90% of businesses experienced API security vulnerabilities in 2020

Report finds that more than a quarter of organizations haven't yet launched an API security strategy

Nine in ten organizations suffered a security incident with their application programming interfaces (APIs) last year, according to a report from security company Salt Security.

An API is a tool that software uses to field queries over the internet, including other cloud-based and mobile apps. They can also make browser-based applications more responsive and fluid. APIs are becoming increasingly popular, with Akamai stating that API queries comprise 83% of web traffic.

However, poorly crafted APIs can be a security risk, allowing people to query information they shouldn't. Examples in the past include a flaw an ethical hacker discovered in a GitLab API that could have exposed private group information. In 2018, an API bug at Google exposed 52.5 million private users’ data, and another at the US Postal Service made near real-time data on 60 million users public.

The report's findings don't mean 90% of people have experienced breaches via APIs. The incidents it described range from the discovery of vulnerabilities (54% of companies found those in production systems) to authentication problems (46%). However, the number of attacks on APIs was still a concern.

One in five companies experienced bot scrapers, and almost the same proportion experienced denial of service attacks via their APIs. Account misuse via APIs plagued 14% of respondents, while 9% saw an API-based data breach.

Related Resource

IBM Maximo 8.0: Moving to an integrated suite of applications

A report on the business benefits of the new Maximo solution

What are the benefits of Maximo 8.0 - integrated suite of applications - whitepaper from IBMDownload now

The respondents surveyed across all company sizes and various sectors revealed a lack of knowledge and strategy around API security. Of those surveyed, 5% had no API security strategy, and 22% were in the planning stages for API security. It's no surprise, then, that 83% of them lacked confidence in the APIs they were using, and 8% had no confidence at all. Companies had not documented their APIs properly because their tools relied on human interaction.

API blindness is a problem when it comes to version control. Outdated ”zombie” APIs that should have been retired long ago are often left exposed. According to Salt, there were anywhere from 40% to 800% more APIs in its clients' infrastructures than employees had documented.

This lack of visibility makes APIs a critical attack point. Salt's software found that 91% of its clients' APIs exposed personal or otherwise sensitive data.

Companies are aware of these security issues and see them as a significant risk and, according to the report, these concerns have delayed 66% of API deployments. There is too much of a focus on pre-production API threat-hunting, it warned, adding that too many people rely on developers and DevOps teams to catch API security issues. Companies must increase collaboration between their security and development teams, it warned.

Featured Resources

Virtual desktops and apps for dummies

An easy guide to virtual desktop infrastructure, end-user computing, and more

Download now

The total economic impact of optimising and managing your hybrid multi-cloud

Cost savings and business benefits of accelerating the cloud journey

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

What’s next for the education sector?

A new learning experience

Download now

Recommended

Biden calls for $22 billion in cyber security funding
Security

Biden calls for $22 billion in cyber security funding

18 May 2021
Avast’s Business Hub helps eliminate gaps in cyber defense
Security

Avast’s Business Hub helps eliminate gaps in cyber defense

18 May 2021
NETSCOUT threat intelligence report
Whitepaper

NETSCOUT threat intelligence report

18 May 2021
Defend your organisation from evolving ransomware attacks
ransomware

Defend your organisation from evolving ransomware attacks

18 May 2021

Most Popular

KPMG offers staff 'four-day fortnight' in hybrid work plans
flexible working

KPMG offers staff 'four-day fortnight' in hybrid work plans

6 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

30 Apr 2021