Introducing Traceable Cloud WAAP: Built for the Way Applications Work Today

Introducing Traceable Cloud WAAP, the first major innovation from the combined Harness and Traceable teams. Purpose-built for modern, API-driven applications, this unified solution provides deep, context-aware protection across your web applications and APIs—wherever they run. It redefines cloud-native security with integrated capabilities in API security, bot mitigation, DDoS defense, and web app protection.

Announcing Traceable Bot Defense

Introducing Traceable Bot Defense: Real-Time Protection Against Bot Attacks We’re excited to announce the launch...

The Journey Continues

...

Exciting News: We’ve Merged Harness and Traceable To Create A New Leader In Secure Software Delivery

Harness and Traceable to merge to create a new leader in secure software delivery....

Recent Posts

Introducing Traceable Cloud WAAP: Built for the Way Applications Work Today

The Practical Guide to Zero-Trust for APIs

JWTs Under the Microscope: How Attackers Exploit Authentication and Authorization Weaknesses

Announcing Traceable Bot Defense

The Journey Continues

Exciting News: We’ve Merged Harness and Traceable To Create A New Leader In Secure Software Delivery

API Security

The Authorization Maze

This article delves deep into the complexities of authorization in API security, exploring why implementing robust access controls is far more challenging than many engineers realize. Through real-world examples from companies like Airbnb and Uber, the author breaks down different types of authorization vulnerabilities (BOLA, BOPLA, BFLA) and explains the nuanced challenges of creating dynamic, context-aware access policies.

Help, I'm Being Attacked: Why WAFs & Gateways Won't Stop the Next API Attack

Many organizations mistakenly believe that Web Application Firewalls (WAFs) or API gateways provide sufficient protection against API attacks. While these tools offer useful traffic management and basic security features, they fall short when it comes to defending against more sophisticated API threats. WAFs are designed for web applications, not the complex logic and workflows of APIs, leaving them vulnerable to business logic and shadow API attacks. Similarly, API gateways, while helpful for managing API traffic and authentication, often miss critical vulnerabilities. Understanding the limitations of WAFs and gateways is the first step in strengthening your API security strategy.

API Security: The Risk Threatening Australian Businesses

Explore API security ownership in modern Australian enterprises, key stakeholders, and how regulations like APRA and SOCI shape security practices and governance.

Why "Check-the-Box” Solutions Are Insufficient for API Security

Why “Check-the-Box” Solutions Are Insufficient for API Security

Organizing API Security Around the NIST Framework

Revolutionize your API security strategy with NIST Cybersecurity Framework 2.0. Enhance protection, detection, and incident response.

Traceable ASPEN

ALBeast: a simple misconfiguration to a complete authentication bypass

The ALBeast vulnerability represents a critical security flaw in AWS Application Load Balancer (ALB) authentication implementation that could lead to complete authentication bypass. This vulnerability, affecting over 15,000 applications, stems from improper validation of AWS-specific header claims and misconfigured security groups, allowing attackers to forge authentication tokens and impersonate legitimate users. The issue highlights the importance of proper JWT validation and security group configuration in AWS ALB implementations.

ALBeast: a simple misconfiguration to a complete authentication bypass

The ALBeast vulnerability represents a critical security flaw in AWS Application Load Balancer (ALB) authentication implementation that could lead to complete authentication bypass. This vulnerability, affecting over 15,000 applications, stems from improper validation of AWS-specific header claims and misconfigured security groups, allowing attackers to forge authentication tokens and impersonate legitimate users. The issue highlights the importance of proper JWT validation and security group configuration in AWS ALB implementations.

JWTs Under the Microscope: How Attackers Exploit Authentication and Authorization Weaknesses

JSON Web Tokens (JWTs) offer stateless authentication in modern web applications, but improper implementation can expose critical vulnerabilities. This analysis explores attack vectors across JWT components, revealing how small oversights can lead to significant security breaches like privilege escalation and unauthorized access.

The Practical Guide to Zero-Trust for APIs

Zero Trust APIs ensure security by treating all networks as compromised. Learn how to implement authentication, access control, and policies to protect APIs against threats while maintaining seamless operations.

JWTs Under the Microscope: How Attackers Exploit Authentication and Authorization Weaknesses

JWTs are a powerful tool for authentication, but improper implementation can expose applications to serious security risks. Learn how attackers exploit JWT vulnerabilities and how to defend against them.

ALBeast: a simple misconfiguration to a complete authentication bypass

The ALBeast vulnerability represents a critical security flaw in AWS Application Load Balancer (ALB) authentication implementation that could lead to complete authentication bypass. This vulnerability, affecting over 15,000 applications, stems from improper validation of AWS-specific header claims and misconfigured security groups, allowing attackers to forge authentication tokens and impersonate legitimate users. The issue highlights the importance of proper JWT validation and security group configuration in AWS ALB implementations.

Product Updates

Traceable API Security Platform Updates - June & July 2024

Discover major improvements: enhanced data classification, UX updates for API catalog, AST changes, and a...

December Software Release

December was an extremely busy month for Traceable as we worked with customers to protect...

Traceable API Security Platform Updates - May 2024

Traceable's May 2024 updates enhance API security with compliance policies, targeted testing filters, and improved...

March | Traceable AI Feature Release

Stay current with new developments from Traceable AI; including, local hosting for EU/Asia and support...

February | Traceable AI Feature Release

Stay current with new developments from Traceable AI; including, new support for AWS Lambda serverless...

Traceable Defense AI M8 Released

Easier deployment process, extended agent support, extended API Intelligence, easier to find problems, protection additions,...