OWASP cautions against “insufficient logging & monitoring.” What does sufficient l...- Rob Dickinson
Channel: OWASP Foundation
Date: 06/01/2022

Speaker
Rob Dickinson
Resurface Labs, Co-Founder and CEO

Description
The OWASP API Security Top 10 defines the most critical API security risks with recommendations on how to prevent them. Number 10 on this list is what OWASP calls “Insufficient Logging and Monitoring.” OWASP states what we all know: “Without logging and monitoring, or with insufficient logging and monitoring, it is almost impossible to track suspicious activities and respond to them in a timely fashion.” The 2020 Ponemon study found that data breaches aren’t discovered for an average of 203 days and that they take an average of 73 days to remediate. Clearly, whatever people have been doing up until now is not sufficient.

Much of API security is focused on design and development – don’t let the bad guys in and they can’t hurt you. But this is where Hyram’s Law plays out: Your APIs will be used in a way that serves the user or abuser. Understanding API use and risk in production is left to Ops teams to decipher and manage. Inevitably, logging and monitoring are overlooked in hectic and busy Ops centers. Even those with general logging and monitoring systems may not be using them in a way that provides sufficient protection for APIs.

We’ll walk through real-world examples (unfortunately, there are many) and five ways to build sufficient logging and monitoring for your APIs. We’ll discuss how to create a chronological record of API calls to provide an independently verifiable trail that permits reconstruction, review and examination to determine the original sequence for auditing, security, and API observability.


Managed by the OWASP® Foundation
https://owasp.org/