Web application program interfaces (APIs) are growing increasingly popular, causing all manner of cybersecurity problems in the process.
This is according to a new report from Noname Security, which surveyed 3,000 employees across 350 businesses about challenges associated with APIs.
The company found that APIs are extremely popular these days, with an average organization leveraging 15,564 APIs in total, up 201% year-on-year.
Security incidents
However, many companies are facing problems. More than two in five (41%) have had an API-related cybersecurity incident in the last twelve months, with almost two-thirds (63%) of those involving a data breach, or data loss.
For example, one of the biggest marketing automation platforms and email marketing services, MailChimp, was breached by attackers who also also accessed API keys (now defunct) from an unknown number of customers.
With the keys, the attackers could create custom email campaigns and send them to mailing lists without accessing the MailChimp customer portal.
Almost all (90%) companies have API authentication policies set up, but a third (31%) said they weren’t exactly confident these policies provided an adequate level of protection.
What’s more, a third (35%) have had projects delayed due to API security concerns, with 87% of those believing that integrating API security testing into developer pipelines could have prevented the delays.
Roughly half (51%) are fully confident in their API inventories, with a quarter (26%) adding that their inventory update processes are manual.
“With API usage continuing to grow, this extreme level of use and dependency has enabled many vulnerabilities to rise to the surface, making securing these APIs across sectors more paramount than ever,” said Daniel Kennedy, Principal Research Analyst at 451 Research.
“This report should help enterprises of all sizes across various sectors make the informed decisions they need when developing their API security strategy.”
