97 Things Every Application Security Professional Should Know

Chapter 81. API Security: The Bedrock of Modern Applications

Charan Akiri

The evolution of software from monolithic architectures to microservices has elevated the importance of APIs. APIs facilitate interactivity among software components, systems, and third-party services, and they have become the gateways to a plethora of services and data. Thus, APIs have become prime targets for cyber adversaries. Breached APIs can result in unauthorized data access, system infiltrations, and even complete system takeovers. Their often subtle presence can lead to oversights during security assessments. These oversights can create many potential vulnerabilities. In this world progressively defined by integration and connectivity, ensuring the security of APIs is paramount.

API breaches can wreak havoc, revealing confidential data and core functionalities of an organization’s software infrastructure. Some significant breaches within the past five years include:

Facebook (2019)

A third-party Facebook app’s API was exploited, compromising over 530 million users’ data.

LinkedIn (2021)

An open API led to a data breach affecting nearly 700 million users.

T-Mobile (2022)

A breach through one of T-Mobile’s APIs exposed 37 million customers’ personal details.

OWASP underscores API security’s significance by enumerating potential API risks in its renowned OWASP Top 10 API list, including Broken ...