Submit support requests and browse self-service resources.
In late August, T-Mobile announced that data for more than two million T-Mobile customers was accessed in a coordinated exploitation of an improperly secured API. While they state that no banking or social security numbers were exposed, the following types of personally identifiable information (PII) were breached: name, billing zip code, phone number, email address, account number, account type (prepaid or postpaid), and/or date of birth.
In 2017, T-Mobile had a similar issue with their "wsg" API, and a video was created showing that very little technical skill was needed to query the API for customer data, as one simply needed to change the phone number parameter of the API to look up the details of any customer. The fact that these vulnerabilities were implemented in production is indicative of a lack of a mature API gateway to enforce policy rules for identity authentication and authorization at the edge of the network in front of the physical API servers and the application and data tier.
This is one of the areas where the Akana API Gateway shines. Leading enterprise customers around the globe in financial services, government, healthcare, and other industries rely on Akana's industry-leading API security to protect their most sensitive applications.
The Common Weakness Enumeration (CWE) Top 25 Vulnerabilities list documents the most common and highest risk errors found in connected systems, and even suggests effective mitigations including:
The CWE Top 25 list is also organized into three categories of vulnerabilities:
Clearly the T-Mobile APIs that were breached had issues with Porous Defenses and Insecure Interaction Between Components.
Related blog >>OWASP Top 10 API Risks
Our recent whitepaper, Securing the Edge API and the Microservices Mesh, suggests additional ways to leverage a mature API Gateway platform to implement ways to deny anonymous API requests, require Mutual TLS protocol layer trust domains, authenticate and authorize all API requests especially from public cloud networks, and mediate and filter request parameters for potentially malicious content such as the number one CWE vulnerability that results in a data breach: SQL injection.
Click below to sign up for a free 30-day trial of the Akana API management platform.
API Security & Integration Architecture, Akana
Ryan Bagnulo has implemented API integration and security and privacy solutions for hundreds of global transactional systems over the past 2 decades, with deep technical experience in investment banking high performance grid computing as well as connected electronic medical devices and international regulatory compliance. Ryan was the first chief security officer and the head of Solution Architecture for Joyent, a container focused cloud IaaS startup in 2010, and has worked with a number of Silicon Valley startups on cloud API IoT and Microservices innovations.