Analiza mogućnosti različitih API vatrozida i testiranje njihove primjene za PSD2

undergraduate thesis

• Title (english): Analysis of different API firewalls and testing their application on PSD2
• Author: Filip Vrbić
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Petar Paradžik (član povjerenstva)
• Committee member: Iva Sović (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2024-09-11, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

PSD2 omogućuje standardizirani i sigurni pristup bankovnim podacima putem API-
ja, što stvara potrebu za učinkovitim sigurnosnim rješenjima poput vatrozida. U radu se
istražuje prilagodba vatrozida za zaštitu API-ja zasnovanih na PSD2 direktivi, s posebnim naglaskom na usporedbu različitih rješenja. Dva vatrozida, Wallarm API Firewall
i Open-appsec, odabrana su za analizu zbog različitih pristupa zaštiti. Wallarm se os-
lanja na validaciju prema OpenAPI specifikaciji i zaštitu temeljenu na prepoznavanju
uzoraka, dok Open-appsec koristi modele strojnog učenja. Analiza prikazuje njihove
prednosti, ograničenja te utjecaj na sigurnosne rizike API-ja.

Abstract (english)

PSD2 enables standardized and secure access to bank data via APIs, which creates the
need for effective security solutions such as firewalls. The paper investigates the adaptation of firewalls for the protection of APIs based on the PSD2 directive, with special
emphasis on the comparison of different solutions. Two firewalls, Wallarm API Firewall
and Open-appsec, were selected for analysis due to their different protection approaches.
Wallarm relies on validation against the OpenAPI specification and protection based on
pattern recognition, while Open-appsec uses machine learning models. The analysis
shows their advantages, limitations and impact on API security risks.

• Keywords: PSD2; NextGenPSD2; vatrozidi; Wallarm API Firewall; Open-appsec; OWASP Top 10 API
• Keywords (english): PSD2; NextGenPSD2; firewalls; Wallarm API Firewall; Open-appsec; OWASP Top 10 API
• Language: croatian
• URN:NBN: urn:nbn:hr:168:718291
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2024-10-12 22:27:35