DEVOPSdigest

The majority (75%) of organizations typically change or update their APIs on a daily or weekly basis, creating a significant challenge for protecting the changing API attack surface, according to Securing the API Attack Surface, a report from Data Theorem and Enterprise Strategy Group (ESG).

Results also revealed 92% have experienced at least one security incident related to insecure APIs in the last 12 months, while 57% have experienced multiple security incidents related to insecure APIs during the past year.

To address these API security concerns, organizations will increase spending over the next 12-18 months on:

■ API security tools (45%)

■ Cloud-Native Application Protection Platforms — CNAPPs (43%

■ Integrated application security and API security tools (41%)

The study found that organizations face security challenges with faster development cycles of CI/CD, including:

■ Security lacking visibility and control in development processes (41%)

■ New builds deployed to production with misconfigurations, vulnerabilities, and other security issues (40%)

■ Developers skipping security processes (39%)

■ Software released without security checks and/or testing (38%)

"It's no surprise that most organizations are experiencing API-related security incidents," said Melinda Marks, Senior Analyst for Enterprise Strategy Group. "Modern development cycles bring faster, more frequent product releases and updates, and the growing number of APIs that change on a daily and weekly basis make it imperative to address the changing attack surface. This rapid rate of change also creates shadow APIs and zombie APIs, which can be hackers' favorite APIs to exploit because organizations often do not know about them."

The study also found that the types of API vulnerabilities of greatest concern to organizations are sensitive data exposure due to:

■ No SSL or TLS (34%)

■ Attribute-based access control (ABAC) vulnerabilities (31%)

■ API business logic flaws (31%)

■ Distributed denial of service attacks — DDoS (30%)

"According to ESG, with the overwhelming majority (80%) of organizations reporting that all or most of their cloud-native applications use APIs today, and a similar majority (75%) of organizations typically changing or updating their APIs at least weekly, API and cloud-native security remains a critical issue for organizations today," said Doug Dooley, Data Theorem COO. "The good news the research shows is that two security approaches — API security tools and Cloud Native Application Protection Platforms (CNAPPs) — appear to be the most promising options to help organizations reduce their vulnerabilities to attack, and organizations are taking action over the next 12-18 months to best secure their applications and data."

Methodology: ESG surveyed 397 respondents from private- and public-sector organizations in North America (US and Canada) across IT (38%), Security (30%) and Application Development (32%) on issues, challenges and trends around cloud native applications and API security. The majority of respondents (64%) were from organizations with 1,000 or more employees while 36% were from organizations with 100 to 999 employees.