API security worries hold back business innovation

A new report shows that 66 percent of organizations admit slowing the rollout of a new application into production because of API security concerns.

The State of API Security report from Salt Security also reveals that 54 percent of organizations running production APIs have at best only a basic strategy for API security, with 27 percent having no strategy at all.

"In today's digital economy, APIs are the direct gateway to organizations' most critical data and assets. Built to enable customers and partners, these APIs create risk by also providing a path for attackers to follow. As APIs have grown in volume and functionality, they've made ever more attractive targets for hackers, driving up the number and sophistication of API attacks," says Roey Eliyahu, CEO and co-founder of Salt Security. "We compiled the industry's first State of API Security Report to better understand the enterprise experience of APIs today. The study makes clear that companies' current approaches for securing APIs have gaps that leave them at risk. It also highlights how organizations need new approaches to API security if they are to continue innovating safely and remain competitive."

It shows 91 percent had suffered an API security problem last year. Vulnerabilities (54 percent) and authentication issues (46 percent) top the list, followed by bot/scraping (20 percent) and denial of service attacks (19 percent). Finding a vulnerability in a production API means that pre-production vetting, while crucial, isn't preventing vulnerabilities from making their way into production rollouts.

More worrying is that Salt customer data shows the number of API attacks per month per customer is up from 50 last June to nearly 80 by December. More concerning still is that nine percent of respondents admit they can't identify API attacks. In addition only 16 percent of respondents are very confident that their API inventory is complete.

Of organizations responding to the survey 80 percent don't believe their security tools can prevent API attacks effectively. Also 82 percent lack confidence in knowing API details such as exposed PII, which might include CPNI, PHI, cardholder data, and other sensitive information, 22 percent admit they have no way to know which APIs expose PII.

You can read more on the Salt Security blog.

Photo Credit: Panchenko Vladimir/Shutterstock