The National Stock Exchange (NSE) on July 11, 2024, issued an advisory for Enhancement of API Authentication & Security for Trading Members with reference to SEBI circular No.: SEBI/HO/MIRSD/CIR/PB/2018/147 dated December 3, 2018, regarding Cyber Security & Cyber Resilience framework for Stockbrokers. Securities Market participants and entities have been experiencing cyber-attacks which are rapidly growing in frequency and complexity.
It has been observed that these incidents occurred due to vulnerable APIs used as part of the software products/services. To avoid the occurrence of such cyber incidents and ensure secure usage of API, members are advised to adopt the following best practices:
• Maintain Inventory of API: Inventory of API including ownership, criticality/impact of API shall be maintained.
• Strong Authentication Mechanisms: Employ strong & mutual authentication mechanisms such as API keys, OAuth, or IWT, ensuring secure token management practices and setting appropriate expiration times.
• Centralized API Security: Establish an API gateway for centralized security enforcement and a web application firewall (WAF) to protect against common web threats. Implement an API security gateway for both internal and external APIs. Disable any public API lacking secure authentication or strengthen it as per advisory at the earliest.
• Data Protection and Secure Communication: Prioritize data protection by encrypting sensitive data, applying data masking techniques and using secure communication protocols to prevent eavesdropping and information leakage. Additionally, integrity checks through checksum or digital signature should be implemented to ensure data integrity & to avoid data manipulation/MITM.
[Circular No. 48/2024]
