API Security Survey Reveals Most Companies Not Yet Using API-Specific Controls

Survey Reveals Phishing, Missing Patches Are Top Concerns

Akamai Technologies, Inc. (NASDAQ: AKAM), the cloud company that powers and protects life online, recently released the results of a new survey of application security professionals on what they view as the top security risks related to Application Programming Interfaces (APIs).

The 2023 SANS Survey on API Security found that less than 50 percent of respondents have API security testing tools in place. Even fewer have API discovery tools (29 percent). What’s more, the report finds that taking advantage of API security controls that are included in DDoS and load balancing services is “an underutilized area.” Just 29 percent of respondents reported using these features.

Akamai partnered with the SANS Institute on the survey which was conducted in the first quarter of 2023 to determine enterprise awareness, readiness and future plans for dealing with API security risks. The 231 global respondents were primarily application security professionals.

Modern applications increasingly use APIs to capture business processes and break them into the communications required to efficiently enable business partners and customers to work with an organization. A recent State of the Internet report by Akamai noted that 2022 was a record breaking year for application and API attacks.

Survey participants ranked phishing (38.3 percent) and missing patches (24 percent) as the top two API security concerns. These were followed by exploitation of vulnerable applications/APIs (12 percent) and accidental disclosure of sensitive information (9.1 percent).

Other key findings of the survey include:

• 62 percent of respondents are using web application firewalls as part of API risk mitigation.

• Most (57.1 percent) respondents reported API inventory accuracy of between 25 percent and 75 percent.

• Most respondents cited the OWASP (Open Web Application Security Project) Application Security and API Top Ten lists, and the MITRE ATT&CK Framework as the basis for defining application and API risk.

• 76 percent of survey takers reported training development staff on application security.

“This new survey offers the industry perspective on a topic which will continue to be one of the top security issues of 2023 and beyond,” said Rupesh Chokshi, Senior Vice President and General Manager, Application Security at Akamai. “The results show enterprises need to place more focus on both where and how many APIs are running, because vulnerable APIs are becoming the most common access point for attacks.”

“The key takeaways of this survey are that security hygiene controls like strong authentication, asset inventory, vulnerability management and change control need to address API security issues," said John Pescatore, Director of Emerging Security Trends with SANS. “Prevention and detection need to be upgraded to deal with API-centric attacks, and infrastructure services (such as content delivery networks and denial of service filtering) need to be put to work, as well.”