Category: Traceable

[By Richard Bird, Chief Security Officer, Traceable]

In the wake of the devastating cyber-attack on Kyivstar, Ukraine’s largest telecommunications service provider, it’s time for a blunt conversation in the boardrooms of global enterprises. As someone who has navigated the cybersecurity landscape for over 30 years, I’ve witnessed numerous security breaches, but the Kyivstar incident is a watershed moment. This isn’t just a breach; it’s a complete obliteration of a company’s internal infrastructure. And it happened to a company that was on high alert, operating in a war zone, and had heavily invested in cybersecurity.

The breach, attributed to the Russian military spy unit Sandworm, didn’t just disrupt services; it decimated Kyivstar’s core, wiping out thousands of virtual servers and causing communications chaos across Ukraine. The attackers demonstrated a frightening capability to exfiltrate a vast amount of personal data, including device location data, SMS messages, and potentially data that could lead to Telegram account takeover. This level of devastation doesn’t happen without exploiting fundamental weaknesses, and it points to a glaring oversight in many current cybersecurity strategies: the underestimation of API vulnerabilities.

Despite Kyivstar’s significant security investments, it’s evident that APIs and Layer 7 were not prioritized. This is a critical mistake that many are making. CEOs and CISOs around the world need to take their heads out of the sand. The Kyivstar breach is a clear demonstration of the catastrophic potential of modern cyber-attacks. It’s no longer about if your defenses will be breached, but when and how devastating it will be. The traditional approach to cybersecurity is no longer sufficient. We need to rethink our strategies, with a particular focus on securing APIs and fortifying every layer of our digital infrastructure.

This is a critical mistake that many are making.

The attack on Kyivstar took out mobile and home internet service for as many as 24 million people, signaling not just a corporate disaster but a national emergency. The financial implications were staggering, with nearly $100 million in revenue loss, underscoring the severe economic repercussions of such breaches. This incident should be a massive wake-up call. We’re not talking about mere data theft or temporary disruptions. The Russians have demonstrated that they can take down an entire company, exploiting the same vulnerabilities that threaten enterprises globally.

In response, hackers linked to Ukraine’s main spy agency breached computer systems at a Moscow-based internet provider, signaling a tit-for-tat in the cyber domain between Russia and Ukraine.

This escalation is not just a regional issue but a global one, serving as a stark warning to the West about the capabilities and intentions of state-sponsored cyber groups like Sandworm.

The Bottom Line

CEOs and CISOs around the world need to take their heads out of the sand. The Kyivstar breach is a clear demonstration of the catastrophic potential of modern cyber-attacks. It’s no longer about if your defenses will be breached, but when and how devastating it will be. The traditional approach to cybersecurity is no longer sufficient. We need to rethink our strategies, with a particular focus on securing APIs and fortifying every layer of our digital infrastructure.

The Kyivstar incident is a stark reminder of the evolving and increasingly destructive nature of cyber threats. As industry leaders, we must recognize this as a turning point and act swiftly to reinforce our defenses. It’s time to move beyond complacency and address the critical vulnerabilities that can lead to the downfall of our enterprises. The message is clear: bolster your cybersecurity or risk severe consequences. The choice is ours.

The post The Kyivstar Breach and Its Implications for Global Cybersecurity appeared first on Cybersecurity Insiders.

By Richard Bird, Chief Security Officer at Traceable

In the ever-evolving landscape of cybersecurity, it’s concerning to witness a persistent rise in breaches. The underlying issue? The consistent sidelining of API security. Despite the transformative role APIs play in modern digital infrastructures, they remain an underestimated component in many security strategies. This oversight isn’t merely a lapse; it’s a gaping vulnerability. Without vigilant monitoring and robust protection, APIs become inviting gateways for adversaries seeking unauthorized access.

In 2022, the digital realm witnessed a stark reminder of this vulnerability. Twitter, rebranded as X, succumbed to an API breach, leading to the exposure of data for 5.4 million users. This incident wasn’t an isolated one. Optus, a prominent telecom entity, encountered a ransomware attack initiated through an API vulnerability. The aftermath of their decision not to pay the ransom was the compromise of data for 10 million individuals, both past and present customers.

As we navigate the latter half of 2023, the horizon remains clouded with challenges. For a brighter, more secure future, it’s imperative that we introspect, drawing insights from past API breaches.

To chart a path forward, we must dissect recent API breaches, identifying critical areas of focus that will fortify businesses against future threats.

JumpCloud

Breach Overview: JumpCloud, an enterprise software company, faced a sophisticated attack from nation-state hackers. These adversaries exploited vulnerabilities to access the system, leading JumpCloud to reset customer API keys as a precautionary measure. The breach raised concerns about the security measures in place, especially when dealing with nation-state actors who possess advanced capabilities.

Lesson: Third-party solution providers can be a significant risk vector, especially when they’re targeted by highly skilled adversaries.

