In a recent surge within the digital sphere, APIs have eclipsed other forms of internet traffic, becoming a pivotal component of our online world. The 2023 API Security and Management Report indicates that APIs now account for more than half (57%) of the dynamic internet traffic processed by Cloudflare in the past year.
Yet, this rise in API dominance brings with it a set of intricate challenges, particularly in management and security. Cloudflare’s ML algorithms detected 30.7% more API endpoints than what was self-reported by the organizations. According to the report, this gap underscores a worrying underestimation and potential vulnerability in API management.
APIs that have not been managed or secured by the organization using it — also known as ‘Shadow’ APIs are often introduced by developers or individual users to run specific business functions,” the report stated. “While they are not inherently malicious, shadow APIs are essentially unprotected attack surfaces that introduce new risks. If exploited, shadow APIs can lead to data exposure, unpatched vulnerabilities, data compliance violations, lateral movement, and other threats.”
The report also found that over half (51.6%) of API error rates comprised “Too Many Requests” at 429 errors. This error speaks to rate-limiting concerns where the client has sent too many requests within a given timeframe, a mechanism web services use to control traffic and prevent abuse.
The 400 “Bad Request” error is next, making up 13.8% of the reported problems, often caused by sending data that the server cannot parse. The 404 “Not Found” and 401 “Unauthorized” errors follow closely, indicating that the requested resource is unavailable or the client lacks the necessary credentials to access it, according to the report.
Best practices for security and management from the report start with the call for a unified approach that encompasses application development, visibility, performance, and security. This holistic perspective can be facilitated through a connectivity cloud, which acts as an intelligent platform connecting networks, cloud environments, applications, and users. Key aspects include automated API discovery for a comprehensive inventory of APIs, modern authentication and authorization processes, and endpoint management to monitor metrics like latency, errors, and response size.
Additionally, moving towards a “positive security” model is emphasized in the report, particularly through the use of an API gateway. This model operates on allowing only verified and known behaviors and identities, as defined by the API schema, and rejecting all others. This approach helps in effectively blocking malformed requests and HTTP anomalies which could lead to security breaches. Machine learning technologies are also recommended to aid in uncovering all API traffic, detecting attack variations, and differentiating between legitimate user traffic and potential malicious bot traffic.
