Recent Events in Australia and API Security

Recent events in Australia have yet again highlighted the importance of cybersecurity, specifically relating to APIs. The real-world impacts of ineffective API security have affected businesses and the public. Government efforts have increased to mitigate and manage the risks and effects of lapses in API security. It is becoming clearer that secure APIs are critical to organizations that use them and the customers and public they serve.

Aiculus has deep industry knowledge and expertise in the field of API security, dating back to 2017. Over the last 5 years, Aiculus has provided API real-time security monitoring and developed API security architectures and standards for fintechs, banks, telcos, and government departments. As API security becomes topical again, we recommend that organizations consider the following:

  1. Development of APIs follows a secure development lifecycle
  2. Security standards for internal, external, and third-party APIs
  3. API security monitoring with real-time reporting
  4. Consistent adherence to security protocols and guidelines

1. Secure API Development Lifecycle

Today, most companies with digital service offerings have multiple APIs and API accessible services. The proliferation of agile methodologies for software development and continuous integration/continuous deployment (CI-CD) results in organizations constantly pushing changes on API services at rapid rates. A recent report showed that a large US retail company publishes 150,000 changes a month to a key component of their digital services platform, indicating the high activity and importance of APIs for organizations offering their services digitally.

Organizations with digital service platforms must continuously evolve to stay relevant. These constant changes require a robust security approach at the design, implementation, and operation of APIs. A gap in any of these phases can lead to dire and expensive consequences in the event of data breaches. While fines can be paid and some damages rectified, the loss of reputation and customer trust are among the hardest to win back. Failing to establish robust security can lead to government intervention and more stringent requirements.

2. API Security Standards / Design Principles

The problem with API security is not the lack of technology; rather, it often lies in the standards and principles on which APIs are designed. For example, implementing the right API security design principles can limit dependencies between APIs, avoiding domino effects in the event of a breach. APIs built on solid security foundations that incorporate the organization’s business context will mitigate damage when compromised.

3. API Security Monitoring

Aiculus believes that the most critical API is one that is operational, connecting systems or carrying out a user request involving sensitive data. With over 80% of recent API breaches occurring post-authentication, screening API requests and API transactions for anomalies is essential for operational-critical APIs. While many organizations have invested in security standards and processes, few maintain adaptive real-time security monitoring and analytics of API traffic, with many relying solely on Web Application Firewalls (WAFs) for mission-critical APIs.

4. API Security Protocols Followed Consistently

In cybersecurity, writing policies is the easy part; the challenge lies in compliance and enforcement. For APIs, defining standards and secure deployment processes is crucial. Keeping up with processes when multiple APIs are frequently changed or published is vital. Even urgent APIs must adhere to necessary protocols to minimize risks stemming from oversights.

Aiculus Can Help

Organizations today cannot afford to skimp on API security. Aiculus is prepared to share our knowledge and insights on these matters. Supported by a comprehensive engineering team through our DigiEx partnership, we can scale deployment, support, and maintenance of our solutions.

To ensure confidence in your organization’s security governance and processes or to review your current API environment, the expert team at Aiculus is ready to support you in building and operating APIs securely. Reach out to our team of experts by emailing contact@aiculus.co.