Detect suspicious API and third-party behavior
Detect API misuse and abuse by third parties that traditional monitoring solutions miss.
Book a Demo
Business apps are highly interconnected
Today’s modern IT infrastructure extends far beyond a traditional security perimeter. Many critical business application processes rely on third-party platform integrations, and API-based interconnection with ecosystem partners is more common than ever. As a result, some of the biggest – and most difficult to manage – security and compliance risks are now found at third-party touchpoints.
Unauthorized
Access
Threat actors increasingly seek out API vulnerabilities and misconfigured platform integrations as a way to circumvent primary security controls.
Data
Leakage
While business collaboration often requires data sharing, unauthorized access and data scraping can escalate into a major data breach.
Compliance
Exposure
Partner access or interconnection can complicate efforts to demonstrate compliance with key government and industry regulations.
Insider
Threats
Third-party personnel may intentionally or unintentionally abuse their privileges, steal sensitive data, or engage in other malicious activities.
Monitoring API usage by third-parties is essential
Governing access to your sensitive applications and data with sound identity and access management (IAM) capabilities is a well-established best practice. But preventative identity security measures alone are not enough. Implicitly trusting all authenticated third-party and machine identities creates critical weaknesses for threat actors to exploit, including:
API Vulnerabilities
Many API implementations have hidden vulnerabilities, ranging from over-privileged account usage to security flaws in how the API is implemented and configured. And the high-volume and programmatic nature of API activity makes it easy for threat actors to blend abuse in with legitimate API usage.
Misconfigured User Privileges
When you use third-party platforms to support critical business processes, small configuration errors can introduce major risks to your business. For example, one small privilege management error can give third parties unauthorized access to your sensitive data – and data your partners and customers are counting on you to protect.
API Vulnerabilities
Many API implementations have hidden vulnerabilities, ranging from over-privileged account usage to security flaws in how the API is implemented and configured. And the high-volume and programmatic nature of API activity makes it easy for threat actors to blend abuse in with legitimate API usage.
Misconfigured User Privileges
When you use third-party platforms to support critical business processes, small configuration errors can introduce major risks to your business. For example, one small privilege management error can give third parties unauthorized access to your sensitive data – and data your partners and customers are counting on you to protect.
It’s impossible to anticipate every way that third-party access or dependencies may be abused by an insider or exploited by an external threat actor. The only way to mitigate these risks effectively is by monitoring API and third-party behavior in applications and detecting anomalies that indicate abuse or other malicious activity.
Identity Journey Analytics™ detects anomalous API usage by third-parties
The Reveal Security platform uses a patented technique called Identity Journey Analytics™ to learn the typical journeys of third-party identities with native or API access to your applications.
Identity Journey Analytics harnesses unsupervised machine learning to analyze the journeys that these identities take after login and learn their typical usage patterns.
When insider abuse or attempts to exploit weaknesses in third-party platform integrations and APIs occurs, Reveal Security detects these anomalies quickly and accurately, engages your incident response process, and empowers your team with detailed information and actionable guidance.
Reveal Security integrates with your full array of business applications, including widely used software-as-a-service (SaaS) platforms and API-based communication. The platform turns disparate log events into a journey that is analyzed holistically to accurately detect anomalies.
Detect and stop third-party API abuse
APIs often provide access to sensitive business processes and data. When they’re used in a compliant manner they fuel innovation. But it’s often difficult to anticipate how APIs can be used in unintended ways that can cause harm to your business.
In fact, OWASP (Open Web Application Security Project) identifies broken access control as a top concern related to API usage. This can result in a wider attack surface, unauthorized access to sensitive data and access to other users’ resources and administrative functions.
Reveal Security detects API abuse and misuse, so you can respond quickly to correct API misconfigurations and loose access control policies and strengthen your security controls.
OWASP Top 10 API Risks
| Risk | Description |
|---|---|
| API1:2023 - Broken Object Level Authorization | APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues. Object level authorization checks should be considered in every function that accesses a data source using an ID from the user. |
| API2:2023 - Broken Authentication | Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user's identities temporarily or permanently. Compromising a system's ability to identify the client/user, compromises API security overall. |
| API3:2023 - Broken Object Property Level Authorization | This category combines API3:2019 Excessive Data Exposure and API6:2019 - Mass Assignment, focusing on the root cause: the lack of or improper authorization validation at the object property level. This leads to information exposure or manipulation by unauthorized parties. |
| API4:2023 - Unrestricted Resource Consumption | Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request. Successful attacks can lead to Denial of Service or an increase of operational costs. |
| API5:2023 - Broken Function Level Authorization | Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws. By exploiting these issues, attackers can gain access to other users’ resources and/or administrative functions. |
| API6:2023 - Unrestricted Access to Sensitive Business Flows | APIs vulnerable to this risk expose a business flow - such as buying a ticket, or posting a comment - without compensating for how the functionality could harm the business if used excessively in an automated manner. This doesn't necessarily come from implementation bugs. |
| API7:2023 - Server Side Request Forgery | Server-Side Request Forgery (SSRF) flaws can occur when an API is fetching a remote resource without validating the user-supplied URI. This enables an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN. |
| API8:2023 - Security Misconfiguration | APIs and the systems supporting them typically contain complex configurations, meant to make the APIs more customizable. Software and DevOps engineers can miss these configurations, or don't follow security best practices when it comes to configuration, opening the door for different types of attacks. |
| API9:2023 - Improper Inventory Management | APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. A proper inventory of hosts and deployed API versions also are important to mitigate issues such as deprecated API versions and exposed debug endpoints. |
| API10:2023 - Unsafe Consumption of APIs | Developers tend to trust data received from third-party APIs more than user input, and so tend to adopt weaker security standards. In order to compromise APIs, attackers go after integrated third-party services instead of trying to compromise the target API directly. |
Detect misconfigured privileges in third-party integrations
When you rely on third-party SaaS applications like customer relationship management (CRM) and IT service management (ITSM) platforms to power key business processes, it’s critical to verify that identities are governed by the appropriate access controls and privileges.
Reveal Security identifies abnormal user journeys that do not align with normal behavior, so you can quickly identify and resolve gaps or misconfigurations in your security controls.
Engage with third-party identities, integrations, and services confidently
The Reveal Security platform helps you harness the business value of third-party relationships while tightly managing your security and compliance risk.
Detect third-party
threats quickly
Catch abnormal third-party activity within hours, so you can respond quickly with corrective measures.
Be prepared for the unexpected
Uncover third-party risks that would be difficult-to-impossible to anticipate and detect with rule-based detection.
Optimize team focus
and efficiency
Minimize false positive alerts and give responders the insights and guidance they need to act quickly.