Prevention: It’s crucial to conduct thorough security assessments of third-party vendors and ensure they adhere to stringent security standards. Additionally, monitoring and real-time threat detection can help in early identification of such sophisticated attacks.

T-Mobile

Breach Overview: In January 2023, T-Mobile found itself at the center of a cybersecurity storm, disclosing a data breach that impacted approximately 37 million customers. A malicious actor exploited a specific API, gaining unauthorized access. Alarmingly, this breach came on the heels of a previous incident, despite T-Mobile’s substantial investments in bolstering their cybersecurity defenses. The intruder maintained access for over six weeks, starting from late November 2022, before the breach was detected and addressed.

Lesson: Even with recent security enhancements, organizations can remain vulnerable, especially when they lack comprehensive visibility and control over their API inventory.

Prevention: Organizations should implement continuous API monitoring, adopt zero-trust policies for sensitive data access, and employ advanced threat detection mechanisms that can discern between legitimate and malicious API traffic patterns.

Cisco

Breach Overview: Cisco, a tech giant, identified a critical vulnerability in its SD-WAN vManage software. This vulnerability allowed unauthorized API access, enabling attackers to send crafted API requests, potentially retrieving or manipulating information. The issue was not just about unauthorized access but also the potential manipulation of network configurations.

Lesson: Even industry leaders can have lapses, emphasizing the importance of continuous vigilance.

Prevention: Strict access controls for APIs are essential. Organizations should also invest in automated vulnerability scanning tools and ensure that security patches are applied promptly.

Razer

Breach Overview: Razer, a renowned tech company, faced two significant security incidents. The recent one involved a potential data leak after claims of stolen source code and encryption keys. Previously, in 2020, a misconfiguration by an IT vendor left sensitive data exposed, highlighting the risks associated with third-party integrations.

Lesson: Continuous oversight and third-party integrations can introduce vulnerabilities, making it essential to have a robust security review mechanism.

Prevention: Regular security audits and third-party risk assessments are crucial. All configurations, especially those by external parties, should undergo rigorous security checks.

QuickBlox

Breach Overview: QuickBlox, a platform offering chat and video calling solutions, had critical vulnerabilities in its software development kit and APIs. These vulnerabilities could allow attackers to access and steal personal data of millions of users. The breach underscored the challenges of securing modern software architectures, especially when they are widely used across industries.

Lesson: As software architectures evolve, they can introduce new vulnerabilities if not designed with a security-first mindset.

Prevention: A security-first approach in software development is essential. Regular updates, patches, and security training for developers can help in minimizing such vulnerabilities.

The Bottom Line? Holistic Data Security is Non-Negotiable

APIs are the universal attack vector and demand our undivided attention. Their integral role in bridging various data layers makes them both invaluable and, if overlooked, perilous. A cybersecurity strategy that sidelines API security is akin to building a fortress but leaving the main gate unguarded. As we architect our future security blueprints, it’s essential to adopt a holistic approach, encompassing every facet of our digital infrastructure. And while innovation propels us forward, the wisdom gleaned from past breaches must serve as our guiding beacon, ensuring that history’s pitfalls aren’t repeated.

The post API Breaches Are Rising: To Secure the Future, We Need to Learn from the Past appeared first on Cybersecurity Insiders.

By Holger Schulze, Cybersecurity Insiders

As the proliferation of APIs continues unabated, the importance of robust API security measures cannot be overstated. In a recent interview, Richard Bird, Chief Security Officer at Traceable AI, offered valuable insights into the increasing risks associated with APIs and how companies can defend against these threats.

The Escalating API Security Challenge

In Bird’s view, the rise of APIs, and with them, the security risk exposure, is linked to a number of factors. Firstly, the digital transformation efforts of organizations have led to the widespread adoption of APIs to enable seamless interactions between different software applications. This, coupled with the increasing use of cloud services and microservices architectures, has led to an explosion in the number of APIs in recent years, thereby significantly expanding the attack surface for potential cyber threats. At the same time, APIs have in the past not received the same attention from security teams and product vendors as other aspects of IT environments, leaving APIs vulnerable to innovative attacks.

Types of API Attacks

APIs, by nature, expose application functionality and data, which makes them an enticing target for cyber attackers. Several types of attacks target APIs, including:

  1. Injection Attacks: These occur when an attacker sends malicious data as part of a command or query, tricking the interpreter into executing unintended commands or accessing unauthorized data. SQL Injection is a notable example of this type.
  2. Broken Authentication: APIs that don’t properly enforce authentication can allow attackers to impersonate other users or even gain administrative privileges.
  3. Sensitive Data Exposure: APIs may inadvertently expose sensitive information like personal identifiers, financial information, or security credentials, which can be exploited by attackers.
  4. Security Misconfiguration: Poorly configured security settings for APIs can leave them vulnerable to attackers who can exploit the defaults left in place.
  5. Mass Assignment: APIs that bind client-provided data (like JSON request payloads) directly to data models may inadvertently expose any properties not explicitly listed in a binding exclusion list.
  6. Broken Access Control: APIs must properly validate users’ permissions before granting them access to data. Failure to do so can allow unauthorized access to sensitive data.
  7. Server-Side Request Forgery (SSRF): These attacks trick the server into making requests it didn’t intend to, possibly bypassing access controls and gaining access to internal resources.

