Should You Be Worried About Your API Security Strategy?

Application Programming Interfaces (API) are the major intermediary piece of software that allows data communication using requests and responses between software components. The data that is transferred among software – including everyday applications related to health, lifestyle, banking, automobile, and IoT devices – is all conducted through APIs. An API acts like glue connecting data and applications. 

Some advantages offered by APIs is that they ease maintenance and integration, while increasing the development of existing software systems.  However, as the use of APIs has increased, so have the security risks they create, which need to be addressed.

API Security Risks 

The client connections made through any API must be verified, ensuring that they are secured from unauthenticated and unauthorized access. Active APIs must be encrypted in real-time from the interpretation of the data that is exchanged between the applications. Weak APIs are easy targets for Cyber-attacks, like Man-In-the-Middle, DDoS, and SQL injection. Moreover, they can be leveraged to carry out data breaches, malware distribution, and impersonation attacks.

According to a recent survey of more than 250 security professionals, 95% of the respondents indicated that they have experienced a security incident involving APIs during the past twelve months. 34% of the respondents agreed that they lacked an API security strategy to respond to those attacks, despite running APIs in production. Also, 96% of the exploits were targeted at authenticated APIs, as reported. 

While it was encouraging to see that 62% of the survey respondents said that deployment of applications were being delayed due to API security concerns, this negatively affects the business. The expectation of many API deployments is to increase the performance and efficiency of an application to meet consumer demands.  When an unsolvable security challenge halts this progress, the business is put in the unenviable position of either fixing the problem or resume operations with the hope of addressing it before it becomes publicly exploited. 

The sensitive data that is accessible via an API is the main cause of exposure to API attacks. Among the 9 categories offered as part of the Salt Labs survey, the very general “Vulnerabilities” selection was chosen as the leading security problem with APIs during the past 12 months. This was closely followed by “Authentication problem”, and “Sensitive Data Exposure”.  Customers of Salt security experienced a 681% increase in API attack traffic over the past year and stopping API attacks remained the top security priority for the third time in a row, amongst the enterprises surveyed. 

The top security concern of API’s is outdated APIs, otherwise known as “zombie” APIs.  This was indicated 40% of the time, where old API's that were longer used could be exploited to access systems, exposing data. 85% of the respondents reported their existing legacy Web Application Firewalls and API gateway systems are not very effective and less capable of handling and preventing present-day API attacks.

Mitigating API Security Risks 

It is clear that up-keep and maintenance practices of API security is less focused upon within the organizational processes. This has resulted in an increasing number of security threats and incidents that have remained unresolved. 

It becomes clear that the current security strategies practiced by those organizations are insufficient in defending against the high surge of API attacks, and if any API security protocols were applied at all, they are in dire need of updating. A proper API security strategy must be created to deal with the alarming security threats to which organizations are regularly subjected. Protection of sensitive data must be held in high regard while minimizing the business disruption that is caused by the lack of API security mechanisms.  

In relation to the growing concern regarding the security of APIs, tight, up-to-date protocols against attacks for robust API systems must be executed on company APIs, uniquely understanding their functions and data sets that are involved in the data communication exchange. This simple API security checklist highlights the top security API mechanisms and other best practices that your organization can cover in accordance with your existing investments and resources. Addressing API security can be overwhelming sometimes, and a security checklist will help you to reach a starting point and adopt further protective strategies towards building a resilient and lasting API security strategy for your business. 

About Author:

Dilki Rathnayake is a Cybersecurity student studying for her BSc (Hons) in Cybersecurity and Digital Forensics at Kingston University. She is also skilled in Computer Network Security and Linux System Administration. She has conducted awareness programs and volunteered for communities that advocates best practices for online safety. In the meantime, she enjoys writing blog articles for Bora and exploring more about IT Security.