Let’s Face It - Criminals are bypassing selfie verification in Know Your Customer processes

Explore how criminals are exploiting selfie verification in Know Your Customer (KYC) processes for neobanks. Learn about the risks, current bypass techniques, and potential solutions for more secure digital identity verification in fintech.

Help, I'm Being Attacked: Why WAFs & Gateways Won't Stop the Next API Attack

Many organizations mistakenly believe that Web Application Firewalls (WAFs) or API gateways provide sufficient protection against API attacks. While these tools offer useful traffic management and basic security features, they fall short when it comes to defending against more sophisticated API threats. WAFs are designed for web applications, not the complex logic and workflows of APIs, leaving them vulnerable to business logic and shadow API attacks. Similarly, API gateways, while helpful for managing API traffic and authentication, often miss critical vulnerabilities. Understanding the limitations of WAFs and gateways is the first step in strengthening your API security strategy.

Navigating the Road to Automotive Security

In today's connected world, automobiles are complex systems driven by APIs, but this brings risks; Traceable ASPEN's latest research highlights urgent automotive security needs by analyzing recent vulnerabilities, including real-time vehicle tracking and data breaches.

Securing Third Party APIs is Critical for Modern Business

Third-party APIs are essential for modern businesses but pose security risks, including data breaches, service disruptions, and regulatory violations. Poorly secured APIs expose organizations to attacks, compliance failures, and reputational damage. Protecting APIs is a business imperative, requiring proactive security measures to safeguard sensitive data and maintain service stability.

Recent Posts

Help, I'm Being Attacked: Why WAFs & Gateways Won't Stop the Next API Attack

Let’s Face It - Criminals are bypassing selfie verification in Know Your Customer processes

API Security: The Unseen Risk Threatening Australian Businesses

Why "Check-the-Box” Solutions Are Insufficient for API Security

Securing Third Party APIs is Critical for Modern Business

Securing Generative AI-Enabled Applications: Crawl - Walk - Run Strategy for Product Security

API Security

Help, I'm Being Attacked: Why WAFs & Gateways Won't Stop the Next API Attack

Many organizations mistakenly believe that Web Application Firewalls (WAFs) or API gateways provide sufficient protection against API attacks. While these tools offer useful traffic management and basic security features, they fall short when it comes to defending against more sophisticated API threats. WAFs are designed for web applications, not the complex logic and workflows of APIs, leaving them vulnerable to business logic and shadow API attacks. Similarly, API gateways, while helpful for managing API traffic and authentication, often miss critical vulnerabilities. Understanding the limitations of WAFs and gateways is the first step in strengthening your API security strategy.

Let’s Face It - Criminals are bypassing selfie verification in Know Your Customer processes

Explore how criminals are exploiting selfie verification in Know Your Customer (KYC) processes for neobanks. Learn about the risks, current bypass techniques, and potential solutions for more secure digital identity verification in fintech.

API Security: The Unseen Risk Threatening Australian Businesses

Explore who owns API security in modern Australian enterprises, key stakeholders involved, and how regulations like APRA and SOCI shape security practices. Learn about evolving responsibilities and emerging challenges in API governance

Why "Check-the-Box” Solutions Are Insufficient for API Security

Why “Check-the-Box” Solutions Are Insufficient for API Security

Organizing API Security Around the NIST Cybersecurity Framework

Explore how the NIST Cybersecurity Framework 2.0 can revolutionize your API security strategy. This guide outlines key functions and activities for securing APIs, including risk identification, protection measures, real-time detection, incident response, and recovery processes. Enhance your organization's API security posture and protect critical data with actionable insights and best practices.

Traceable ASPEN

Service Now RCE - The Three Keys to ServiceNow's Data Vault

ServiceNow recently patched critical vulnerabilities (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) that allow remote code execution and sensitive file reads. Exploits involve server-side template injection using Apache Jelly. Traceable has deployed protection mechanisms to safeguard against these threats.

Navigating the Road to Automotive Security

In today's connected world, automobiles are complex systems driven by APIs, but this brings risks; Traceable ASPEN's latest research highlights urgent automotive security needs by analyzing recent vulnerabilities, including real-time vehicle tracking and data breaches.

Critical PHP CGI Argument Injection Vulnerability (CVE-2024-4577) Leads to Remote Code Execution

Researchers have identified a critical remote code execution vulnerability in PHP, known as CVE-2024-4577. This flaw, affecting PHP installations on Windows, exploits a Unicode processing oversight, allowing attackers to inject arbitrary command-line arguments. With a CVSS score of 9.8, it poses a severe threat to server security. Read on to understand the vulnerability, its impact, and essential protective measures.

Service Now RCE - The Three Keys to ServiceNow's Data Vault

ServiceNow recently patched critical vulnerabilities (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) that allow remote code execution and sensitive file reads. Exploits involve server-side template injection using Apache Jelly. Traceable has deployed protection mechanisms to safeguard against these threats.

How 1 Exposed Honeywell API Gave us Control Over an Internal Engineering System

APIs are essential for modern web applications, but they also introduce significant security challenges. Even large enterprises can fall prey to simple API vulnerabilities, as demonstrated by Traceable's discovery of a critical security flaw in Honeywell’s BEDQ system. This incident underscores the importance of robust API security measures.

Navigating the Road to Automotive Security

In today's connected world, automobiles are complex systems driven by APIs, but this brings risks; Traceable ASPEN's latest research highlights urgent automotive security needs by analyzing recent vulnerabilities, including real-time vehicle tracking and data breaches.

Product Updates

Traceable API Security Platform Updates - June & July 2024

This past month’s releases include major improvements to data classification, UX improvements for API catalog, AST changes, and a new threat activity UI for improved visibility and more efficient analysis.

December Software Release

December was an extremely busy month for Traceable as we worked with customers to protect their environments from the Log4Shell vulnerability.

Traceable API Security Platform Updates - May 2024

Traceable, a leading API security platform, has released major updates in May 2024, including new compliance policies and issues dashboard, fine-grained filters for targeted API security testing, and enhancements to credential stuffing and volumetric attack detection. These updates empower organizations to maintain API compliance, conduct targeted security testing, and combat advanced API threats effectively.

March | Traceable AI Feature Release

Stay current with new developments from Traceable AI; including, local hosting for EU/Asia and support for agentless deployments.

February | Traceable AI Feature Release

Stay current with new developments from Traceable AI; including, new support for AWS Lambda serverless architecture and new privacy features for managing sensitive data.

Traceable Defense AI M8 Released

Easier deployment process, extended agent support, extended API Intelligence, easier to find problems, protection additions, improved UX around threat hunting, ability to isolate per environment