API Security Service - Get a free assessment today!

Progress

1/6Network Security and Authentication

Check certificate revocation on every call.

A trusted PKI issues certificates.

No export-grade encryption algorithms.

All communications to the network's edge are secured using the most recent version of TLS with perfect forward secrecy and a modern cipher set.

Authentication should include a set of claims.

Use the API Gateway to validate the Bearer token

Ensure the API Gateway does not cache.

No export-grade encryption algorithms.

2/6Authorization and Access Control

Authorization results are not cached.

If OAuth, users can revoke tokens without administrator assistance.

Return 403 for OAuth authorization failure.

All code paths should require authorization.

Use scope claims to constrain the activities of a caller.

Sensitive information should not be visible in paths.

Sensitive information should not be visible in headers.

The API Gateway evaluates the calling application to authorize access to an endpoint.

3/6Request Validation

Use correlation keys requested from clients.

If a client does not provide a correlation key, have the API Gateway create one.

Encrypt context.

Verify content types in request bodies.

Reject requests that do not send accepted content.

Content is verified to be syntactically correct.

Verify content against a schema.

Request bodies are not directly bound to data objects.

4/6Response Handling

Do not return unnecessary information about the nature of an error.

Error responses should only include sufficient information for a consumer to know how to correct their request.

Sensitive information should not be visible in response headers.

Use the no-cache directive on API endpoints.

Use Cache-Control headers to identify stale information.

Disable caching.

Redact sensitive information.

Enable CORS for APIs running in a browser.

5/6Data Protection and Handling

Responses should not contain sensitive data.

Parameterize SQL queries.

Do not use dynamic SQL in stored procedures.

JSON is not evaluated directly as JavaScript.

Do not execute binary code or script code in the body.

Log security events into a centralized security event system.

Convert exceptions to standardized errors.

Patch critical vulnerabilities immediately.

6/6Access Control and Management

Use network isolation techniques.

Check sudden changes in API usage.

Only appropriate personnel can disable an API.

Only appropriate personnel can disable access to APIs by applications.

Mark data with a security classification to identify its appropriate usage.

As a rule, developers cannot modify code in any environment without following the standard code progression path.

Use automated tests.

Record and track technical debt.

Company: First Name: Last Name: Email:

Welcome to Taliferro Group

At Taliferro Group, we recognize the critical role technology plays in today's competitive landscape. Drawing inspiration from our commitment to turning technology into a competitive edge, our mission is to empower businesses with comprehensive API security solutions.

Authentication and Authorization

Elevate your API security with our checklist's emphasis on robust authentication and authorization mechanisms, ensuring only authorized users and systems access your valuable resources.

Data Encryption

Enhance your API security posture with our checklist's comprehensive guide to advanced data encryption techniques, safeguarding the confidentiality and integrity of your sensitive information during transmission and storage.

Audit and Monitoring

Stay ahead of potential threats by incorporating our checklist's robust audit and monitoring solutions, allowing real-time detection of anomalies and ensuring the integrity of your API interactions

Developer Education

Empower your development team with our checklist's focus on education and best practices, fostering a security-first mindset and ensuring your API implementations align with industry standards and guidelines.

A brief about Taliferro Group

Tailoring our expertise to diverse sectors, we address specific challenges in API security, ensuring the longevity and prosperity of your digital assets. Our collaborative approach, continuous adaptation to tech trends, and unwavering commitment to client success converge to make Taliferro Group your trusted partner in navigating the evolving landscape of digital security.

Mission

We aim to bolster your digital infrastructure by transforming your technology into a strategic asset. We specialize in providing robust API security solutions that empower businesses to confidently navigate the dynamic digital landscape. Our focus is on uncovering hidden revenue streams, and our dedication lies in identifying and addressing vulnerabilities to ensure the resilience of your virtual resources.

reviews

Saluting Taliferro Group from Redmond, There are so many Sr. IT top guns out there, but few could provide sound advice after a brief chat. Lucky me to be one of the guys who received such advice yesterday from them.

Henry PanSr. Cloud Engineering Manager

Taliferro Group was working alongside development teams whom were delivering complex API's while assessing both the team and the API as to the Cyber Security Maturity and Posture. I found Taliferro Group to be very methodical and centered as they guided a development team through the process.

Ken CrimsonAssociate Director, Security Enablement

Taliferro Group has been a technical subject matter expert for RESTful API design on my team since 2010. Taliferro Group authored the bulk of our Guidelines for RESTful API Design. This document is an extremely useful compendium of best practices that we have used to drive consistency across APIs.

Ed LambertLead Product Development Engineer

Address

Explore our location and connect with us – find our address below and discover where your journey to exceptional experiences begins.

1424 11th Ave STE 400 Seattle, WA 98122

Get directions

Email and website

Connect effortlessly with us online – discover our email and website details below, the gateway to staying informed and engaged with our digital presence.

Email: info@taliferro.com
Website: www.taliferro.com

Telephone

Stay connected with ease – find our company telephone number below, your direct line to seamless communication and unparalleled support.

Tel: (206) 809-8529