In the Alleys of Black Hat and DEF CON 2023: The Quiet API Security Crisis – Source: securityboulevard.com

The neon lights of Black Hat and DEF CON, with their flashing demos and groundbreaking presentations, often dazzle attendees and cyber enthusiasts alike. From AI-driven hacking tools to quantum encryption, the subjects covered span a vast spectrum. However, as with any vibrant city, these include areas of risk and concern. For Black Hat 2023 events, APIs are core to these areas.

The conspicuous absence of dedicated API security talks at Black Hat

Historically, APIs have been overshadowed by more visible security threats, often relegated to the backdrop of cybersecurity discussions. This complacency stems from a time when APIs were perceived as secondary targets, ensconced behind robust security barriers. However, with the digital landscape’s transformation, the usage of APIs has exploded, amplifying the  interconnectedness of services, making APIs more vulnerable and, consequently, attractive targets.

Despite the omnipresence of APIs in today’s digital infrastructure, Black Hat curiously lacked sessions solely dedicated to API security. Yet, a significant portion of the web application attack talks highlighted the looming threat posed by APIs, with some even emphasizing them as the fastest-growing and most substantial attack vector. Such discussions, even if indirect, shed light on the escalating significance of API vulnerabilities. It’s a stark reminder that while APIs may not always headline sessions, their security implications cannot be sidelined.

‍APIs: the silent threat

APIs are the connectors, the backstage maestros enabling our apps, services, and platforms to communicate and harmonize in the digital-first economy. Yet, their strategic importance stands in stark contrast with their underrepresentation in the cybersecurity conversation.

In the Black Hat exhibitors’ space, a significant development was afoot: vendors actively showcasing ASPM (API Security Posture Management) solutions and platforms touting comprehensive API security testing suites. 

‍What is ASPM?

Application Security Posture Management (ASPM) is an emerging concept aimed at ensuring applications remain secure and resilient to threats, especially in production environments. ASPM provides a continuous and comprehensive snapshot of the risk landscape of an application’s architecture, including its services, libraries, APIs, attack surfaces, and data flows. As businesses increasingly rely on applications to drive their operations, the continuous evaluation of these applications becomes paramount to ensure security and to reduce business risks.

‍Why is ASPM Important?

In today’s digital age, where applications are at the heart of business operations and customer experiences, application vulnerabilities can have catastrophic impacts. Not only do they expose businesses to potential breaches, but they also pose significant financial and reputational risks. ASPM addresses the following challenges:

• Continuous Monitoring: Unlike traditional security measures that might take a snapshot approach, ASPM ensures continuous monitoring of applications, especially in production.

• Risk Prioritization: By understanding the application’s architecture and its components, ASPM allows teams to quickly identify and prioritize high-impact risks.

• Business Context: Beyond just identifying vulnerabilities, ASPM assesses the potential business impact, allowing for more informed decision-making.

• Adapting to Modern Architectures: As businesses transition to cloud-native applications, traditional security solutions often fall short. ASPM is designed to address the complexities of modern, dynamic application architectures.

‍Is ASPM a worthwhile pursuit for organizations?

The answer is nuanced – it depends on an organization’s specific complexities and where it currently stands in its security journey. While there’s an undeniable value in having a holistic view of an application’s security posture, given the increasing reliance on applications and the evolving nature of modern architectures, the integration of ASPM should be calibrated to an organization’s existing security program and expertise level. For some, ASPM will be a game-changer, enhancing resilience against threats. For others, it might be an additional layer that needs careful integration and understanding. The key is to assess its relevance and applicability to your specific context.

However, while ASPM can be an important component of a modern security strategy, it’s crucial to approach it with a discerning eye. By understanding its value and being aware of potential pitfalls, organizations can ensure they are truly bolstering their application security, rather than just checking boxes. Specifically, organizations need to:

‍Beware of “API security washing”: Just as “cloud washing” was a trend where vendors claimed cloud capabilities without truly offering them, there’s a risk of “API security washing” today. As the focus on API security grows, some vendors might jump on the bandwagon without genuinely providing the necessary capabilities. It’s essential to thoroughly vet solutions and ensure they offer real value.

‍Recognize there’s no silver bullet for API security: While ASPM may be important, it’s a mistake to believe any single vendor can cover all aspects of application and API security comprehensively. It’s often said, “it takes a village,” and this truism applies in the realm of security. Relying solely on one solution or vendor that claims to do it all can lead to gaps in your security posture. Diversifying tools and strategies, and ensuring each is tailored to specific needs, is essential.

‍Understand that complexity can be a double-edged sword: While having a comprehensive tool that covers multiple aspects of security is advantageous, there’s also a risk of complexity. If a tool is too complex, it can lead to misconfigurations or gaps in understanding, which can be just as dangerous as having no tool at all. Trying to “do it all” can also lead to “halfway” solutions. Ensure that whatever solutions you adopt are not only robust but also user-friendly and well-understood by your team.

Rather than pushing for all-encompassing solutions, a stronger solution will be to enrich the ecosystem with API insights, strengthening a variety of tools in the process and ensuring a better security outcome. Instead of leaning into consolidation, this approach fosters collaboration, pooling expertise from various industry leaders. While the “all in one” might offer short-term simplicity, it risks feature gaps and limited innovation. In contrast, an enriched ecosystem promotes flexibility and a diverse range of solutions, equipping businesses to tackle emerging API security challenges.

‍The path forward

The narrative emerging from Black Hat and DEF CON 2023 needs a reframing. The underlying theme of many talks acknowledges the API security crisis, but that conversation was not an overt part of the program. These conferences need to shine a brighter light on the challenges and compromises resulting from API security gaps so that companies can build a deeper understanding of how to prevent such threats. That depth is crucial for companies to be able to critically assess vendor offerings and scrutinize the various vendor approaches.

In the digital alleys of our interconnected realm, APIs serve as the silent custodians. As Black Hat and DEF CON 2023 draw to a close, our call to arms is clear: spotlight the quiet crisis of API security and foster a fortified digital future with effective, flexible, API-centric security strategies.

‍

*** This is a Security Bloggers Network syndicated blog from Salt Security blog authored by Salt Technical Engineering. Read the original post at: https://salt.security/blog/in-the-alleys-of-black-hat-and-def-con-2023-the-quiet-api-security-crisis