The Multi Commodity Exchange Clearing Corporation Limited (MCXCCL) on July 15, 2024, issued an advisory for Enhancement of API Authentication & Security for Professional Clearing Members.
The following has been stated: -
•Securities Market organizations have been experiencing cyber-attacks which are rapidly growing in frequency and complexity.
•To avoid the occurrence of such cyber incidents and ensure secure usage of API, members are advised to adopt the following best practices: -
(i)Maintain Inventory of API: Inventory of API including ownership, criticality/impact of API shall be maintained.
(ii)Strong Authentication Mechanisms: Employ strong & mutual authentication mechanisms such as API keys, OAuth, or IWT, ensuring secure token management practices and setting appropriate expiration times.
(iii)Centralized API Security: Establish an API gateway for centralized security enforcement and a web application firewall (WAF) to protect against common web threats. Implement an API security gateway for both internal and external APIs. Disable any public API lacking secure authentication or strengthen it as per advisory at the earliest.
The detailed advisory is given in the document below.
[Circular No. MCX/MCXCCL/466/2024, MCXCCL/TECH/172/2024]
