Monetary providers API and internet software assaults improve by 257%

Managing the assault floor is likely one of the most troublesome challenges dealing with trendy safety groups. In at the moment’s hybrid and multi cloud environments, each single app and API is a possible goal that cybercriminals can and can exploit.  

Right this moment, CDN supplier Akamai Applied sciences, Inc. launched a brand new report revealing a 257% development in internet software and API assaults on monetary service establishments year-over-year.

The identical report additionally discovered that DDoS assaults on monetary providers establishments elevated by 22 p.c yr over yr and located that risk actors are utilizing strategies of their phishing campaigns to bypass two-factor authentication options. 

Whereas the findings pertain to monetary service establishments, the report has broader implications for enterprises and highlights that internet apps and APIs are a core goal for cybercriminals sooner or later. 

API assaults and the rising assault floor 

Akamai isn’t the one vendor to have picked up on the rising development of API assaults. Analysis launched by Noname Safety discovered that 41% of organizations had an API safety incident within the final 12 months, 63% involving an information breach or information loss.

One of many primary causes for the excessive quantity of API exploitation focusing on enterprises and monetary service establishments, is that there’s a huge assault floor of internet functions and APIs that the majority safety groups don’t have the sources or experience to guard. 

“Corporations have moved key infrastructure over to APIS, so the criminals are following the income. However on high of that, APIs are newer and, in lots of instances, don’t have the identical degree of maturity in safety processes and controls, so are extra weak,” stated Advisory CISO at Akamai, Steve Winterfield. 

“Lastly, they’re simpler to automate assaults towards as they’re designed for automation. These components mix to make APIs a wise place for attackers to focus. That is additionally why CISOs must give attention to them,” Winterfield stated. 

Working towards API safety  

There are a selection of steps that enterprises can take to extend their resilience towards API-driven threats. 

At a high-level, Gartner recommends that organizations spend money on applied sciences to routinely uncover, catalog and validate APIs, whereas growing a safety technique that includes API safety testing and API entry management. 

Rising transparency over what inside and third-party APIs are used ensures that enterprises are able to begin mitigating potential vulnerabilities throughout the assault floor. 

As well as, Winterfield recommends enterprises assessment their threat fashions to find out if they’ve acceptable fraud and buyer threats categorized based mostly on this new information, whereas updating phishing defenses to counter the newest MFA assaults with FIDO2-compliant capabilities. 

Extra broadly, implementing trade finest practices and processes akin to Cyber Kill Chain and NIST’s 800-207 Zero Belief Structure will help present larger cyber resilience towards the newest threats.