In API Security, Complacency is the Enemy

Chuck Herrin

In the realm of modern software development, the security of APIs is a critical pillar of modern digital architecture. As businesses become increasingly interconnected, APIs emerge as crucial links binding these systems together. Their role is fundamental, yet this very centrality gives rise to significant security responsibilities. The rise of generative AI provides yet another tailwind to API adoption, as regardless of the use case, most AI usage will call API endpoints as their primary means of communication.

Protecting APIs transcends the defense of individual software components—it’s about preserving the integrity of an entire ecosystem. These interfaces channel core business logic, data, and functionality outward, potentially becoming vectors for devastating breaches that can cause not only financial harm but also erode trust in the organization.

Don’t Fight the Last War

The battlefield of cybersecurity is ever-changing, with API and AI-driven attacks distinguishing themselves from traditional threats. If our defenses are informed by past offenses alone, we're fighting the last war—a strategy doomed to fail. The onslaught against APIs and AI systems differs fundamentally from the attacks we’ve previously weathered. Legacy technologies, including the most sophisticated web application firewalls (WAFs), fall short against the nuances of contemporary API and AI vulnerabilities. Your defense must be informed by the offense, and new architectures expose new attack surfaces that legacy processes were never designed to address. Our defense strategy must be as dynamic and nuanced as the threats we face, constantly evolving to address the shift in attack patterns.

Embrace the New Front

API security now underpins nearly all software development, with APIs being integral to modern architecture. With API-first development strategies and the increasing use of AI models, the reliance on APIs has skyrocketed. In fact, 92% of the attacks we observe across our global network are attacks on API endpoints, underscoring their allure to attackers. We also know that in the bot and automated attack space, roughly 90% of damage is caused by the most effective 10% of attackers. If your API security strategy isn’t up to par, you’re missing a critical piece of your defense architecture, both now and for the future. This is more than a gap—it's a massive chasm.

What We Can Do

In my view, there are a few important things we can do about this:

Acknowledge the prevalence and novelty of API attacks. Realize that your current and future digital framework is predicated upon APIs. API traffic is now the majority of web traffic, and ignoring API security is not an option—dive into it, understand it, prioritize it.

Arm against evolving threats. Understand that the defense measures of yesterday are inadequate against today’s API and AI threats. There’s a reason that groups like OWASP have new Top Ten lists for APIs and AI weaknesses, and your defenses must adapt to these changes in architecture and attack methods. F5 can assist in fortifying your infrastructure by sharing knowledge on the nature of these modern attacks and the solutions we’ve developed in response.

Understand The Limitations of Partial Solutions. Security strategies that focus solely on a portion of the lifecycle—from code to customer—fall short. Visibility is key. Without a comprehensive view of where your APIs reside, whether in code, traffic, or third-party integrations, you can't fully understand, document, or test them. This lack of understanding directly impacts your capacity to anticipate and respond to unexpected inputs. And in the fluid landscape where API surfaces morph with every code update or infrastructure shift, constant vigilance is imperative.

Get End-to-End Visibility and Automation. Only a purpose-built, end-to-end solution can offer the complete visibility necessary to keep pace with the rapid evolution of API landscapes. Manual efforts are no longer sufficient; automation is essential to capture the continuous changes and to ensure comprehensive monitoring and documentation. In addition, while technology alone can’t solve people or process problems, thoughtful technology design can help multiple stakeholders within an organization gain understanding to make it easier for multiple teams to collaborate and work together.

The Vigilance Imperative

To conclude, the domain of API security is characterized by relentless change and the imperative of perpetual vigilance. As the digital landscape advances, so too do the methodologies of adversaries. For those of us committed to securing digital assets, it is imperative to remain informed and agile, and remember that your attack surface is driven primarily by your architecture. Security is not just a technical challenge but a cultural one, infusing every aspect of our work from API design through deployment. The trust our customers place in us, and the security of our digital future, demands nothing less.

In API security, the adage rings true: complacency is indeed the enemy. We must stay alert and proactive, reinforcing our defenses against the next wave of digital threats, not the last. The future of our digital world depends on it.

About the Author

Chuck Herrin

More blogs by Chuck Herrin