The Unique Challenges of Securing APIs

By John Iwuozor

APIs are responsible for a huge amount of data flowing around on the internet. With more and more software and technology using APIs to interact with one another, they're also becoming a bigger target for hackers who abuse them to find business logic gaps they can exploit and steal sensitive information.

Recent research from Gartner highlights how API attacks have become the most common attack vector now for enterprises’ online applications. As the use of APIs continues to grow, organizations must contend with the need to secure their APIs from attacks.

Businesses are using APIs more than ever before

APIs have become a critical aspect of modern business, with organizations using them to integrate disparate systems, access data from third-party sources and provide access to software as a service.

An average enterprise now has more than 300 APIs in use which has seen a 201% increase in the past 12 months.

The API economy is growing at an exponential rate, but this rapid pace of innovation poses several challenges for IT teams tasked with securing these interfaces.

API attacks can be incredibly damaging

Since APIs allow businesses to seamlessly integrate with third-party data sources and take advantage of new technologies, they also have the potential to open businesses up to exploitation by bad actors.

Attackers can use APIs to bypass traditional web application security controls. For example, an attacker could use an API to access sensitive customer data and then send that data directly to their own server. This is a huge concern because it allows attacks to happen very quickly, without being detected by many traditional monitoring tools.

Recent data has shown that API attacks have increased by 681% in the past 12 months, in comparison to a 321% growth in overall API traffic. Malicious API calls were also recorded to have increased from 2.73 million in December 2020 to 21.32 million in December 2021. There have been a lot of other notable API security incidents in the past year and this indicates that when it comes to APIs, it can make or break a business's cybersecurity strategy if care is not taken.

Securing APIs requires a different mindset

Securing APIs is a different ball game than securing web applications. In the Web world, you're protecting your users from hackers and malware. With APIs, though, you need to protect them not just from external threats but also internal ones (like misuse by others within your own organization). As such, API security requires a different mindset that focuses on protecting against both external and internal threats. Whether you're working with web services, microservices, or even messaging APIs that drive the business logic of modern applications, you need to understand their security implications.

APIs are exposed to the outside world

An API is a gateway to your organization’s data or functionality. It can be accessed by anyone, from anywhere—and it must be protected accordingly. There is no hiding behind firewalls or DMZs when it comes to web services and microservices; any potential attacker can access them directly.

This means you need strong authentication and authorization controls in place for all API operations so only authorized users can access what they need, when they need it. It also means you should use encryption wherever possible (and always at rest).

APIs are not static; they're constantly evolving

The reason APIs are interesting from a security perspective is because they are constantly being updated, improved, changed, added to, removed from and deprecated. This means that the security controls for your API must be dynamic and agile enough to keep pace with these changes.

APIs can be hard to monitor

While API monitoring can be used to track API availability, functionality, speed, and performance issues, it can sometimes be hard to carry out because they are not all built the same.

Some APIs may be built by a single team, while others may be shared among multiple teams or even different companies. And unlike typical software, the UI of an API is often limited to a set of functions that can be called from your application—meaning that there's no clear indicator that something is amiss if you don't know how the API was designed in the first place.

That's why it's important for security professionals who work with APIs to understand how they're architected and what kinds of attacks they might face based on their architecture.

Managing the lifecycle of an API can be tricky

Managing the lifecycle of an API can be tricky. Unlike a traditional web app where you start with a single product and evolve from there, APIs are designed to be infinitely extensible and scalable. They're like Lego sets for developers: once you've created one piece, you can keep adding pieces to it until it becomes something entirely different than you originally intended.

Because of this, managing the lifecycle of an API is more complex than managing the lifecycle of a traditional web app; not only do you need to consider all possible changes that could happen in future versions but also keeping track of all existing versions as well. In addition, because APIs are so dynamic by nature (they grow or shrink based on what developers build), they need frequent updates and adjustments throughout their entire existence.

Conclusion

The growing popularity of APIs, combined with the unique challenges of API security, means that it’s critical for businesses to build a robust API strategy. Technologies such as API gateways can help businesses develop a consistent approach to API security across their organization, while streamlining development and improving customer experience by enabling easy access to data on demand.

John Iwuozor is a freelance tech writer with proven expertise in the tech niche. This includes Data Science, Artificial Intelligence, Machine Learning, Natural Language Processing (NLP), Computer Vision, Image Recognition, IoT, Programming Languages, SaaS, and Cybersecurity. He isalso a regular writer at Bora.

September 7, 2022