Getting API security right: Ensuring robust protection

Application programmable interfaces (APIs) are an essential component of the online experience — from business websites and applications to consumer platforms like social media. APIs enable different software applications to communicate and interact with each other programmatically. 

APIs create a unique security environment that can be difficult to get right. The big problem is that many APIs remain unmanaged and undiscovered, and even known APIs are often poorly protected. Without getting a handle on their API footprint, organizations face growing threats of exposing sensitive data or falling victim to malicious bots performing credential stuffing, website scraping and other nefarious acts. 

The right protection can help mitigate a much larger attack surface of which security teams may not even be aware of. Special attention should also be placed on major events, such as the 2024 Olympics and U.S. election, where custom websites and applications are spun up, often leading to the proliferation of API vulnerabilities.

The critical role of APIs

In 2021, Gartner predicted that APIs would soon become the top attack vector — a prediction that has come true. Since then, there have been significant API-targeted attacks on top brands, such as attackers exposing the personal data of about 37 million T-Mobile customers and scraping the data of 2.6 million Duolingo users that appeared on a dark web hacking forum.

Having access to all data for a website, APIs are integral to digital transformation and enable smooth communication between applications and databases. As entry points to critical systems, APIs often handle sensitive data, from personal information to corporate data. An exploited API can severely impact a business, putting corporate intellectual property and customer data at heightened risk, and insecure APIs compromise the integrity of the systems they interact with, creating significant opportunity data breaches and other attacks. As the API ecosystem constantly evolves, security teams must also evolve their defenses.

Examining common attacks

APIs have become pervasive and extremely valuable targets for bad actors. Many have coding deficiencies or other vulnerabilities that open them to attacks, and even properly coded APIs can suffer business logic abuse. Security and IT teams should pay close attention to common and threat vectors, including:

• Sensitive data exposure: When an API unintentionally makes sensitive data accessible to unauthorized users, security breaches will likely happen, targeting data like personally identifiable information (PII).
• Credential stuffing: To gain unauthorized access to systems, data or accounts, attackers use automated tools to “guess” a multitude of log-in credential combinations — often obtained from data breaches — against a target API.
• Malicious bot attacks: Bots are automated software programs designed to carry out disruptive activities on APIs without human intervention. Attacks can result in fraud, account takeovers, data theft and DDoS.
• Third-party vulnerabilities: When an organization uses or integrates APIs with external providers, it often acts as a gateway for bad actors to enter the network.
• Artificial intelligence: AI enhances the capabilities of cybercriminals, helping them facilitate attacks that are more efficient, sophisticated and harder to detect.

It’s important to understand APIs in all states to enable better protection. For example, shadow APIs exist within an organization without proper approval or oversight from the security team. They can emerge from various sources like development projects, third-party integrations or employee-initiated tools. Shadow APIs often lack proper security controls and documentation, making them highly vulnerable to attacks. Deprecated APIs, or those no longer supported or maintained by developers, also pose significant risks. Many have been replaced by newer versions or discontinued altogether, but the original API was never retired.

Ensuring robust protection

Keeping track of all APIs and assessing potential vulnerabilities are enormous obstacles for security teams to manage. Undiscovered vulnerabilities can be a disaster waiting to happen, as they give bad actors easier access to an entry point. From there, attackers steal data, takeover accounts and wreak havoc on the targeted business.

Security teams should inventory all API hosts and document important aspects of each one. Taking inventory includes understanding of the full API environment including production, staging, testing and development and having the ability to detect known and unknown APIs in that environment. Complete API detection and mitigation solutions should cover discovery of all APIs, monitoring for compliance and vulnerabilities and blocking malicious traffic and attacks. 

Continuous monitoring of internal and external APIs helps reveal new endpoints and provide a basis for real-time visibility, testing and monitoring. Given that bot attacks are on the rise, advanced bot mitigation capabilities are a must-have when it comes to robust API security. Bot mitigation helps identify bots that carry out malicious behaviors so threats can be blocked in real-time, reducing damage to the organization.

Protecting the business as the bottom line

As the API threat landscape continues to advance and bad actors deploy more sophisticated methods of attack, organizations must better understand their API environment. Security teams — those at the enterprise level or those protecting major events like the Olympics and 2024 election — can’t underestimate the risks that APIs introduce. Investing in API security can drastically reduce vulnerabilities and attacks, preventing business disruption, data theft, financial loss and damaged brand reputation.

A recent survey reported that 53% of organizations are impacted by three or more API attacks per month. That’s why it’s never been more important to secure the-online experience with solutions that encompass the entire API lifecycle — from discovering exposed APIs to protecting them against attacks and ensuring regulatory compliance.