Check out the on-demand sessions from the Low-Code/No-Code Summit to learn how to successfully innovate and achieve efficiency by upskilling and scaling citizen developers. Look now.
Managing the attack surface is one of the most difficult challenges facing modern security teams. In today’s hybrid and multi-cloud environments, every single app and API is a potential target that cybercriminals can and will exploit.
Today, CDN provider Akamai Technologies, Inc. released a new report revealing a 257% year-over-year growth in web application and API attacks against financial institutions.
The same report also found that DDoS attacks on financial institutions increased by 22 percent year-on-year, and found that threat actors are using techniques in their phishing campaigns to bypass two-factor authentication solutions.
While the findings apply to financial services institutions, the report has broader implications for businesses and highlights that web apps and APIs are a core target for cybercriminals in the future.
Intelligent Security Summit
Learn the critical role of AI and ML in cybersecurity and industry-specific case studies on December 8. Sign up for your free pass today.
API attacks and the growing attack surface
Akamai is not the only vendor to address the growing trend of API attacks. Research released by Noname Security found that 41% of organizations had an API security incident in the past 12 months, 63% involved a data breach or data loss.
One of the main reasons for the high amount of API exploitation targeting enterprises and financial institutions is that there is a huge attack surface of web applications and APIs that most security teams do not have the resources or expertise to protect.
“Companies have moved key infrastructure over to APIS, so the criminals follow the revenue. But on top of that, APIs are newer and in many cases don’t have the same level of maturity in security processes and controls, so they are more vulnerable,” says Advisory CISO at Akamai, Steve Winterfield.
“Finally, they are easier to automate attacks against since they are designed for automation. These factors combine to make APIs a smart place for attackers to focus. This is also why CISOs need to focus on them,” said Winterfield.
Working towards API security
There are a number of steps that companies can take to increase their resilience against API-driven threats.
At a high level, Gartner recommends that organizations invest in technologies to automatically discover, catalog, and validate APIs, while developing a security strategy that includes API security testing and API access control.
Increasing transparency over which internal and third-party APIs are being used ensures that enterprises are in a position to begin mitigating potential vulnerabilities across the attack surface.
In addition, Winterfield recommends businesses review their risk models to determine whether they have appropriate fraud and customer threats categorized based on this new data, while updating phishing defenses to counter the latest MFA attacks with FIDO2-compliant capabilities.
More generally, implementing industry best practices and processes such as the Cyber Kill Chain and NIST’s 800-207 Zero Trust Architecture can help provide greater cyber resilience against the latest threats.
VentureBeat’s mission will be a digital town square for technical decision makers to gain knowledge about transformative business technology and transactions. Discover our orientations.