The Hidden Dangers of APIs: Unveiling the Unknown Risks of Data Sharing

The Alarming Rise of API-Related Data Breaches

The digital landscape has transformed organizations, providing them with numerous capabilities enabled by cloud applications. However, this technological revolution also brings with it unknown risks that organizations may not fully appreciate or recognize. The “2023 State of API Security: Global Findings” report by Traceable sheds light on these risks, providing profound insights into the nature of the threats organizations face.

Startling Statistics

The report, based on data gathered from 1,629 respondents across over 100 countries and six major industries, reveals alarming statistics about API-related data breaches. In the past two years alone, 74% of organizations have experienced at least three API-related breaches. This trend calls attention to the escalating number of breaches and emphasizes the need for a proactive approach in addressing this issue.

Furthermore, the report highlights that 88% of organizations deploy over 2,500 cloud applications, signifying a high level of digital dependency and connectivity. While this extensive digital landscape offers vast potential, it also broadens the attack surface, making organizations more susceptible to cyber threats.

The Problem of Unknown Risk

One critical issue illuminated by the report is the prevalence of unknown risk. Despite the increasing number of API breaches, 40% of organizations only test a fraction of their APIs for vulnerabilities. This oversight leads to a mere 26% confidence level in preventing attacks, with only 21% of API attacks being detectable and containable. The core challenge lies in organizations lacking awareness of the extent of their API risks.

Surprisingly, only 27% of organizations prioritize having a security risk profile for every API, revealing a potential oversight in risk evaluation. When asked about the factors hindering the prioritization of API security, 49% cited management underestimating the risks, while 37% struggled with understanding threat-reduction measures.

The Expanding Attack Surface

The proliferation of APIs significantly expands the range of potential vulnerabilities and attack vectors. According to the report, 58% of respondents agree that APIs inevitably increase the attack surface across all tech layers.

Sheer Volume of APIs

The numbers speak for themselves: 88% of organizations utilize more than 2,500 cloud applications and manage thousands of APIs. This includes not only internally developed APIs but also third-party integrations. Each integration represents a new potential attack vector, calling for meticulous scrutiny.

Diversity in API Types

The digital landscape comprises various types of APIs, creating a complex web of connectivity. This includes open-to-partner, third-party, and internal APIs. The risk profiles of these APIs vary, with public APIs accessible to a broad audience being prone to a wide range of attack vectors, while internally perceived secure APIs might be vulnerable to insider threats. The report underscores this complexity, with 58% of respondents acknowledging that APIs amplify the attack surface across the entire tech stack.

Varied Perceptions about API Risk

The report reveals a wide range of perceptions regarding API-related risk. While 52% of respondents recognize the importance of having a security risk profile for every API, an almost equivalent 47% consider it of low to moderate importance. Alarmingly, 8% view it as negligible. These scattered perspectives reflect the industry’s inconsistent understanding and acknowledgment of API risk, hinting at potential vulnerabilities in many organizations’ digital infrastructure.

Unknown Risk and the Expanding Attack Surface

Unknown risk is intricately linked to the expanding API landscape. With 40% of organizations only intermittently testing their APIs for vulnerabilities, many potential threats remain undetected. According to the report, only 21% of API-related attacks are detectable and containable, indicating that a majority of attackers exploit these unknown risks. While 27% prioritize API security profiling, a significant number of organizations remain unaware of the hidden threats lurking in their digital infrastructure.

Interpreting the Unknown

The crux of the unknown-risk problem lies not only in the tangible threats APIs face but also in the intangible barriers within organizations preventing effective recognition and mitigation of these threats. A two-fold challenge emerges: raising organizations’ awareness of potential risks and equipping them with the necessary tools, knowledge, and resources to address them.

As the role of APIs in organizational infrastructures continues to grow, the associated unknown risks become an invisible threat. The interconnectedness of volume, diversity, and infrequent risk evaluation poses significant vulnerabilities for many organizations. It is crucial to not just manage more APIs but also to understand and proactively address the blind spots in their security frameworks.

About the Author

Richard Bird, the author of the report, serves as the Chief Security Officer at Traceable. With his extensive experience in cybersecurity, data privacy, identity, and zero trust, Richard is globally renowned as an expert in the field. He is a Senior Fellow at the CyberTheory Zero Trust Institute and a member of the Forbes Tech Council. Richard’s insights are often featured in prominent media outlets such as the Wall Street Journal, CNBC, and CNN.

Keywords: Cybersecurity, APIs, Data Sharing, Risks, Security, Vulnerabilities, Privacy, Data Protection, Data Breaches, Cyber Threats