StackHawk launches deeper API security test coverage

StackHawk, the company making application security testing part of software delivery, has announced its Deeper API Security Test Coverage release. 

This expands StackHawk's solution to help developers scan the entire API layer to uncover potential vulnerabilities.

"Today's application architectures require different approaches to security testing, and legacy security testing tools result in untested parts of the application, or require tedious manual testing and are too slow for most modern release schedules," the company says. 

"With this release. StackHawk provides developers the ability to test APIs deeper and faster, so organisations can be confident every build they release is secure."

The StackHawk platform empowers engineers to easily find and fix application security bugs at any stage of software development. 

The API layer presents the highest level of security risk for software companies. Yet API discovery can be a challenge for many security teams. StackHawk's Deeper API Security Test Coverage release allows teams to leverage existing automated testing tools, such as Postman or Cypress, to guide discovery of the paths and endpoints, provide custom test data to be used during scans and cover proprietary use cases for security testing.

"Modern API and application security requires tooling that integrates into existing engineering workflows and provides thorough test coverage for today's application architectures," says Scott Gerlach, StackHawk Co-Founder and Chief Security Officer. 

"With our recent release of Deeper API Security Test features, StackHawk continues to lead the market in depth and accuracy of real API security testing, all while remaining true to our developer-first security approach," he says.

Engineering teams have sophisticated automated test suites in CI/CD to ensure that quality is maintained as they push software changes to production, and security testing should be no different. By integrating into existing testing workflows, StackHawk provides developers with security testing in a familiar way, shifting security left.

StackHawk's comprehensive scan functionalities have expanded to address several key issues, including:

Custom Test Data for REST APIs
The ability to use realistic required variables for paths, query, or request body, is something DAST tools historically have struggled with as the use of incorrectly formatted data can prevent the scan from reaching critical logic in the application. 

Custom Scan Discovery
The ability to use test scripts and data from devtools such as Postman or Cypress for guiding the scanner, resulting in a more comprehensive, thorough test without the need for API docs.

Custom Test Scripts
The ability to test for specific use cases like business logic, privacy laws, and sensitive data requires custom scripts. This functionality also addresses the issue of tenancy checks, the top vulnerability in the OWASP Top 10, and testing for Broken Function Level Authorisation, which are test cases not covered with the ZAP library.