Imagine the following: depositors can’t check their bank account balances or withdraw money for several days because the bank’s mobile app has gone down. Or, a young married couple invites friends over to watch a highly anticipated playoff game only to realize the streaming service has been cut off. No game available today.
These scenarios are entirely possible, yet most of us don’t think about them actually happening. We live under the false assumption that the applications we use every day are infallible. But in reality, massive outages because of security breaches are always a lurking threat, and everyone is vulnerable.
In fact, a huge application programming interface (API) security breach looms right around the corner. Why? Combine ever-expanding attack surfaces, hackers who are getting smarter by the day, an increase in the number of security incidents overall, the fact that API security is tough to master as-is, and major attacks are inevitable.
It’s already happened in Australia: last year, an API attack hit telecom company Optus, which experienced a breach that exposed the data of 9.8 million customers, including information such as driver's licenses, passports, names, and phone numbers.
Depending on which company gets targeted in the next big API attack, its impact could be far-reaching and serve as a much-needed wake-up call regarding the importance of API security. Given it’s likely just around the corner, let’s look at what makes APIs challenging to secure in the first place and steps organizations should take to protect their attack surface.
The challenge with API security
Pick any security breach that has occurred in the last few years (barring ransomware incidents), and it’s likely that an API was involved. From Pelton to T-Mobile to Twitter, companies’ APIs are acting as a getaway car for hackers to steal private information.
Despite major advancements in security throughout the years, API security remains a challenge. It’s hard to determine who should take organizational ownership of API security within a company. Is it an API developer problem to solve? Purely a security challenge? Or maybe even a product challenge?
When there’s ambiguity around who’s responsible for API security, mistakes, oversights, and attacks are more likely to happen. API security isn’t as cut and dry as ransomware, for instance: There’s no debate about who defends an organization’s endpoints — it’s always the IT security team’s job. But it’s more difficult to determine exactly who’s responsible for API security.
Here are two steps organizations can take to bolster API security:
More API security breaches are on the horizon, but companies can take steps to better protect their attack surface in the interim. By choosing a champion responsible for API security, and conducting ongoing assessments that clue them in to potential issues, organizations have the best chance at not falling victim to cyberattacks.
Karl Mattson, chief information security officer, Noname Security
