## Introduction
Data Theorem, a leading provider of modern application security, has partnered with Enterprise Strategy Group (ESG) to publish a report on API security titled “Securing the API Attack Surface”. The study surveyed 397 respondents from private- and public-sector organizations in North America (US and Canada) across IT, Security, and Application Development on issues, challenges, and trends around cloud-native applications and API security.
## Key Findings
The study found that a majority (75%) of organizations typically change or update their APIs on a daily or weekly basis, creating a significant challenge for protecting the changing API attack surface. Additionally, the majority (92%) of organizations have experienced at least one security incident related to insecure APIs in the last 12 months, while 57% of organizations have experienced multiple security incidents related to insecure APIs during the same period.
To address these API security concerns, the study found that the leading approaches organizations will increase their spending on over the next 12-18 months are API security tools (45%), Cloud-Native Application Protection Platforms – CNAPPs (43%), and integrated application security and API security tools (41%).
The study also found that the most cited security challenge organizations face with faster development cycles of CI/CD is that security lacks visibility and control in development processes (41%). The second most cited security challenge with faster development cycles of CI/CD is that new builds are deployed to production with misconfigurations, vulnerabilities, and other security issues (40%), followed by developers skipping security processes (39%), and software released without security checks and/or testing (38%).
## Vulnerabilities of Greatest Concern
The types of API vulnerabilities of greatest concern to organizations are sensitive data exposure due to no SSL or TLS (34%), attribute-based access control (ABAC) vulnerabilities and API business logic flaws (both at 31%), and distributed denial of service attacks – DDoS (30%).
## Expert Commentary
Melinda Marks, Senior Analyst for Enterprise Strategy Group, commented on the study’s findings, stating, “It’s no surprise that most organizations are experiencing API-related security incidents. Modern development cycles bring faster, more frequent product releases and updates, and the growing number of APIs that change on a daily and weekly basis make it imperative to address the changing attack surface. This rapid rate of change also creates shadow APIs and zombie APIs, which can be hackers’ favorite APIs to exploit because organizations often do not know about them.”
Doug Dooley, Data Theorem COO, expressed confidence that API security tools and Cloud-Native Application Protection Platforms (CNAPPs) are the most promising options to help organizations reduce their vulnerabilities to attack. Data Theorem offers both API security and CNAPP solutions to supply organizations with complete security measures to tackle these vulnerabilities.
## Conclusion
The report reinforces the importance of API security as a continued challenge for organizations, particularly those with cloud-native applications. Investing in API security tools and CNAPPs is recommended to address these challenges. Organizations must also ensure that developers, and security teams are fully integrated into the CI/CD process to guarantee proper security inspection and remediation measures are taken.
<< photo by ThisIsEngineering >>
