Description

No authentication was detected for an API that provides access to non-sensitive personally identifiable information (PII).

What are considered non-sensitive personally identifiable information (PII)?

PII is information that can identify a user but, in isolation, could not cause significant harm to a person if leaked or stolen. This information includes full name, email address or phone numbers. Note: Datadog is only able to detect certain types of PII.

Rationale

This finding works by identifying an API that both:

• Datadog detected no authentication mechanism.
• Replies with or accepts requests containing email addresses or phone numbers.

Remediation

• Validate that the code isn’t expecting the user to be authenticated to have access to this resource (AuthN). In case this API is in fact authenticated, ensure your code is instrumented correctly. Datadog auto-instruments many event types; review your instrumented business logic events.
• Validate whether the API is intended to return PII.
• To improve authentication detection, you can configure custom authentication detection via the Endpoint Tagging Rules settings.

References