DEVOPSdigest

The marriage between AI and API security seems like an odd pairing at first. Dubbed a threat to API security, generative AI applications can be easily customized to create and run multiple scenarios to expose weaknesses in APIs. Moreover, given the right datasets, hackers can train AI to plan and execute attacks that evade traditional API security solutions. However, those qualities make artificial intelligence and machine learning the technology that may be missing in your API security stack.

Before we discuss how you can harness AI to secure your APIs, let's talk about why API security is now considered a C-level cybersecurity concern.

Why API Security is the New AppSec

API communications today make up over 80%(link is external) of all traffic on the internet, and the average enterprise uses over 15,000 APIs. The same report found that 41% of organizations surveyed experienced an API security incident last year, and other reports(link is external) claim the number is much higher — up to 76% in some cases. In monetary terms, the average annual cost associated with API-related cyber loss is around $12 to 23 billion(link is external) in the US alone — hefty, to say the least.

But what is it that makes APIs so attractive to malefactors?

A combination of two factors: the sheer volume of API traffic (which is expected to grow twice as fast as HTML traffic) and the ease with which bad actors can bypass traditional API security solutions like WAF, log analysis, and API gateways.

An emerging threat should require advanced protection, yet this isn't necessarily the reality. 77%(link is external) of businesses admit that their existing tools aren't very effective in preventing API attacks(link is external). The same survey revealed that 31% of businesses surveyed had experienced a sensitive data exposure or privacy incident, and 17% were the victims of a security breach resulting from an API attack.

How Can AI/ML Tools Help?

Can the answer to API security challenges be AI? Many answer with an optimistic yes, but only a few envision where AI fits their API security strategies — and how. So, what can AI do for API security?

Secure API Development

The use of AI/ML tools in software development is nothing new, and API developers avidly adopt AI in various aspects of their workflows. 60% of API developers already use AI tools in their work, though only 18% said they use AI to flag potential vulnerabilities in API code.

While not directly related to coding, another way AI/ML tools help secure APIs from the core is by producing and updating the documentation for the many APIs businesses employ.

API Discovery

It takes about forty hours to discover, document, migrate, refactor, and remediate security issues for each API. Considering the API sprawl plaguing enterprises, lack of visibility into the APIs employed is one of the main challenges in API security. Often, organizations focus on high-risk APIs while turning a blind eye to shadow APIs and zombie APIs that may leak sensitive information.

AI-enhanced API management tools can help discover and document the different exit points and provide infosec teams with contextual intelligence on managing and protecting the APIs (or eliminating them if they are no longer used).

API Testing

The most apparent use for AI/ML tools in API security is in testing and validating APIs. Compared to humans, AI tools can write thousands of tests and scenarios to run against your API, and they don't require as much time and resources to achieve broad coverage. So, it's no wonder numerous API management and security products have added AI features to their testing tools.

Behavior Analysis

Another advantage AI has over humans is its ability to instantly spot anomalies in behavior across masses of API calls to uncover potential malefactor activity in their search for exploitable application logic flaws. The tools traditionally used to protect APIs lack the context to detect such supposedly unrelated malefactor actions over time. They also don't protect against API abuse and attacks over authenticated APIs, which count for up to 80%(link is external) of all API attacks.

Prioritization and Contextualization of Alerts

One of the challenges with cybersecurity overall and API threats is the volume of logs and alerts produced. While AI can never fully replace human analysis, it can provide IT, infosec, and DevOps teams with more actionable and contextualized information, as well as prioritize the severity of incidents or vulnerabilities to help resolve the most critical ones in a timely manner.

The Future of API Security With AI/ML Tooling

APIs are vital in modern applications, but traditional API security tools and policy-based mechanisms are no longer enough. As bad actors explore the capabilities of AI, so do API security vendors.

To be effective and accurate, AI must be trained on masses of historical API traffic logs and best practices for threat detection and validation. But, once trained, AI tools can monitor and analyze all API traffic to detect increasingly sophisticated attacks and arm security professionals with the information they need when they need it to stop attacks from becoming breaches.