APIs (Application Programming Interfaces) are a key part of digital transformation strategies, and securing those APIs is a top challenge. APIs are a rapidly growing attack surface that isn't widely understood and can be overlooked by developers and application security managers.
Take it from the OWASP API Security Project: “APIs are a critical part of modern mobile, SaaS, and web applications and can be found in customer-facing, partner-facing, and internal applications. By nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.”
Again, from OWASP:
API Security focuses on strategies to mitigate the unique security risks of APIs. Traditional vulnerabilities are less common in API-based apps:
API security is important because businesses use APIs to connect services and to transfer data, so a hacked API can lead to a data breach.
In December 2021, Cloudflare reported that API calls accounted for 54% of total requests and increased 21% from February to December 2021. Attackers have taken notice and increased their focus on APIs.
API security testing is part of the core capabilities in the Gartner MQ for Application Security Testing.
APIs have become an essential part of modern applications (e.g., single-page or mobile applications), but traditional AST toolsets may not fully test them, leading to the requirement for specialized tools and capabilities. The ability to discover APIs in both development and production environments and test API source code, as well as the ability to ingest recorded traffic or API definitions to support the testing of a running API, are typical functions.
OWASP recently announced the API Security Top 10 Release Candidate. Read more about the OWASP API Security Project. Here is the top 10:
Smarter, simpler protection
Unlock security testing, vulnerability management, and tailored expertise and support
Find and fix security issues early with the most accurate results in the industry
Identify vulnerabilities in deployed web applications and services
Enable single sign-on and access control across mobile, cloud, and legacy platforms