies specific to your organization or business units are enforced. 

Automatically surface and prioritize issues related to unauthenticated APIs

Start securing your APIs today  

The detection of exposed and unauthenticated APIs is an addition to the many capabilities of the Dynamic Scanner and is available today for Wiz Advanced customers. If you would like to learn more, please consult the Wiz documentation (login required). If you prefer a live demo, we would love to connect with you. 

Tags:
#Product

Secure everything you build and run in the cloud

Organizations of all sizes and industries use Wiz to rapidly identify and remove the most critical risks in AWS, Azure, GCP, OCI, and Kubernetes so they can build faster and more securely.

Continue reading

Wiz introduces Dangling Domain Detection to help you prevent subdomain takeovers

Easily detect dangling domains to reduce the risk of phishing campaigns and cookie harvesting of organization’s customers.

Wiz enhances dynamic scanner to analyze and validate external exposure

Wiz extends its cloud analysis with an external scanner, giving customers an attacker's view of their externally exposed resources to reduce noise.

Use cases for Delegated Administrator for AWS Organizations

Learn about how AWS's recently released Delegated Administrator for AWS Organization can be used to solve common problems at your company and the issues you might run into with it.