Application Security Analyst

One morning, Bruce receives an alert about a critical security breach. Attackers have exploited an unauthenticated API endpoint to compile a list of millions of personal data belonging to customers. Understanding the gravity of the situation, Bruce logs into Qualys API Security to address this threat.

Bruce's first step is to utilize the API inventory feature in Qualys API Security. He accesses the APIs tab under Applications to get a complete overview of all API endpoints in the environment for detailed information, including the security status of each API. He filters the list using Qualys Query Language (QQL) to quickly locate the unauthenticated API endpoint that was compromised.

With the detailed application report, Bruce informs the CISO and security managers about the vulnerability details and the necessary remediation steps. He uses existing integrations with JIRA to automatically create tickets for the development teams, ensuring that security fixes are promptly addressed.

After the initial remediation, Bruce conducts a re-scan to confirm all issues have been resolved. He updates the scan settings, scanning schedules and option profiles for future Authentication Tests using Authentication & Session Management, Information Disclosure, API Compliance and OWASP API Top 10 categories to check for PII and sensitive data exposures.

Bruce configures the authentication settings to simulate real-world scenarios where the API might be exploited. He also sets up header-based injections to authenticate the API and enable in-depth scans, covering all potential entry points.

As time progresses, Bruce monitors the Detections tab for critical vulnerabilities like API key and sensitive data exposures via URLs. He checks if passwords, credentials, API keys or tokens are improperly exposed and uses the TruRisk™ scoring system to prioritize these vulnerabilities based on overall business impact.

Bruce navigates to the API Compliance tab to check for deviations from OpenAPI specifications for issues, such as improper input validation, weak encryption protocols, missing '500' error responses, lack of rate limiting and improper string size definitions. Bruce uses these insights to inform the development team about necessary fixes to ensure compliance.

Bruce creates a dashboard that visualizes the scan results, highlighting OWASP API Top 10 vulnerabilities and sensitive data exposures to be reassured that API assets and the personal data of customers are secure. He categorizes the vulnerabilities by status (new, active, fixed) to have a clear overview for the CISO and other stakeholders.