Improper inventory management

As explained in Secure APIs

Improper inventory management is a vulnerability caused by insufficient tracking and lifecycle control of API versions, endpoints, environments, and documentation.

Improper inventory management occurs when API versions, endpoints, environments, or documentation are not tracked and controlled throughout their lifecycle. Gaps create API sprawl, obscure the attack surface, and leave forgotten assets exposed. section 5.6

A forgotten API version

An organization releases v2, announces v1's retirement, and then forgets to deprovision v1. The old version can be redeployed or re-exposed, becoming a zombie API. Undocumented endpoints can similarly become shadow APIs with weak protection, sensitive data exposure, or poor monitoring. section 5.6

Reduce the risk by:

• Using Deprecation and Sunset headers, optionally linking to a deprecation policy. section 5.6
• Automating retirement with API versioning tools or gateways. section 5.6
• Restricting traffic to documented endpoints and continuously monitoring traffic for undocumented attack surface. section 5.9

Figure 5.7 To upgrade our API version, we release the new version and set the sunset deprecation header in the old version. When the date is due, we retire the old version.

Follow the release, deprecation, and retirement sequence for an API version. section 5.6

How Secure APIs covers it

How deep it goes

Describes version retirement, deprecation headers, gateways, shadow APIs, and monitoring, but does not detail implementation code.

Examples

Uses a v1-to-v2 release sequence, Deprecation and Sunset headers, and undocumented sensitive endpoints.

What you can do after

Operate/configure API inventories with explicit deprecation, retirement, endpoint restriction, and traffic-monitoring practices.

How it connects

Connects API versioning, API gateways, API documentation, shadow APIs, zombie APIs, firewalls, and attack-surface monitoring.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

• api inventoryaddressed by · An API inventory is a maintained catalog of an organization’s APIs and their relevant operational, access, versioning, and lifecycle metadata.
• versioningaddressed by · The practice of identifying and managing successive revisions of files, data, models, interfaces, or other artifacts so changes can be tracked and earlier states recovered.
• authenticationaddressed by · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
• API documentationaddressed by · API documentation is written or generated material describing an application programming interface’s capabilities, operations, inputs, outputs, behavior, and usage.
• firewalladdressed by · A firewall is a network security system that monitors and filters communications according to rules governing which traffic is permitted or blocked.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.