The Black Unicorn Report for 2021

APIs are the New Cybersecurity Battlefield, But
You're Doing It Wrong
By David Thomason, WW Director of Solution Architects at Noname Security
“For every complex problem there is an answer that is clear, simple, and wrong.”
• H.L. Mencken
Before the global COVID-19 pandemic, Gartner predicted that APIs would become the most-frequent attack
vector by 2022. Necessity, as they say, is the mother of invention. The pandemic forced many to accelerate
their digital transformation journey. Enterprises had to rethink the perimeter, transition to supporting an
almost entirely remote workforce, and adopt multi-cloud infrastructure — APIs became the lifeblood of the
modern digital enterprise.
This rapid shift to an API-first world also accelerated API cyber attacks. It’s safe to say that APIs are already
the most-frequent attack vector ahead of schedule, establishing API security as one of the top initiatives
for CISOs worldwide.
Yes, APIs are under attack, but I caution security leaders of the dangers of treating the symptom instead
of the cause of API vulnerabilities. API security is far more than just attack prevention.
Many of the recent API leaks, like Experian leaking American credit scores or Peloton leaking user data,
were not due to an attack. A single misconfigured API can put an entire environment at risk. API security
is not about protecting APIs, it is about protecting an enterprise’s digital environment from the threats
associated with APIs.
73