Progress announced the early-access release of Progress® MarkLogic® Server 12.
APIs have become the lifeblood of modern software development. These digital messengers allow applications to talk to each other, enabling seamless data exchange and functionality. But as the API economy booms, so does the API monster is lurking in the shadows. The API security market, already experiencing explosive growth, is on track to reach a staggering valuation of over $905 billion by 2031. This surge is fueled by two key factors: the evolving landscape of Generative AI and an expanding attack surface.
API abuse is rampant, impacting organizations of all sizes and industries. Dell became the target of an API attack earlier this year where 49 million customer records were stolen. The worst part of it all, this particular attack wasn't very sophisticated nor was it novel. The attacker used a business logic flaw and an API. This attack emphasizes the increasing complexity of API protection in a continuously expanding landscape of API usage.
Despite increasing awareness, many organizations are still in the initial stages of implementing strong API security. Our recent research, the Salt Security State of API Security Report 2024, painted a concerning picture of the current state of the market. A significant 95% of organizations reported difficulty containing API security incidents, highlighting a massive gap between existing security measures and the evolving threat landscape.
The Expanding Attack Surface
The API security market is facing a growing attack surface due to a confluence of factors. One key driver is the sheer proliferation of APIs themselves. As businesses embrace digital transformation and cloud-based solutions, they produce more APIs to fuel innovation and interconnectedness. A significant percentage (35%) of these organizations are dealing with the security implications of managing over 500 APIs.
Many organizations have also experienced a rapid increase in API growth over the past year. 38% have reported an increase of 51-100%, and another 26% have reported an increase of over 100%. This expansion has created a vast and constantly changing attack surface that is hard to secure with traditional security tools.
Adding further fuel to the fire, threat actors constantly innovate, developing new techniques to target APIs. This includes exploiting zero-day vulnerabilities, leveraging stolen credentials through phishing attacks, or even using bots to automate brute-force attacks against API endpoints.
Traditionally, API security focused on reactive measures, patching vulnerabilities and detecting attacks after they happened. However, GenAI allows attackers to automate tasks, churning out mass phishing campaigns or crafting malicious code specifically designed to exploit API weaknesses. These attacks, known for their speed and volume, easily overwhelm traditional security solutions designed for static environments.
Keeping Up to Stay Ahead
APIs are crucial for modern business operations, driving innovation and customer interactions. However, without proper security measures, APIs can be vulnerable to attacks that can put sensitive data at risk, disrupt operations, and damage customer trust. Our survey revealed that 55% of respondents experienced delays in application rollout due to security issues with their APIs. This underscores the real-world impact of inadequate API security, including delayed innovation, frustrated customers, and lost revenue. Ensuring robust API security isn't just an IT issue, it's a critical business continuity imperative.
Compounding the problem, a staggering 42% of organizations lack a formal process to discover all their APIs. This creates significant blind spots in their security posture. This incomplete inventory is like defending a city with a blindfold on — hidden vulnerabilities become easy targets for attackers.This incomplete inventory makes it incredibly challenging to implement effective security measures and govern the access controls across all APIs. You cannot protect against what you cannot see, right?
Moving in the Right Direction
Traditional API security solutions like WAFs are no longer enough. While WAFs and API gateways offer some protection, a comprehensive API security strategy is crucial for a complete defense that protects APIs throughout their lifecycle and assigns clear security ownership across teams.
Here's how to fortify your API defenses:
■ Define a holistic strategy: This includes API design analysis, continuous discovery, runtime protection with AI/ML, developer feedback loops, security team training, and a shared responsibility model.
■ Assess your current risk: Regularly evaluate your APIs against security best practices, conduct penetration testing, and simulate real-world attacks.
■ Enable frictionless security across environments: API discovery and protection should span all your environments, from on-premise to cloud, and integrate seamlessly without impacting application performance.
■ Prioritize robust runtime security: Advanced runtime protection with AI/ML is crucial to continuously defend against evolving threats and malicious intent hidden within seemingly legitimate traffic. Cloud-based security offers the processing power needed for this sophisticated analysis.
■ Shift left with API posture governance: Integrate security throughout the entire development lifecycle, from design to runtime. This reduces risk by identifying vulnerabilities early and ensuring that APIs are built with security in mind.
Finding Footing for the Future
The growing reliance on APIs necessitates a proactive approach to security. Organizations must move beyond reactive measures, like patching vulnerabilities after attacks occur, and embrace a comprehensive API security strategy. This strategy should encompass the entire API lifecycle, from design to runtime, baking in security from the very beginning.
Rising technologies such as GenAI can and should be implemented and utilized to analyze vast amounts of data better and identify subtle anomalies and malicious intent hidden within seemingly legitimate traffic. By taking these proactive steps, businesses can fortify their API defenses and ensure the secure exchange of data that fuels modern digital interactions. This not only safeguards sensitive information and prevents costly disruptions, but also fosters trust with customers and partners who rely on the seamless flow of data through APIs. Investing in robust API security is no longer optional; it's a strategic imperative for success in today's API-driven digital landscape.
Industry News
Red Hat announced the general availability of Red Hat Enterprise Linux (RHEL) AI across the hybrid cloud.
Jitterbit announced its unified AI-infused, low-code Harmony platform.
Akuity announced the launch of KubeVision, a feature within the Akuity Platform.
Couchbase announced Capella Free Tier, a free developer environment designed to empower developers to evaluate and explore products and test new features without time constraints.
Amazon Web Services, Inc. (AWS), an Amazon.com, Inc. company, announced the general availability of AWS Parallel Computing Service, a new managed service that helps customers easily set up and manage high performance computing (HPC) clusters so they can run scientific and engineering workloads at virtually any scale on AWS.
Dell Technologies and Red Hat are bringing Red Hat Enterprise Linux AI (RHEL AI), a foundation model platform built on an AI-optimized operating system that enables users to more seamlessly develop, test and deploy artificial intelligence (AI) and generative AI (gen AI) models, to Dell PowerEdge servers.
Couchbase announced that Couchbase Mobile is generally available with vector search, which makes it possible for customers to offer similarity and hybrid search in their applications on mobile and at the edge.
Seekr announced the launch of SeekrFlow as a complete end-to-end AI platform for training, validating, deploying, and scaling trusted enterprise AI applications through an intuitive and simple to use web user interface (UI).
Check Point® Software Technologies Ltd. unveiled its innovative Portal designed for both managed security service providers (MSSPs) and distributors.
Couchbase officially launched Capella™ Columnar on AWS, which helps organizations streamline the development of adaptive applications by enabling real-time data analysis alongside operational workloads within a single database platform.
Mend.io unveiled the Mend AppSec Platform, a solution designed to help businesses transform application security programs into proactive programs that reduce application risk.
Elastic announced that it is adding the GNU Affero General Public License v3 (AGPL) as an option for users to license the free part of the Elasticsearch and Kibana source code that is available under Server Side Public License 1.0 (SSPL 1.0) and Elastic License 2.0 (ELv2).
Progress announced the latest release of Progress® Semaphore™, its metadata management and semantic AI platform.
Elastic, the Search AI Company, announced the Elasticsearch Open Inference API now integrates with Anthropic, providing developers with seamless access to Anthropic’s Claude, including Claude 3.5 Sonnet, Claude 3 Haiku and Claude 3 Opus, directly from their Anthropic account.