Financial providers API and internet utility assaults improve by 257%

Managing the assault floor is among the most troublesome challenges dealing with trendy safety groups. In immediately’s hybrid and multi cloud environments, each single app and API is a possible goal that cybercriminals can and can exploit.  

Today, CDN supplier Akamai Technologies, Inc. launched a brand new report revealing a 257% development in internet utility and API assaults on monetary service establishments year-over-year.

The identical report additionally discovered that DDoS assaults on monetary providers establishments elevated by 22 % 12 months over 12 months and located that risk actors are utilizing methods of their phishing campaigns to bypass two-factor authentication options. 

While the findings pertain to monetary service establishments, the report has broader implications for enterprises and highlights that internet apps and APIs are a core goal for cybercriminals sooner or later. 

API assaults and the rising assault floor 

Akamai isn’t the one vendor to have picked up on the rising pattern of API assaults. Research launched by Noname Security discovered that 41% of organizations had an API safety incident within the final 12 months, 63% involving an information breach or knowledge loss.

One of the primary causes for the excessive quantity of API exploitation focusing on enterprises and monetary service establishments, is that there’s a huge assault floor of internet functions and APIs that the majority safety groups don’t have the assets or experience to guard. 

“Companies have moved key infrastructure over to APIS, so the criminals are following the revenue. But on top of that, APIs are newer and, in many cases, don’t have the same level of maturity in security processes and controls, so are more vulnerable,” stated Advisory CISO at Akamai, Steve Winterfield. 

“Finally, they are easier to automate attacks against as they are designed for automation. These factors combine to make APIs a smart place for attackers to focus. This is also why CISOs need to focus on them,” Winterfield stated. 

Working towards API safety  

There are quite a few steps that enterprises can take to extend their resilience in opposition to API-driven threats. 

At a high-level, Gartner recommends that organizations spend money on applied sciences to routinely uncover, catalog and validate APIs, whereas growing a safety technique that includes API safety testing and API entry management. 

Increasing transparency over what inner and third-party APIs are used ensures that enterprises are ready to begin mitigating potential vulnerabilities throughout the assault floor. 

In addition, Winterfield recommends enterprises evaluate their danger fashions to find out if they’ve acceptable fraud and buyer threats categorized primarily based on this new knowledge, whereas updating phishing defenses to counter the most recent MFA assaults with FIDO2-compliant capabilities. 

More broadly, implementing trade finest practices and processes reminiscent of Cyber Kill Chain and NIST’s 800-207 Zero Trust Architecture will help present better cyber resilience in opposition to the most recent threats.