The National Stock Exchange, (NSE) on July 04, 2024, issued a notification regarding the Enhancement of API Authentication & Security for Exchange EV and ASPs.
In response to the increasing frequency and complexity of cyber-attacks targeting the securities market, particularly through vulnerabilities in Application Programming Interfaces (APIs), Exchanges have mandated best practices for software vendors and Application Service Providers (ASPs). These practices include maintaining an inventory of APIs, employing strong authentication mechanisms, and centralizing API security with gateways and web application firewalls. Data protection measures such as encryption, secure communication protocols, and integrity checks are essential. Additionally, validating user inputs, implementing rate limiting, proper error handling, logging, and configuring Cross-Origin Resource Sharing (CORS) are critical steps to mitigate risks. Secure storage of secrets, regular security assessments aligned with the OWASP Top 10 API security framework, and comprehensive documentation on secure API usage are also required.
Further, these best practices emphasize privacy protection by minimizing data collection, complying with privacy regulations, and integrating privacy considerations from the development stages. A secure software development lifecycle (SDLC) is crucial, promoting security from the outset and conducting regular security training for developers. Vendors and ASPs must also conduct an annual software audit as per ISO 12207:2017 standards to ensure ongoing compliance and security. These measures aim to safeguard sensitive data, prevent business disruptions, and protect against unauthorized access to APIs.
[Notification No NSE/MSD/62913]
