DHS · DHS-2444 · record R1818

API Security Vulnerability Technology

Department of Homeland Security · CBP

Overview

Development stage: In development or acquisitionSource: a) Pre-deployment – The use case is in a development or acquisition status.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not reported
Start date: Not reported
Withheld from public reporting: Not reported

Mission

Topic area: Administrative Functions
Operational functions: Software development assistance Derived by keyword rules; see methodology

Problem the AI is intended to solve

Discover, ingest, and analyze APIs to create and run thousands of custom attack scenarios against every build prior to production. Catch security vulnerabilities as early in the software development life cycle (SDLC) as possible. Educate and empower security and dev teams on sound API security strategies.

Expected benefits

With the necessity of leveraging application programing interfaces (APIs) for applications across the enterprise, this AI technology is intended to run thousands of custom attack scenarios against APIs on a continuous basis. This will help to identify potential security vulnerabilities prior to production level deployments, and enable the enterprise to develop essential remediations, if required. Additionally, the techonlogy is intended to provide continuous monitoring on APIs to provide real-time alerts on new potential vulnerabilities.

System outputs

The AI system is intended to output custom reports on identified vulnerabilities within application programing interfaces (APIs). These reports will Include the identified risk and a summary of the risk, as well as tailored remediation guidance based on the applications, environment, data, and tests conducted for end-users.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): Not reported
Custom-developed code: Not reported
Public source code: Not reported

Sourcing

How it was built: Not reported
Vendor (as reported): Not reported
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Not reported
Privacy Impact Assessment: Not reported
Authorization to Operate: Not reported
Demographic features: Not reported
Training and evaluation data: Not reported
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported