In 2024, API requests accounted for 57% of dynamic internet traffic around the globe, according to the Cloudflare 2024 API Security & Management Report, confirming that APIs are a crucial component of modern software development. But with their increased adoption over the years, there’s also been a rise in associated security challenges.
Over the past two years, 60% of organizations have experienced at least one breach that involved APIs. This is an alarming trend that can be and must be addressed.
Consequences of insufficient API security
Hackers love exploiting APIs for many reasons, but mostly because they let them bypass security controls and access sensitive company and customer data easily, as well as certain functionalities.
A recent incident involving a publicly exposed API of social media platform Spoutible could have ended in attackers stealing users’ 2FA secrets, encrypted password reset tokens, and more.
This type of incident can result in a loss of customer and business partners’ trust, consequently leading to financial loss and a drop in brand value.
Poor API security practices can also have regulatory and legal consequences, cause disruption to company operations and even result in intellectual property theft.
Attacks against APIs
Attackers can mount a variety of attacks against APIs:
- DDoS
- Brute force
- Code injection
- Man-in-the-Middle (MitM)
“The nature of APIs also makes attacks simpler to execute, to more devastating effect. Unlike the conventional cyber kill chain, which consisted of seven stages that attackers had to go through in order to exploit and compromise a system, APIs are simple to exploit and effectively shorten the kill chain from seven to three simple stages: reconnaissance, weaponization, and exploitation,” former Wib product team lead Yonathan Michaeli noted.
“There is no need to install malware, get control of your systems, or complete any activities to take advantage of your systems; with APIs, attackers can gain access to a large amount of sensitive information by making simple requests.”
Planning a strategy
A good API security strategy is essential for every organization that wants to keep its digital assets safe and protect sensitive customer data.
OWASP constantly updates its list of the top 10 API security threats. While security practitioners mustn’t rely solely on this data, the list is still an essential tool when planning a security strategy that will hold up.
Adhering to the NIST Cybersecurity Framework is also an essential step in planning a good API security strategy. The key stages of the cybersecurity process (identify, protect, detect, respond, and recover) are a universal approach to dealing with high priority risks.
With this in mind, organizations need to implement API security best practices. Check Point has highlighted the following:
- Implementing authentication and authorization
- Using SSL/TLS encryption
- Implementing zero trust access control
- Performing regular security tests and risk assessments
- Updating regularly and promptly patching vulnerabilities
- Continuously monitoring and alerting on anomalous activities
- Using API gateways
- Using a web application and API protection (WAAP) solution
It’s also advised to limit data exposure (through masking, filtering and anonymization), manage API endpoints and enable security policy automation.
Finally, and most importantly, development and IT teams need to be consistently educated and trained on new and evolving threats as well as API security best practices. Building security into APIs is the best way to make sure API vulnerabilities don’t become security holes.