How to find out if your AI vendor is a security risk https://www.helpnetsecurity.com/2025/04/10/ai-vendor-risk/ #Artificialintelligence #Expertanalysis #VorlonSecurity #cybersecurity #Expertcorner #APIsecurity #Don'tmiss #Hotstuff #dataleak #opinion #News #risk

"API keys are foundational elements for authentication, but relying solely on them is inherently a risky proposal.

Firstly, there’s the reality that API keys are not securely designed — they were never meant to be used as the sole form of authentication, and as such, they aren’t really built for the task. These keys can often be easily stolen, leaked, or, in some cases (especially if generated incrementally), outright guessed. An API key is suitable for tracking usage but is poor for security.

There is also the additional reality that keys in their default state lack some critical functionality. There’s not a lot of verification built-in for identity management, and what does exist offers very little in the way of granular access control.

Ultimately, solely relying on API keys is a mistake common with novice developers but frighteningly common even in advanced products.

Best Practices
Instead of relying heavily on API keys as a sole mechanism, combine those keys with additional approaches such as OAuth 2.0 or mTLS. Implement rigorous expiration and rotation policies to ensure that keys which are made public are only useful for a short amount of time. Consider more advanced approaches, such as IP whitelisting or device fingerprinting, to add another layer of security atop the API key process."

https://nordicapis.com/9-signs-youre-doing-api-security-wrong/

#APIs act as digital portals that allow data to travel between applications. However, as sensitive data moves from one application to another, each API becomes a potential access point that threat actors can exploit.

Securing APIs is critical to any company's data protection program, and knowing the OWASP API security top 10 will help!

Read on an learn about:
Who OWASP is
The 10 most critical API security risks based on several data points
The OWASP top 10 API security risks

https://graylog.org/post/an-introduction-to-the-owasp-api-security-top-10/ #cybersecurity #infosec #APIsecurity #GraylogLabs

How Contrast ADR Speeds up SOC Incident Response Time| SOC Challenges From Alert Fatigue to Application-Layer Visibility | Contrast Security – Source: securityboulevard.com https://ciso2ciso.com/how-contrast-adr-speeds-up-soc-incident-response-time-soc-challenges-from-alert-fatigue-to-application-layer-visibility-contrast-security-source-securityboulevard-com/ #ApplicationDetectionandResponse(ADR) #SecurityOperationsCenter(SOC) #applicationvulnerabilities #ApplicationLayerSecurity #APIsecurity

Did someone say FREE training? Welcome to #Graylog Academy! We are excited to give you the tools to gain immediate value, unlock #security analytics, and begin data driven decision-making as you embark upon (or continue) your journey with Graylog.

Check out the awesome selection of FREE courses you can take, including:
Adding Context and Enriching Your Log Data
Events, Alerts, and Notifications
Hardening Graylog with TLS
Intro to API Security
Introduction to Graylog Dashboards
Pipelines, Parsing and the Graylog Information Model

Did we mention that many of the courses are What are you waiting for! Let's go.

https://academy.graylog.org/home #APIsecurity #SIEM #logmanagement #cybersecurity #infosec

It was a packed house for the Graylog #BSidesROC Capture The Flag on Saturday! Thank you to everyone who joined us for the fun and games. You are all amazing and, now, a little (or a lot!) more knowledgable about #Graylog! It's a win-win.

And congrats to our challenge winners!
Grand prize winner — Tyler Smith
Training voucher winner — Praveen Kumar Penukonda
Runner up — Gabriel Schickling

HIPAA Security Rule Amendment: Key Public Comments and Next Steps – Source: securityboulevard.com https://ciso2ciso.com/hipaa-security-rule-amendment-key-public-comments-and-next-steps-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #APISecurityAnalysis #CyberSecurityNews #mobileappsecurity #SecurityBoulevard #NewsandInsights #MobileHealth #APIsecurity #healthcare

Threat actors are increasingly using cloud services to identify the data they intend to exfiltrate or ransom. Cloud native development, containers, and microservices allow dev teams to quickly deploy new builds. But, they also lead to a higher potential for misconfiguration. And where there are misconfigurations there are vulnerabilities that leave openings for threat actors.

So, what can #security teams do about this? They can shine a spotlight on what’s in their #API traffic! Once you know how #cybercriminals are accessing sensitive data, you can stop them from gaining access to it.

Critical security steps need to happen before data exfiltration does. Learn more about predicting risk and closing your vulnerability gap, in this article by #Graylog's Seth Goldhammer.

https://securityboulevard.com/2025/03/reading-the-data-breach-tea-leaves-preventing-data-exfiltration-before-it-happens/ #cybersecurity #APIsecurity #infosec

APIs often handle vast amounts of Personally Identifiable Information (#PII), which makes them prime targets for API data exfiltration. So, it's no surprise that #API-based attacks with the aim of stealing sensitive data have increased over time. Many orgs also lack visibility into which APIs are handling PII, which leaves them with massive #security blind spots.

