Top Threat #2 to Cloud Computing: Insecure Interfaces and APIs

Written by the CSA Top Threats Working Group.

The CSA Top Threats to Cloud Computing Pandemic Eleven report aims to raise awareness of threats, vulnerabilities, and risks in the cloud. The latest report highlights the Pandemic Eleven top threats, in which the pandemic and the complexity of workloads, supply chains, and new technologies shifted the cloud security landscape.

This blog will summarize the second threat (of eleven) from the report. Learn more about threat #1 here.

The Importance of Securing APIs

Due to the growing popularity of Application Programming Interface (API) usage, securing APIs has become paramount. Misconfiguration of APIs is a leading cause of incidents and data breaches, and must be checked for vulnerabilities due to misconfiguration, poor coding practices, a lack of authentication, and inappropriate authorization. These oversights can leave the interfaces vulnerable to malicious activities. It could allow for exfiltration, deletion or modification of resources, or service interruptions.

Today, organizations are rapidly adopting APIs with an eye towards improved connectivity and agility. Benefits of doing so include enabling digital experiences for API developers and customers. As APIs streamline a digital ecosystem, cloud technologies are a catalyst for quickly and easily creating or using APIs.

Business Impact

The risk of an insecure interface or API varies depending on the usage and data associated with the API, as well as how quickly the vulnerability is detected and mitigated. The most commonly reported business impact is the unintended exposure of sensitive or private data left unsecured by the API.

What are the key principles for proper API usage?

1. The attack surface provided by APIs should be tracked, configured, and secured.
2. Traditional controls, change management policies, and approaches need to be updated to keep pace with cloud-based API growth.
3. Companies should embrace automation and employ technologies that monitor continuously for anomalous API traffic and remediate problems in near real-time.

Example

In April 2021, it was reported by a security researcher that an Experian partner website let anyone look up the credit score of tens of millions of Americans just by supplying their name and mailing address, according to what KrebsOnSecurity has learned. While the data set belonged to the credit bureau Experian, this service was made available by third parties.

Learn more about this threat and the other 10 top threats in our Top Threats to Cloud Computing Pandemic Eleven publication.