MENU
A developer is building new API functions for a cloud-based application. Before writing the code, the developer wants to ensure that destructive actions, including deleting and updating data, are properly protected by access control identifying sensitive fields such as those that contain passwords or personally identifiable information. Which approach must be used to score the risks proactively?
In a DevSecOps environment, 'shifting left' means identifying risks before a single line of application code is even executed. Open API Specification (OAS) Analysis is a proactive technique where the 'contract' of the API (the YAML or JSON file defining its endpoints, methods, and data structures) is audited for security flaws.
By analyzing the OAS, security tools can proactively identify if 'destructive' methods---like DELETE or PATCH---lack proper authorization scopes or if sensitive fields (like PII or passwords) are being exposed in responses where they shouldn't be. This allows the developer to 'score' the risk based on the API's design before moving into the implementation phase.
While SAST (Static Application Security Testing) (Option B) is vital for finding vulnerabilities in written source code, it occurs after the code is written. SBOM (Software Bill of Materials) Generation (Option C) tracks third-party libraries but doesn't analyze API logic. CSPM (Cloud Security Posture Management) (Option D) focuses on the misconfiguration of the cloud infrastructure (like open S3 buckets) rather than the internal logic of the API itself. OAS Analysis specifically addresses the developer's need to validate access controls and sensitive data handling during the design and definition stage of API development.