What should orgs do about this? Let's take a closer look at:
The growing risks of PII exposure in API traffic
The methods attackers use to exfiltrate data
Capabilities to look for in a data exfiltration prevention solution
How the new release of Graylog API Security 3.7 can help

https://graylog.org/post/apis-the-silent-highway-for-sensitive-data/ #APIsecurity #APIs #cybersecurity

Wallarm Releases 2025 API ThreatStats Report, Revealing that APIs are the Predominant Attack Surface

https://buff.ly/4aEd2fo

"Wallarm's researchers tracked 439 AI-related CVEs, a staggering 1,025% increase from the prior year. Nearly all (99%) were directly tied to APIs, including injection flaws, misconfigurations, and new memory corruption vulnerabilities stemming from AI's reliance on high-performance binary APIs."

We're going to apidays NYC, woot! Join us at the conference to learn about #API management for surfing the next innovation waves. Our VP of Engineering, Rob Dickinson, will be speaking at the event, as well.

Got questions about #APIsecurity, #SIEM and/or log management? See us in NYC on May 14th and 15th, 2025 to get all of your burning questions answered. Or just to hang out and pick up some Graylog swag!

https://www.apidays.global/new-york/ #apidays #apidaysNewYork #apidaysNY #Graylog #APIs

Node.js Security in 2025: Best Practices and Threat Mitigation

https://bloggingaadd.com/nodejs-security-in-2025-best-practices-and-threat-mitigation

Learn the best Node.js security practices for 2025 to protect your applications from evolving threats. Explore key strategies for threat mitigation, data protection, and secure coding.

#NodeJS
#CyberSecurity
#WebSecurity
#SecureCoding
#BackendDevelopment
#APISecurity
#TechTrends2025
#DataProtection
#SoftwareSecurity
#JavaScript
#SecureApps
#ThreatMitigation

China-Linked Silk Typhoon Expands Cyber Attacks to IT Supply Chains

The Silk Typhoon hacking group, linked to China and previously behind Microsoft Exchange zero-day attacks, is now targeting IT supply chains, abusing stolen API keys, remote management tools, and cloud applications to infiltrate corporate networks.

The group is exploiting stolen API keys and credentials from IT service providers, launching zero-day attacks on Ivanti VPN, Palo Alto Networks, and Citrix NetScaler, and shifting from on-prem environments to cloud applications like Microsoft 365, OneDrive, and SharePoint to exfiltrate data.

Organizations must strengthen API security, enforce least privilege access, and monitor cloud environments to mitigate these growing supply chain threats.

Read more: https://thehackernews.com/2025/03/china-linked-silk-typhoon-expands-cyber.html

ADR Report | Application Detection and Response Trends | Contrast Labs – Source: securityboulevard.com https://ciso2ciso.com/adr-report-application-detection-and-response-trends-contrast-labs-source-securityboulevard-com/ #ApplicationDetectionandResponse(ADR) #rssfeedpostgeneratorecho #SecurityBloggersNetwork #crosssitescripting #CyberSecurityNews #Perimeterdefenses #SecurityBoulevard #.netapplication #methodtampering #cyberattacks #SQLinjection #APIsecurity #attacks #.NET #XSS

So what does make APIs special and different? #apisecurity #apihacking #apis #pentesting

1) Interconnectedness, even if you're sure you don't have APIs, I bet your suppliers do
2) Large attack surfaces that are poorly documented, they balloon into hundreds of endpoints quickly

The biggest mistake I see in API security will probably surprise you... Whether in offensive security or defending APIs, most teams make one fundamental mistake that leaves their APIs vulnerable, they forget that APIs are web applications.
#apisecurity #apihacking #apis

"APIs are fundamentally dark and challenging to monitor, making it hard for organizations to detect exposures and exploits," says #Graylog's VP of Engineering Rob Dickinson. In this ITPro Today article, Rob explains more about:

Inherent API challenges
The evolution of API attacks and the role of AI and automation
What you need to know about API data exfiltration targeting personal identifiable information
Deterring sophisticated API data exfiltration attacks

API security incidents were at an all time high in 2024. And as we move further into the era of #cyberattacks driven by #AI and automation, security teams need to continue to have an effective strategy that emphasizes monitoring firewalls, gateways, and individual requests but also works towards the detection of API data exfiltration. Learn more.

https://www.itprotoday.com/vulnerabilities-threats/how-to-approach-api-security-amid-increasing-automated-attack-sophistication #cybersecurity #APIsecurity #PII

Stay Relaxed with Top-Notch API Security – Source: securityboulevard.com https://ciso2ciso.com/stay-relaxed-with-top-notch-api-security-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #CloudSecurity #Cybersecurity #APIsecurity

AI Security is API Security: What CISOs and CIOs Need to Know – Source: securityboulevard.com https://ciso2ciso.com/ai-security-is-api-security-what-cisos-and-cios-need-to-know-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #APIsecurity

The API security crisis and why businesses are at risk https://www.helpnetsecurity.com/2025/02/05/the-api-security-crisis-and-why-businesses-are-at-risk/ #artificialintelligence #cybersecurity #APIsecurity #Don'tmiss #Hotstuff #Wallarm #Video #video