APIs (Application Programming Interfaces) are a key part of digital transformation strategies, and securing those APIs is a top challenge. APIs are a rapidly growing attack surface that isn't widely understood and can be overlooked by developers and application security managers.
Let’s let OWASP API Security Project take this: “APIs are a critical part of modern mobile, SaaS and web applications and can be found in customer-facing, partner-facing and internal applications. By nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.”
Again, from OWASP:
API Security focuses on strategies to mitigate the unique security risks of APIs. Traditional vulnerabilities are less common in API-Based apps:
API security is important because businesses use APIs to connect services and to transfer data, and so a hacked API can lead to a data breach. API abuse issues have roughly doubled over the past 4 years, according to the 2019 Application Security Risk Report by Micro Focus Fortify. The 2018 data show 35% of the analyzed Web applications had API abuse problems, and the incidence increased to 52% for mobile applications.
API security testing is one of the innovation factors in the Gartner MQ for Application Security Testing.
Organizations are...moving from more traditional monolithic web applications to more modern applications such as those that make heavy use of client-side JavaScript (and invoke many server-side APIs) or ones that utilize microservices architecture. This results in smaller distinct units of functionality and often results in an explosion of web APIs to interact with those microservices. Security testing of APIs is currently a challenge for organizations, which need better capabilities to automatically discover APIs and conduct testing than what current DAST and SAST technologies offer.
OWASP recently announced the API Security Top 10 Release Candidate. Read more about the OWASP API Security Project (and check out presentation deck in the Quick Links section). Here is the top 10:
Fortify scan APIs with Fortify WebInspect:
Watch these demos on our Fortify Unplugged YouTube channel:
How does NetIQ Secure API Manager work?
Watch this demo on our NetIQ Unplugged YouTube channel:
