January 2022 Summaries

The OWASP API Security Top Ten, a key initiative by the international non-profit OWASP, aims to highlight the most significant risks to web applications, focusing particularly on APIs. The 2019 list identifies "Broken Object Level Authorization" as the top vulnerability, where unauthorized access to sensitive data can occur due to insufficient authorization checks in RESTful APIs. This issue arises when APIs, unlike monolithic applications, lack native session management, making it easier for malicious actors to manipulate parameters and access restricted data. To mitigate this risk, it is recommended to implement robust authorization mechanisms that verify user permissions for every action, use random and unpredictable IDs to prevent unauthorized access, and conduct rigorous testing to ensure these security measures are effective. The blog series plans to expand on each listed vulnerability, with the next topic being "Broken User Authentication."

Lockfiles play a crucial role in enhancing supply chain security by specifying exact dependency versions and content, thereby reducing the risk associated with trusting external code from numerous developers. They provide a deterministic and reproducible build environment, which is essential for identifying and responding to vulnerabilities or malicious packages. While lockfiles can create friction by limiting automatic updates, modern package managers offer tools to update them easily, ensuring security without sacrificing flexibility. Despite some arguments against their use, such as being stuck on outdated versions or not providing benefits if the original source code is not read, lockfiles complement dependency verification and are supported by many package managers, although not all have full features like content-hash locking. Implementing lockfiles involves creating them, checking them into source control, and ensuring that installations enforce their use, thereby guaranteeing that the same code is consistently used across different environments.