According to the 2022 SaaS Security Survey report, 63% of respondents have had a SaaS misconfiguration that led to a security incident in the past year. The primary culprit? Lack of visibility and an overwhelming number of users on these platforms. Furthermore, with more investment in SaaS applications by companies, thoroughly vetting and securing them becomes even more challenging – or worse, adopters assume the platform is secure by default. To make matters worse, many SaaS platforms have recently begun gatekeeping security features such as Organization-Wide MFA exclusively for enterprise users – making security even more challenging for startups and small and medium businesses than it already is. Postman Security is no exception, given the surge in popularity of APIs – Postman has become the go-to platform for developers and teams trying to consolidate their APIs between team members. This claim is quickly reflected in their adoption statistics; Postman is trusted by 98% of Fortune 500 companies and over 30 million developers worldwide. The problem? Glaring vulnerabilities, in specific vulnerable defaults, allowed our sister company (Mand Consulting Group) to find a critical issue that exposed secrets in many Fortune 500 companies and Postman customers. Mand Consulting Group built a novel, open-source tool, dubbed Porch Pirate, which customers can use to see if their organization publicly exposes secrets. This blog post intends to demystify tips to secure your organization’s Postman accounts and workspaces from malicious hackers and further secure your organization against threats.
Ensure workspaces are private
By default, Postman will expose your workspace to the internet. Why? We are unsure, but this flaw allowed us to quickly mass-scrap sensitive secrets (e.g. API keys, credentials, etc.). To make matters worse, we’ve seen developers often using their own workspace (deviated from the companies) to do their own testing/development, which organizations need visibility into and can lead to more undocumented workspaces which are exposed publicly. To ensure attackers cannot scrape your organization’s data, it’s vital to ensure your developers are aware of making their Postman workspaces private. Workspaces can be made private by navigating to Workspace Settings for the relevant workspace and changing the team visibility to internally accessible.
Enable Multi-Factor Authentication (MFA)
Adding to a list of Postman’s critical flaws – it does not currently allow organizations to enable Multi-Factor Authentication (MFA) for teams – which is acceptable for companies on Enterprise plans using SSO. Still, startups and SMBs may not benefit from this as they often use Postman’s free, basic, or professional plan. Due to this limitation, MFA must be configured on a per-user basis. It is vital to inform employees to enable MFA on each account, lowering the risk of account compromise and sensitive environment variables being leaked (e.g. production API tokens or credentials).
Disable Team Discovery
Postman allows users within the same organization to view adjacent teams; while this seems harmless, it can be used by attackers that have access to Postman (via compromised account or otherwise) to laterally move and access other teams which may contain sensitive information or allow for further access. Considering that password-based attacks are one of the most common, and MFA must be enabled on a per-user level, it’s not a stretch that a large organization could find itself in this situation. To ensure Team Discovery is disabled, navigate to Team Settings within every team in your Postman organization and in Team Discovery, make sure it’s set to disabled.
Store sensitive data in environment variables
Another common misconfiguration we see (and one of the reasons why Porch Pirate was able to do so much damage) is due to committing secrets in the wrong place. While Postman explicitly states that developers should use environment variables, we found that end users often committed secrets to collection variables – most likely due to the assumption that this was the same as using an environment – but it was not. If developers commit secrets to a parent collection or subfolders within the collection, it is still vulnerable to scraping if it is ever left public. Instead, users should create an environment within Postman and commit secrets directly within the environment. An environment can be created by navigating to the Environments tab within Postman, clicking New, then giving the environment a name and committing the variables, their type and value directly to this area. From here, these variables can be safely reused in requests, and even if they were publicly exposed, it would significantly lower the risk of the information getting out.
Total visibility. Zero blind spots. WatchDog helps you monitor every user, service account, and system across Cloud, SaaS, and devices -flagging misconfigurations and risks the moment they arise.
- ➕ Asset management – Add and track your own assets easily across Cloud, SaaS + On-Prem
- Identity monitoring – Limited to Google Workspace & M365 Non-Human Identities on free plan
- 🔧 SaaS + Cloud hardening checks – Spot misconfigurations before they become risks
Get started free today – no credit card required.
