Issue 269: API Security Guidelines, Mastering OpenAPI, Security Flaws in Shopware and Zabbix APIs
Brief
This week, the UK’s NCSC released detailed API security guidelines. Lorna Mitchell offers practical strategies for managing large OpenAPI files. Pieter Danhieux advocates for developer-focused security training in Australia. We also share best practices to secure your Postman collections and cover recent API vulnerability incidents at Zabbix and Shopware.
Article: UKs NCSC promotes secure API development
The UK’s National Cyber Security Centre (NCSC) has published a detailed set of guidelines for the secure development of HTTP-based APIs.
The guidance covers key areas including API design and threat modeling, documentation and asset management, and also secure development and testing practices.
A key recommendation is the use of standardized API specifications, notably OpenAPI, to fully document and describe APIs.