- Report warns vulnerabilities, data exposure, and API authentication weaknesses, are key issues
- Many firms were forced to slow down app rollouts due to API issues
- Businesses can mitigate API risks before they can be exploited, researchers are saying
Virtually all (99%) of organizations have experienced some API security issues over the last 12 months, and more than half (55%) were forced to slow down the rollout of new applications due to various API security concerns, new research has claimed.
A new research paper from Salt Security found businesses are essentially being plagued by API security risks.
Vulnerabilities that expose APIs to various exploits (for example, injection attacks and Broken Object-Level Authorization (BOLA)), accounted for more than a third of issues (37%), similar to sensitive data exposure (34%). API authentication weaknesses took the third spot with 29%.
Outdated practices
Salt added Generative Artificial Intelligence has “advanced” API security challenges, since almost half (47%) of the respondents expressed concerns about securing AI-generated code. Furthermore, for two in five (40%) potential risks introduced by AI-generated code is a top concern. Only 11% of respondents do not see the use of GenAI applications as a growing security.
The researchers also determined that traditional API security methods, in which authentication is the primary defense mechanism, can no longer suffice. Almost all (95%) of API attacks over the past 12 months came from authenticated sources, and what’s more, 98% of attack attempts targeted external-facing APIs.
To protect against “rampant” API attacks, Salt says businesses should make API posture governance strategies “essential”, and warned that the majority is far removed from that notion. It claims only 10% of organizations currently have an API posture governance strategy set up, similar to the previous year – but the good news is that 43% plan on implementing such a strategy soon.
Since threat actors are actively abusing security weaknesses, businesses need to implement a “robust, proactive API security strategy,” says Roey Eliyahu, co-founder and CEO, Salt Security.
“A strategy that should not only encompass timely threat detection and incident responses but also API governance. By implementing frameworks that ensure security policies are clearly defined, continuously enforced, and regularly assessed, organizations can mitigate API risks before they can be exploited.”
Leave a comment