Each of these attacks presents a significant threat to APIs and the applications and data behind them, and it’s essential for organizations to use a robust API security solution, like Traceable AI, to protect against these common API vulnerabilities and threat vectors.

The Impact of API Attacks

The consequences of API attacks can be severe. From data breaches to service disruptions, the impact on an organization’s reputation, operations, and bottom line can be significant. As Richard Bird pointedly noted, “When APIs are attacked, it’s not just about data being lost. It’s about trust being eroded, it’s about operations being hindered.”

The Limitations of Traditional Security Tools

Traditional security tools and techniques often fall short in protecting against API attacks, primarily because they were not designed to deal with the unique challenges that APIs present. In many instances, these tools lack the necessary visibility into API-related traffic and cannot adequately track or analyze API behavior. This leaves organizations vulnerable to attacks.

Stopping API Attacks with Traceable AI

In the complex and continuously evolving landscape of API security, solutions like Traceable AI stand out. This platform combines end-to-end distributed tracing, cloud-native integrations, and advanced machine learning-driven behavioral analytics to deliver API and application security from user to code. Furthermore, it offers robust protection capabilities, with automatic detection and blocking of both known and unknown API attacks.

One notable feature of Traceable AI is its dynamic API catalog. This provides automatic and continuous API discovery, giving security teams comprehensive visibility of all APIs, sensitive data, and risk posture, even in rapidly changing environments. Coupled with real-time topology maps showing API flows and interconnectivity between services, businesses are offered accurate insights into actual application usage and infrastructure vulnerabilities.

API Security Testing for Proactive Threat Mitigation

Beyond protection, Traceable AI is designed for proactive threat mitigation. Its API Security Testing (AST) enables businesses to test their APIs against various vulnerabilities and security gaps before deployment in a production environment. This not only helps in prioritizing threats but also aids in building resilient systems.

Navigating the Complexities of API Security

With API attacks becoming increasingly sophisticated, it is paramount for organizations to have a deep understanding of their API environment and the potential vulnerabilities that exist. Traceable AI provides this understanding through a range of features designed to provide in-depth visibility, protection, and testing. As Bird summarized, “Traceable AI is focused on providing customers with the visibility and control they need to manage their APIs effectively and protect their digital assets.”

Best Practices for Robust API Protection

To help organizations strengthen their defenses, here are best practices for enhancing API security, incorporating the effective use of API security platforms such as Traceable.

  • API Security by Design: It is essential to integrate security from the initial stages of API design and development. This includes defining proper authorization and authentication protocols, ensuring data validation, and incorporating the least privilege principle.
  • Inventory APIs: To mitigate the risk of unsecured APIs, it’s essential to have a complete inventory of all the APIs deployed in your organization. This includes knowing what they do, who has access to them, and how they interact with other elements in your system. Automated platforms can assist in this task, offering tools for automatic and continuous API discovery, providing comprehensive visibility into your API landscape.
  • API Monitoring and Anomaly Detection: Use AI-powered tools to monitor API usage continually. These tools can identify unusual patterns and potential threats based on machine learning algorithms. This proactive monitoring is key to preventing attacks before they cause damage.
  • Encryption and Data Protection: Encrypt all data in transit using HTTPS to maintain data confidentiality and integrity. Additionally, validate all data passing through your APIs to prevent injections and data leaks.
  • Regular Security Testing: Conduct regular security testing, including vulnerability assessments and penetration testing. Platforms like Traceable offer API Security Testing (AST) features that can test your APIs against various vulnerabilities and security gaps before deployment.
  • Rate Limiting and DoS Protection: Implement rate limiting to prevent Denial of Service (DoS) attacks or brute force attempts on your APIs. Tools like Traceable also offer DDoS protection by rate-limiting the number of requests to your APIs.
  • Continuous Training and Education: Regularly update your teams on the best practices in API security. It’s essential to stay informed about the latest security risks and how to avoid them. Empower your development and security teams with the knowledge they need to build secure APIs from the ground up.

Conclusion

API security is a complex and evolving challenge that requires a sophisticated and adaptable approach. The insights shared by Richard Bird underline the importance of adopting advanced solutions like Traceable AI that can provide comprehensive visibility, robust protection, and proactive testing capabilities. As the number of APIs continues to grow, so too does the need for effective API security measures. Organizations that take the time and resources to understand and address this risk will be better positioned to protect their operations and maintain the trust of their customers in the digital age.

The post Advancing API Security: An Interview with Richard Bird of Traceable AI appeared first on Cybersecurity Insiders.