OWASP API Security Top 10 2023 Dashboard¶

The OWASP API Security Top 10 is a gold standard for the evaluation of security risk in APIs. To help you measure your API's security posture against these API threats, Wallarm offers the dashboard that provides clear visibility and metrics for threat mitigation.

Covering the OWASP API Security Top 10 2023, the dashboard allows you to assess the overall security state and proactively implement security controls to address identified issues.

Threat assessment¶

Wallarm estimates the risk for each API threat based on applied security controls and discovered vulnerabilities:

Red - it happens if there are no security controls applied or your APIs have active high risk vulnerabilities.
Yellow - it happens if security controls are only partially applied or your APIs have active medium or low risk vulnerabilities.
Green indicates that your APIs are protected and do not have open vulnerabilities.

For each OWASP API Top 10 threat you can find detailed info about the threat, available security controls, corresponding vulnerabilities, and investigate related attacks:

Wallarm security controls for OWASP API 2023¶

Wallarm security platform provides full-fledged protection against OWASP API Security Top 10 2023 by the following security controls:

OWASP API Top 10 threat 2023	Wallarm security controls
API1:2023 Broken Object Level Authorization	Automatic BOLA mitigation to automatically create triggers to protect vulnerable endpoints
API2:2023 Broken Authentication	Vulnerability Scanner to discover active vulnerabilities of the corresponding type Brute force trigger to mitigate brute force attacks targeting authentication endpoints
API3:2023 Broken Object Property Level Authorization	Vulnerability Scanner to discover active vulnerabilities of the corresponding type
API4:2023 Unrestricted Resource Consumption	Brute force trigger to mitigate brute force attacks which often lead to DoS, making the API unresponsive or even unavailable
API5:2023 Broken Function Level Authorization	Vulnerability Scanner to discover active vulnerabilities of the corresponding type Forced browsing trigger to mitigate forced browsing attempts that are also a way for this threat exploitation
API6:2023 Unrestricted Access to Sensitive Business Flows	API Abuse Prevention mitigating malicious bot actions
API7:2023 Server Side Request Forgery	Vulnerability Scanner to discover active vulnerabilities of the corresponding type
API8:2023 Security Misconfiguration	Vulnerability Scanner to discover active vulnerabilities of the corresponding type Wallarm node self-checks to keep node versions and security policies up to date (see how to address the issues)
API9:2023 Improper Inventory Management	API Discovery to automatically discover actual API inventory based on real traffic
API10:2023 Unsafe Consumption of APIs	Vulnerability Scanner to discover active vulnerabilities of the corresponding type