StackHawk announced its Deeper API
Security Test Coverage release. This expands StackHawk's solution to help
developers scan the entire API layer to uncover potential vulnerabilities.
Today's application architectures require different approaches to security
testing, and legacy security testing tools result in untested parts of the
application, or require tedious manual testing and are too slow for most modern
release schedules. With this release. StackHawk provides developers the ability
to test APIs deeper and faster, so organizations can be confident every build
they release is secure.
The API layer presents the highest level of
security risk for software companies. Yet API discovery can be a challenge for
many security teams. StackHawk's Deeper API Security Test Coverage release
allows teams to leverage existing automated testing tools, such as Postman or
Cypress, to guide discovery of the paths and endpoints, provide custom test
data to be used during scans and cover proprietary use cases for security
testing.
"Modern API and application security requires
tooling that integrates into existing engineering workflows and provides
thorough test coverage for today's application architectures," said Scott
Gerlach, StackHawk co-founder and chief security officer. "With our recent
release of Deeper API Security Test features, StackHawk continues to lead the
market in depth and accuracy of real API security testing, all while remaining
true to our developer-first security approach."
Engineering teams have sophisticated automated
test suites in CI/CD to ensure that quality is maintained as they push software
changes to production, and security testing should be no different. By
integrating into existing testing workflows, StackHawk provides developers with
security testing in a familiar way, shifting security left.
StackHawk's comprehensive scan functionalities
have expanded to address several key issues, including:
- Custom
Test Data for REST APIs: The ability to use realistic required variables
for paths, query, or request body, is something DAST tools historically
have struggled with as the use of incorrectly formatted data can prevent
the scan from reaching critical logic in the application.
- Custom
Scan Discovery: The ability to use test scripts and data from devtools
such as Postman or Cypress for guiding the scanner, resulting in a more
comprehensive, thorough test without the need for API docs.
- Custom Test Scripts: The ability to test for specific
use cases like business logic, privacy laws, and sensitive data requires
custom scripts. This functionality also addresses the issue of tenancy
checks, the top vulnerability in the OWASP Top 10, and testing for Broken
Function Level Authorization, which are test cases not covered with the
ZAP library.