Latest Akamai Security Research examines global API security landscape; reveals 2020-2021 attack traffic trends

Akamai Technologies released new research into the evolving threat landscape for application programming interfaces (APIs), which according to Gartner will be the most frequent online attack vector by 2022. The report, ‘API: The Attack Surface That Connects Us All,’ is the latest from Akamai’s State of the Internet / Security report series. The new report also features a collaboration between Akamai and Veracode researchers, including a guest essay written by Chris Eng, Chief Research Officer at Veracode.

APIs are inherently designed to be fast and easy pipelines between different platforms. While this priority on convenience and user experience leads APIs to be highly essential to many businesses, it also makes them appealing targets for cybercriminals. Akamai’s report highlights the frustrating patterns of API vulnerabilities, despite the improvements that have been made in Software Development Life Cycles (SDLCs) and testing tools. Often, API security is relegated to an afterthought in the rush to bring them to market, with many organizations relying on traditional network security solutions that are not designed to protect the wide attack surface that APIs can introduce.

Steve Ragan, Akamai security researcher and author of the State of the Internet / Security report, said, “From broken authentication and injection flaws, to simple misconfigurations, there are numerous API security concerns for anyone building an internet-connected application. API attacks are both underdetected and underreported when detected. While DDoS attacks and ransomware are both major issues, attacks on APIs don’t receive the same level of attention, in large part because criminals use APIs in ways that lack the splash of a well-executed ransomware attack, but that doesn’t mean they should be ignored.”

It’s not always clear where API vulnerabilities live. For example, APIs are often hidden within mobile apps, leading to the belief that they are immune to manipulation. Developers make the assumption that users will only interact with the APIs via the mobile user interface (UI), but, as noted in this report, that’s not the case.

Chris Eng, Chief Research Officer at Veracode stated, “Compare the OWASP Top 10 to the OWASP API Security Top 10. The latter purports to address the ‘unique vulnerabilities and security risks’ of APIs, but look closely and you’ll see all of the same web vulnerabilities, in a slightly different order, described with slightly different words. To add more fuel to the fire, API calls are easier and faster to automate (by design!) — a double-edged sword that benefits developers as well as attackers.”