The API Security Newsletter - Issue #13

New research shows that 20% of developers and IT professionals report monthly API security incidents despite continued investment in APIs.

When it comes to the struggle to secure APIs, it isn’t just the scale of apps and services that is creating challenges. It is also the fact that many organizations are relying on less-optimized application security tools to mitigate issues at the API level. 

Some striking data from our new API Survey: - 98% of organizations use or are planning to use internal APIs; up from 88% in 2019. - 94% of organizations... 27 comments on LinkedIn

- 98% of organizations use or are planning to use internal APIs; up from 88% in 2019.

- 94% of organizations use or are planning to use public APIs provided by third-parties; up from 52% in 2019.

- 90% of organizations use or are planning to use private APIs provided by partners; up from 68% in 2019.

- 80% of organizations provide or are planning to provide publicly exposed APIs; up from 46% in 2019.

The 2022 State of the API report covers the largest and most comprehensive survey on APIs, ever. More than 37,000 developers and API professionals shared their thoughts.

For the fourth year in a row, the State of the API is the largest and most comprehensive survey and report on APIs–and this year's was the biggest ever. More than 37,000 developers and API professionals shared their thoughts on topics including their organizations' development priorities, the economy, the tools they use, and where they see the industry going.

Cybersecurity News

Nearly one-quarter of all attacks compromise API security, the company’s annual survey of 125 cybersecurity and incident response professionals found. API attacks take many forms, but the top types include data exposure, SQL and API injections, and distributed denial-of-service, according to VMware. 

Application development is moving from a web-centric world to an API-centric world. If you’re wondering what that looks like, the security implications, and what an API is in this context, you’re in the right place.

To best address the security challenges in the API economy, the value of transparency arises yet again. Knowing what an API is supposed to do, how it should function, and what data should be accepted and transmitted is foundational to exposing latent threats and vulnerabilities.

APIsec University provides free training courses on API Security. Learn how to find API vulnerabilities and keep them secure.

The free API Security Certified Expert course covers all the key topics to become an APIsec professional. This hands-on course provides detailed workshops on API hacking techniques and how to uncover vulnerabilities and logic flaws in APIs.

David Bombal interviews Corey Ball who wrote the book "Hacking APIs" and he tells us about his book and the free training he is making available.

Learn the basics of API Security best practises with this 100% free course. APIs form the backbone of modern applications be it on-prem or on the cloud. Learn what are the key risks and how to protect against them

Another podcast recommendation, this time around recruiting with guest Bryan Cantrill, CTO of Oxide Computer

A very interesting episode recounting the most terrible hire Bryan ever made and their innovative approach to avoid past hiring mistakes. I really liked the reference to intrinsic motivation as the single biggest factor for success.

Intrinsic motivation refers to behavior that is driven by internal rewards. In other words, the motivation to engage in a behavior arises from within because it is naturally satisfying to you. Contrast this with extrinsic motivation, which involves engaging in a behavior in order to earn external rewards or avoid punishment.

In this episode, Laura talks to Bryan Cantrill, CTO of Oxide, about a wildly different approach to recruiting and hiring.  Drink Pairing: Diet Dr. Pepper