サイバーセキュリティGRC 13項目
API Security Assessment (OWASP API Top 10)
このチェックリストは英語版です。
Assesses REST and GraphQL API security against the OWASP API Security Top 10 (2023), focusing on authorization, authentication, and resource controls.
OWASP API Security Top 10NIST 800-53
無料のPDFまたはWord・メールアドレスを入力してダウンロード。
Authorization
- Is object-level authorization enforced so users can only access their own objects? *
- Is function-level authorization enforced across all endpoints and methods? *
- Are property-level authorization checks applied to prevent mass assignment? *
Authentication
- Are authentication endpoints protected against credential stuffing and brute force? *
- Are API tokens and keys short-lived, scoped, and securely stored? *
- Is JWT signature and expiration validation enforced? *
Resource & Consumption Controls
- Is rate limiting and throttling applied to prevent abuse? *
- Are payload size, pagination, and query depth limits enforced? *
- Are server-side request forgery risks mitigated on APIs that fetch remote resources? *
Inventory & Configuration
- Is a complete inventory of API endpoints and versions maintained? *
- Are deprecated and non-production API versions decommissioned? *
- Are security misconfigurations (verbose errors, CORS, missing headers) remediated? *
- Is data returned by APIs filtered to expose only necessary fields?
API Security Assessment (OWASP API Top 10)チェックリストの完全版をダウンロード
印刷しやすいPDF、または編集可能なWord文書で無料で入手できます。