Developers and IT Security Teams Disconnecting on API Security
April 11, 2016

Rami Essaid
Distil Networks

The majority of companies surveyed are running some form of an API management platform, either developed in-house or from a commercial provider, according to a survey on Application Programming Interface (API) security, API Security: A Disjointed Affair, conducted by Ovum for Distil Networks.

However, the security features included in these API management platforms are inconsistent, with many lacking basic rate limiting functionality. Also of note is the lack of responsibility for API security. There is nearly an even split between those that give responsibility for API Security to their developers and those that allocate it to the IT Security team.

"The use of APIs to enable applications to interact across single and multiple infrastructures is skyrocketing and innovation is being fueled by companies finding new ways to monetize their software assets by exposing APIs to outside developers," said Rik Turner, Senior Analyst at Ovum. "However, exposing APIs to developers outside the company creates significant risk and APIs are becoming a growing target for cyber criminals. This study highlights an alarming lack of consistency and ownership in how API security is addressed."

APIs impact business and the world around us more than most people realize. The fact that API security is flying under the radar and not being adequately addressed should be a red flag prompting organizations to examine their own practices. CIOs and CISOs need to get a handle on how responsibility is addressed within their organizations and decide whether the process is sufficiently robust.

Key findings of the survey include:

The purpose behind APIs

■ 51 percent of respondents said that their rationale for API deployment was to enable their external developer ecosystem

■ 67 percent said partner connectivity was the main goal while 62 percent cited mobility and 57 percent cited cloud integration

API security woes

■ 83 percent of those surveyed were concerned with API security

■ 87 percent of respondents were running an API Management platform, with 63 percent using a platform developed in-house

API management platforms lack critical features and automation

■ Rate limiting, considered to be a basic API security practice, was employed by less than half of respondents

■ Over two-thirds of respondents were spending over 20 hours a month managing API rate limiting

■ Only 21.9 percent of respondents had protection from API malicious usage, API developer errors, automated API scraping, and web and mobile API hijacking

Who is responsible for API security?

■ 53 percent of respondents feel security teams should be responsible for API security, while 47 percent believe the developer teams should hold responsibility

■ 30 percent of APIs are spec'd out without any input from the IT security team and 27 percent of APIs proceed through the development stage without the IT security team weighing in

■ 21 percent of APIs go live without any input from security professionals

Rami Essaid is CEO and Co-Founder of Distil Networks.

The Latest

September 20, 2018

The latest Accelerate State of DevOps Report from DORA focuses on the importance of the database and shows that integrating it into DevOps avoids time-consuming, unprofitable delays that can derail the benefits DevOps otherwise brings. It highlights four key practices that are essential to successful database DevOps ...

September 18, 2018

To celebrate IT Professionals Day 2018 (this year on September 18), the SolarWinds IT Pro Day 2018: A World Powered by Tech Pros survey explores a "Tech PROactive" world where technology professionals have the time, resources, and ability to use their technology prowess to do absolutely anything ...

September 17, 2018

The role of DevOps in capitalizing on the benefits of hybrid cloud has become increasingly important, with developers and IT operations now working together closer than ever to continuously plan, develop, deliver, integrate, test, and deploy new applications and services in the hybrid cloud ...

September 13, 2018

"Our research provides compelling evidence that smart investments in technology, process, and culture drive profit, quality, and customer outcomes that are important for organizations to stay competitive and relevant -- both today and as we look to the future," said Dr. Nicole Forsgren, co-founder and CEO of DevOps Research and Assessment (DORA), referring to the organization's latest report Accelerate: State of DevOps 2018: Strategies for a New Economy ...

September 12, 2018

This next blog examines the security component of step four of the Twelve-Factor methodology — backing services. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages ...

September 10, 2018

When thinking about security automation, a common concern from security teams is that they don't have the coding capabilities needed to create, implement, and maintain it. So, what are teams to do when internal resources are tight and there isn't budget to hire an outside consultant or "unicorn?" ...

September 06, 2018

In evaluating 316 million incidents, it is clear that attacks against the application are growing in volume and sophistication, and as such, continue to be a major threat to business, according to Security Report for Web Applications (Q2 2018) from tCell ...

September 04, 2018

There's a welcome insight in the 2018 Accelerate State of DevOps Report from DORA, because for the first time it calls out database development as a key technical practice which can drive high performance in DevOps ...

August 29, 2018

While everyone is convinced about the benefits of containers, to really know if you're making progress, you need to measure container performance using KPIs.These KPIs should shed light on how a DevOps team is faring in terms of important parameters like speed, quality, availability, and efficiency. Let's look at the specific KPIs to track for each of these broad categories ...

August 27, 2018

Protego Labs recently discovered that 98 percent of functions in serverless applications are at risk, with 16 percent considered "serious" ...

Share this