Description

No authentication was detected for an API that provides access to sensitive personally identifiable information (PII).

What are considered sensitive personally identifiable information (PII)?

Sensitive PII is information that, if inadvertently disclosed, could have significant consequences for the data subject. Sensitive PII data can encompass a wide range of information, including:

• Health information, covering medical records or insurance information.
• Government information, which includes social security information or other government related data.
• Proprietary information, which includes secrets or intellectual property (IP).

Note: Datadog is only able to detect certain types of PII.

Rationale

This finding works by identifying an API that:

• Datadog detected no authentication mechanism.
• Replies with or accepts requests containing one or more of the following:
  • Social Security Number (US)
  • Social Insurance Number (UK)
  • Passport Number
  • Vehicle Identification Number

Remediation

• Validate that the code isn’t expecting the user to be authenticated to have access to this resource (AuthN). In case this API it is in fact authenticated, ensure your code is instrumented correctly. Datadog auto-instruments many event types, review your instrumented business logic events.
• Validate whether the API is intended to return PII.
• To improve authentication detection, you can configure custom authentication detection via the Endpoint Tagging Rules settings.

References