The Criticality of API Security: Guarding the Gateways of Digital Interactions

The ability to innovate and utilise digital assets is a differentiator that sets leaders apart from laggards in this digital age. At the core of it is the Application Programming Interface (API), the set of rules that enables a software program to transmit data to another software program—at the same time eliminating the labour-intensive, time-consuming task of building or rebuilding applications.

But, as with anything digital, the use of APIs is also a double-edged sword. On the one hand, APIs fuel competitive advantages like greater business intelligence, swifter cloud deployments, and integration of new AI—often with minimal investments in capital, time, and manpower. On the other hand, they also represent an expanded attack surface that, when exploited, can result in business disruptions, financial losses, and critical infrastructure collapse.

The Hidden API Threat

Alarmingly, APIs now comprise over half (58%) of the dynamic Internet traffic processed by Cloudflare, which processes more than 57 million HTTP requests every second. This seeming ubiquity of APIs introduces new risks by allowing outside parties to access an application. Despite this clear vulnerability, API security has fallen behind the fast pace of API deployment. As an example, bot operators are now able to directly—and, sometimes, easily—attack the APIs behind workflows such as account creation, form fills, and payments, stealing credentials, implanting malware, and more.

A complication in this case is that protecting something you do not see is incredibly challenging. That is almost always the case with many organisations, with most of them having 33% more public-facing API endpoints than they knew about as discovered by Cloudflare using its proprietary machine learning model. This model scans not just known API calls, but all HTTP requests, enabling it to identify even API traffic that may be going unaccounted for. This is a major problem, especially with zero-day exploits ever increasing and the weaponisation of disclosed Common Vulnerabilities and Exposures (CVEs) becoming more and more potent.

Cloudflare addresses these very problems, unifying protection across users, apps, networks, and APIs with a connectivity cloud on top of a unified security network. This connectivity cloud:

• Stops various attacks in real-time using powerful rulesets, exposed credential checks, and other security measures.
• Prevents attackers from discovering and exploiting IP addresses, configurations, and IT assets.
• Shifts web browsing to the edge (rather than endpoints), insulating users and devices from web-based threats.
• Detects browser-based attacks, including client-side attacks that target vulnerable JavaScript dependencies and other third-party scripts.
• Adopts zero trust to augment or replace risky Virtual Private Networks (VPN), secure unmanaged devices, reduce data exposure, and mitigate ransomware attacks.
• Stops vulnerability exploits in APIs and web pages, including zero-day attacks and CVE exploitation.

Cloud-Based Solution Transforms Network Security

Popular game operator Mynet is one of the many companies that have turned to Cloudflare’s best-in-class security solutions. In need of a security solution that could solve its perimeter security and remote access problems while maintaining productivity and seamless connectivity, Mynet turned to Cloudflare because of “the speed, usability, and reliability of its products.”

Specifically, Mynet chose Cloudflare’s SSE & SASE platform to secure and isolate its infrastructure and applications from threats on the public Internet, and Cloudflare Gateway to reduce cyber risk and improve administrative and employee efficiency by automatically analysing traffic volumes and intelligently mitigating new threats. This “stress-free transition” to Cloudflare has been a boon to Mynet, resulting in improved usability and better productivity.

This is exactly the kind of protection businesses need to be able to innovate and utilise digital assets in a threat-filled landscape where everything digital is a target—including APIs.

To dive deeper into the statistics discussed in this article, learn more about the emerging threats to APIs, and discover effective defence strategies, download Cloudflare’s comprehensive 2024 API Security & Management Report by clicking here.