{"id":5990,"date":"2018-11-15T00:00:00","date_gmt":"2018-11-15T00:00:00","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/2018\/11\/15\/how-to-control-api-security-risks\/"},"modified":"2021-08-23T18:44:53","modified_gmt":"2021-08-23T18:44:53","slug":"how-to-control-api-security-risks","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/applications\/how-to-control-api-security-risks\/","title":{"rendered":"How to Control API Security Risks"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
\n<\/p>\n

<\/span><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n

The enterprise use of APIs (application programming interfaces) is exploding, as more and more businesses embark on digital transformation and look for ways to make money by exposing their data to outsiders through apps, websites, and other third-party integrations.<\/p>\n

The downside to all those APIs is they can pose a major IT security risk.<\/p>\n

“APIs represent a mushrooming security risk because they expose multiple avenues for hackers to try to access a company’s data,” warned Terry Ray, chief security officer for Imperva. “To close the door on security risks and protect their customers, companies need to treat APIs with the same level of protection that they provide for their business-critical web applications.”<\/p>\n

The source of the risks posed by APIs is explained comprehensively by Scott Morrison, a distinguished engineer at CA Technologies, in a white paper<\/a> on API security.<\/p>\n

“The problem with APIs is that they often provide a roadmap describing the underlying implementation of an application \u2013 details that would otherwise be buried under layers of web app functionality,” he said. “This can give hackers valuable clues that could lead to attack vectors they might otherwise overlook. APIs tend to be extremely clear and self-documenting at their best, providing insight into internal objects and even internal database structure \u2013 all valuable intelligence for hackers.”<\/p>\n

Morrison adds that increased visibility is not the only risk APIs introduce. “Increasing the number of potential calls also increases the attack surface, meaning that a hacker simply has more to exploit.<\/p>\n

“Risk,” he said, “increases with opportunity.”<\/p>\n

How API security can be breached<\/h2>\n

\u00a0In practical terms, there are three main ways (but not the only ones) in which APIs can be exploited by malicious actors to gain access to data or computing infrastructure, according to Morrison.<\/p>\n

These are:<\/p>\n