
Security as a Primary Concern for API Management
The use of APIs has radically increased over the years, and with organisations using many different types of APIs regularly, API management is now essential for managing the API attack surface.
By
CIO Applications Europe | Wednesday, June 21, 2023

A perfect API management system oversees all APIs in a secure, scalable landscape with tools and services enabling developers to establish, deploy, secure, and manage APIs.
FREMONT, CA: The use of APIs has radically increased over the years, and with organisations using many different types of APIs regularly, API management is now essential for managing the API attack surface. A recent survey shows that over half of organisations’ development efforts are spent on APIs. Moreover, most companies’ development efforts focus on APIs, but firms moving further and building an API-first approach will outperform and have a more optimistic business outlook.
As organisations navigate an uncertain economy, API-first strategies become the backbone, allowing companies to respond rapidly and seamlessly.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
Despite many C-level executives believing that the economy is deteriorating, a vast majority feel that API investment is normal and will even increase over the coming years. This wide expansion has led companies to be more API consumers than producers, increasing the need for API management to handle many of the tasks encompassing APIs than before.
The ultimate form of API management oversees all APIs in a secure, scalable environment with tools and services that enable developers to build, deploy, secure, and manage APIs. However, this seems impractical and difficult to obtain.
API management problems arise from the sprawl of APIs. These issues include companies' platforms built around the single gateway concept. With a single gateway, businesses install an API gateway in their architecture and funnel API traffic through that gateway. The problem with this architecture is that when organisations have many different teams and applications producing and consuming APIs, there is no single place to put the gateway.
Businesses using multiple cloud platforms encounter more challenges. There will be sprawl on one side; on the other, there will be several obsolete API management products in their architecture. The reason is that the multi-gateway world has become a reality.
Individuals talk about the need for organisations’ gateway models, but companies need the API lifecycle management that goes with that. At the same time, some of the traditional API management suppliers have started to include verbal support for other gateways.
The two essential aspects of managing API security are strong inventories and real-time discovery to gain visibility into APIs. Although some specialised security controls exist, their API discovery features are limited and lack application logic awareness to create relevant security policies. This indicates that application security teams will deploy perimeter controls with threat inspection capabilities but will be constrained to generic policies and detection signatures.
The API management tools focused on a single gateway leave many APIs exposed. In many scenarios in a typical modern web application stack where one has their front end using a frontend framework and a lot of APIs in the backend, there is not a gateway in between. Although this would not put a heavyweight gateway there, those APIs often fall victim to attacks as people reverse engineer the front end and directly access the APIs. Furthermore, affected APIs did not go through an application farewell in many breach cases.
More in News
Weekly Brief
I agree We use cookies on this website to enhance your user experience. By clicking any link on this page you are giving your consent for us to set cookies. More info
Be first to read the latest tech news, Industry Leader's Insights, and CIO interviews of medium and large enterprises exclusively from CIO Applications Europe
THANK YOU FOR SUBSCRIBING


