In this week’s blog post, we are sharing insights based on our latest interview with Pat Clawson, the Chairman and CEO at Resurface, a business that offers a simple method for enhancing API security. It’s built to facilitate data, inter interchange between channels, teams, and systems, and configured to capture API traffic from all sources.

Our topic for today is how companies can understand their business exposure to intelligently address risk management.

What is API Security and How It is Related to Risk Management?

API stands for Application Programming Interface. An API is a set of rules that describes how software components should interact. APIs are used to make it easier to develop applications and share data across different apps. API security is the practice of protecting the confidential information and data passing through the API. In short, it’s about making sure your app’s user account or password doesn’t get stolen by hackers or malicious bots before reaching its destination — a database, for example — and ensuring that it can’t be altered en route either.

Today virtually every company has an API because APIs allow businesses to deliver products more quickly and easily than ever before. It’s also one reason why companies like Google and Facebook have become dominant players in today’s digital economy: They offer developers access to their massive stores of customer data at no charge so they can build new products with minimal overhead costs. There has been an explosion of API technologies in communication over the last five to ten years. With that, it was probably even exacerbated by the shutdown around Covid with the explosion of apps, which leverage APIs for communication.

However, even with the vast use of API technologies, no one was really doing much about protecting that active surface, leading it to be exposed. Due to its high volume, it’s often responsible for a majority of companies revenues, but no one was watching what was going on. If a user was authenticated and they were legitimately inside that API or microservices, no one was watching what their behaviour was like we do on a laptop, at desktop, a server or a virtual environment or even cloud storage locations. The API was no man’s land, so the industry started to evolve around the concept to make sure it’s healthy and safe at the same time.

How Can Risk Managers Manage Their Exposure to Different Cybersecurity Threats?

Cybersecurity risk management is a critical component of running a business, especially in this day and age. The cyber world is constantly evolving and changing; it’s important for risk managers to stay on top of new cybersecurity threats and make sure their organisations are protected from them. You can do this by reviewing the risks your organisation faces every day — and knowing how your risk management system can help you mitigate those risks.

Alongside this, there is an incredibly growing and large number of laws and regulations and also an increasing number of threats and technology continues to evolve. This can look daunting at the start as it’s a never ending process. As a result, it is the responsibility of the risk manager to make this digestible to the executive team and board.They need to figure out how to communicate to that group of people about their overall risk posture and what they need to do and improve it. Otherwise it can lead to not achieving the budget required to keep the business safe. In order to ensure business continuity, compliance and risk teams must continuously understand changes in their risk posture and communicate those changes effectively to their business leaders.

API and Privacy Compliance

In addition to GDPR, all of the same regulatory requirements apply to API architectures and infrastructures, as we use more and more integrated apps with our personal data, such as banking apps and healthcare apps. So you have a responsibility to protect that data as it’s being used, and then you also have the responsibility to make sure you’re not violating GDPR when you’re doing it. With that, vendors have started to be reckless in this space when they are hosting their environment on Cloud such as AWS or Google, whilst trying to secure their API’s in other locations, such as in EU. So a lot of the vendors have stood themselves up in a third party format, but you really need to think about what that means or what you’re actually capable of doing. Legally, it’s quite limited.

Misconceptions Around API

The role of the DevOps team usually has misconceptions around it. Typically, there are three big stakeholders in securing your APIs. You’ve got your DevOps teams that are building API’s, but there are also the asset teams and security Ops teams that are involved. So what we’re finding is when DevOps is largely involved, they’re the ones who built the APIs, however, they’re not necessarily testing them before they put them into production.

They don’t know if they have code based anomalies, slow performance, or bad code. And if you don’t have a tool to look at it beforehand or in production, you’re never gonna know what the problems are, which are creating, if you follow these guidelines, those anomalies are future attack platforms, like a slow performing API, maybe a future DDoS attack. So the DevOps teams should start with understanding and testing the API before it is put out, so that it can be also monitored better to see if they’ve got leaks, but in general the totality of their API attack traffic so they can start dealing with it better.

What Should Risk Managers Prioritise?

First step should be identification or discovery, in order to understand your business risks properly. They can find vendors to help them summarise exactly what the totality of their API traffic is and what the outcomes are, and if you’re getting positive results from it. This also allows them to check whether there are malforms that they can look into and fix. Overall, the priority should be understanding the totality of your API traffic and its outcomes so that you can put a budget around it and then act.

As we’ve mentioned previously, communication is the key, and should be upkept as it is a never ending cycle. Next year’s risk issues will be different from this year’s risk issues. It’s a great industry and it’s a great space, but risk managers must embrace the changes and learn how to communicate. This will be a huge deal, especially for intelligently addressing business risks and planning ahead.

Upcoming Trends In API and Cybersecurity Space

Cybersecurity has become one of the most important issues in the modern world. It used to be impossible to imagine a world where everything is connected to each other and available online. In addition, it is almost impossible to separate digital content from physical assets. This makes cybersecurity a crucial issue for many businesses and organisations. There’s a pretty big magnifying glass on this space at the moment. Companies are preparing for API security as a part of their budgets for the upcoming years. With that, we can expect API Security to become more significant and feature in larger platforms, instead of being a standalone technology.

Another emerging trend in the cybersecurity space is the use of AI and Machine Learning (ML). Organisations are increasingly adopting AI and ML for various security-related applications. For instance, machine learning algorithms can be used to identify anomalies in network traffic patterns to detect potential attacks. Similarly, there are several tools available today that enable users to build their own custom-made threat intelligence models using the data they have collected over time. In addition to these benefits, ML also helps improve accuracy and speed up detection rates compared with manual detection methods such as signature scanning or anomaly-based monitoring. One area where AI has seen significant adoption is cloud environments due to its ability to automatically adapt itself based on previous experiences; so far most organizations that use cloud services still rely on human experts for help when it comes down deploying new applications or maintaining them but with advances in artificial intelligence technologies we may see fewer incidents due to misconfigurations and such.

The future of cybersecurity is highly dependent on the adoption of these new technologies. This will help organisations’ security operations become more automated and make it easier for them to detect threats that are happening within their environment.

Closing Words

For now, this sums up the key points of our interview. As the Global Risk Community team, we once again thank Pat Clawson, for providing his insight API, cybersecurity and intelligent risk management.

More information about this topic is available in our original interview, which is accessible here.

#risk #API #cybersecurity #data #riskintelligence