The 7.5 release of the Cequence Unified API Protection (UAP) platform is expected to be generally available as of October 18, 2024. This release has several new features.

Sensitive Data Masking with Cequence SaaS Deployments

Cequence now supports masking sensitive data fields in incoming traffic before sending the traffic to the Cequence UAP platform. Sensitive data detection and masking operations take place in the data plane using data plane components starting with version 5.3 of Cequence Defenders or our latest data plane component, version 5.3 of Cequence Bridge. The Cequence Bridge aggregates traffic from multiple traffic sources before sending to the Cequence UAP platform. 

Cequence uses format-preserving encryption (FPE) to implement sensitive data masking, in accordance with the NSP 800-38G NIST standard. Cequence Bridge or Defender replaces sensitive data with alternate values with the same length and format. For example, 10-digit integer values are masked with 10-digit integer values that do not match the original value. The following example shows a JSON excerpt before and after masking.

"credit" : "4532 1828 5449 1573", 
"social" : "766.123.456",  
"email" : support@cequence.ai

After masking:

"credit" : "1521 4879 0354 9905", 
"social" : "334.813.744",  
"email" : "qPca.QJg@cequence.ai"

The new Traffic Management page enables you to configure data masking for Application Tags, no regular expressions required. Cequence automatically masks fields with values that match the configuration in the Sensitive Data Expressions page. Because the masked values are semantically similar to the original sensitive values, masking doesn’t affect product functionality, such as spec generation or sensitive data detection.

Format-preserving encryption does not permit the original values to be reconstructed or reverse-engineered from the masked values, preventing potential bad actors from reconstructing the original sensitive data values.

Enabling Sensitive Data Masking in Traffic Management Configuration

Filtering and Sampling Traffic Sources

Cequence now supports traffic filtering and sampling from incoming traffic sources. This feature enables users to limit the volume of traffic being sent to Cequence UAP and prevent redundant traffic from being sent. This functionality is particularly useful for discovery and API posture management use- cases with the primary goal of building an inventory of APIs and their schemas.

From the new Traffic Management page, you can choose whether the UAP platform sees all your traffic, or just a sample. Advanced configuration options enable you to search for specific query parameters, request headers, or response headers before traffic goes to the UAP platform.

Enabling Traffic Filtering in Traffic Management Configuration

New UI Page Listing Machine Learning (ML) Models

The Cequence UAP platform UI has added a centralized hub, the new model listing page, where you can discover and explore the pre-trained machine learning models that are active on your instance. The model listing page is a valuable resource for security teams and data scientists, providing an organized platform where you can find models tailored to specific tasks or domains. The page offers information about each model, including the model’s purpose, design goals, and generated output, such as automated policies or rules. 

ML Model Configuration page

Improved Dashboard Page for Attack Surface Discovery

API Spyder’s external attack surface dashboard has been refreshed to highlight actionable events for API host discovery.

• The dashboard shows the number of API hosts, and the trends in that metric over time, providing visibility into new or deprecated APIs.
• The dashboard also includes new widgets to categorize specific edge, infrastructure, and application gateway providers that Spyder detects during host discovery crawls. This information enables you to identify or validate specific vendors that you expect in your environments – and also possible rogue/shadow API deployments, such as APIs hosted on unapproved providers. The Cequence UAP platform offers integrations for many of these sources, enabling you to mirror traffic from these sources and build a run-time inventory of APIs, with risk and security posture dispositions, using API Sentinel.
• You can also click these metrics on the dashboard to identify specific hosts, providers, or findings across all domains in your organization. For example, you can click on a specific gateway provider to see a filtered list of all the API Hosts, regardless of domain.

Other noteworthy Spyder enhancements:

• The API Discovery page now identifies all the providers detected on a specific host with visual icons to different between edge, infrastructure, and application gateway providers.
• You can now customize the algorithms that Spyder uses to determine API endpoints, with support for default algorithms, include/exclude capabilities, and the ability to add new rules specific to your instance.
• Spyder email notifications have been refreshed with a new notification of completed crawls, including summary details. Email notifications have been enhanced with informational and, actionable content, for scenarios like tenant creation, new user invitations, or domain approvals.

Downloadable API Testing Reports and Archiving Test Plans

API Security Testing has been enhanced with two noteworthy new capabilities:

• You can download JSON reports for each test run executed in the UAP platform. You can download reports from the Test Plans interface, for a specific test plan, or from the Test Runs interface, across any test plan. Reports are automatically generated and available at the end of each test run. Note that reports aren't available for test runs that ran before you upgraded to version 7.5.

New API Inventory Enhancements

Cequence’s API inventory view has been enhanced with new capabilities:

• Labels enable you to add custom context to individual API endpoints or groups of endpoints, independent of existing classifications or metadata. Labels appear in a dedicated column in the enhanced API Inventory view. You can also filter your view to quickly identify which API endpoints are associated with specific Labels. Labels complement built-in analysis by enabling organizations to incorporate their own relevant context for more tailored management and insights.
• App Tags have long been a cornerstone of Cequence’s approach to grouping and classifying API endpoints. Now, Sentinel users can use app tags in the Inventory view, establishing a critical contextual link between attack detection and runtime inventory. A new column in the tabular Inventory view enables you to filter based on App Tags.
• The new Inventory view offers enhanced visibility into the individual cookies associated with each API endpoint. This detailed information is particularly valuable for users configuring cookie-based authentication, as it simplifies identifying the specific cookie that stores authentication details. Previously, you needed prior knowledge or a custom data extraction to properly configure auth settings, leading to false positives for ‘no auth’ findings. The new Inventory view eliminates that complexity, simplifying accurate authentication configuration for discovery endpoints.

New Risk Posture Page to Track API Security Issues

Version 7.5 of the Cequence UAP platform introduces a new, dedicated Risk Posture page—a centralized location to view and manage the API security issues that Sentinel identifies. The Risk Posture page focuses on individual risk findings, which are categorized according to the OWASP API Top 10, providing a comprehensive overview of the security posture of your APIs. The new filterable interface includes enhanced, actionable visual elements to help you prioritize your attention. Each risk finding has a detailed description that explains the nature of the risk, suggested remediation steps, and the specific API endpoints associated with the event. The Risk Posture page is an evolution of the risk table formerly found on the Sentinel Dashboard, which has now been retired.