Google：2022年API安全性研究报告

HowAPIsecurityisimpactingthepaceofinnovationatenterprisesandwhatITleadersaredoingtomitigaterisksGoogleLLCAllrightsreserved2ExecutiveSummary3Threatsabound4Affectingthepaceofinnovation5ActiveAPIsecuritypostureisnecessary6CurrentAssessment7Confidentinthefaceofthreats7Isthisconfidencemisplaced?8CompaniesprioritizebeingproactivewithAPIsecurity8Opportunities9Consolidation,end-to-endmonitoring,oversightneeded9Moretrainingandcertificationinthisspaceisneeded9Mostagreetheirstrategyneedsimprovement10APIsecuritystrategynotalwaysatoppriority11TheimpactofAPImanagementandAPIgatewaysolutions11APIsecurityisakeyelementofalargerAPIstrategy12GoogleLLCAllrightsreserved3Withtheincreasingadoptionofdigitalexperiences,theuseofApplicationProgrammingInterfaces,orsisontheriseAssuchAPIsrepresentasignicantareaofvulnerabilityfororganizationsworldwideThefollowingreportexaminesthelandscapeofAPIsecuritythreatsandtheirimpactonthepaceofinnovation.ItdelvesintotheworldviewofthetechnologyleadersasitpertainstoAPIsecuritypostureandstrategy,andoffersaperspectiveonopportunitiestoimproveAPIsecurityhealth.andJuneamongrsfromcompaniesintheUnitedStateswithatleastemployeeswhohaveasignificantinfluenceordecision-makingauthorityonpurchasesoftechnologysolutionsrelatedtoAPIinitiativeswithintheirorganization.growingconcernforITexecutivesduetotheprevalenceofthreats,butthatmostorganizationsneedtosaneedforproactivesecuritycapabilitiesandmeasuresaswellasendtoendAPIsecuritysolutionssuchasApigeeafulllifecycleAPImanagementplatform.CompaniesworldwiderelyonApplicationProgrammingofacilitatedigitalexperiencesandunleashnergyoftheirowndataandprocessesAPIsareacriticallinkinblendingproprietarydatawithassetsfromthirdlroleintheracetomodernizeapplications,fuelinginteroperabilityand,inturn,efficientfunctionality.ButtheproliferationandimportanceofAPIscomeswitharisk.AsagatewaytoawealthofinformationandsystemsAPIshavebecomeafavoritetargetforhackers.Ourresearchconfirmsthewidespreadimpactofthesethreats.HalfofthemreportexperiencinganAPIsecurityincidentinthepercentageishigherorlowerdependingcatedthatthey’vehadasecurityincidentinthepast12monthswhileomtheThiscouldpointtowardthelimitedpurviewoffunctionalITteams,oritcouldbeanindicationofhowsalienttheissueisforthosewithgreaterresponsibility.Orboth.GoogleLLCAllrightsreserved4GoogleLLCAllrightsreserved5TocompoundtheissuethreatssurfacefromamyriadofAPIsecurityareaswithIToutasaglaringvulnerability,thethreemostcommonsourcesofpotentialthreatsaresecuritymisconfigurations,outdatedAPIs/data/components,andbots/spam/abuse.categoryarethemostidentiedthreatareawithofITleadersngeithersecuritymiscongurationormisconguredAPIsAffectingthepaceofinnovationThesethreatsandincidentshaverealworldimplications.APIsecurityisslowingthepaceofinnovationformanyorganizationsMorethanhalf(53%)oforganizationshavedelayedtherolloutofanewserviceorapplicationduetoAPIsecurityconcerns.Forthosewhodelayedtherolloutofanewserviceorapplication.GoogleLLCAllrightsreserved6postureisnecessaryWithsecurityvulnerabilitiesbeingintroducedfromavarietyofsourcesthroughoutdevelopment,itwillcomeasnosurprisethatidentiedateveryphaseoftheAPIlifecyclefromdesigntotestingtodeploymentandbeyond.Naturally,securityissuesaremostcommonlydiscoveredduringtestingpartofthereleasemanagementprocessbutasubstantialnumberofvulnerabilitiesareidentifiedaspartoftheprocesstodeploytoproductionThisindicatedanareaofriskforvulnerabilitiestobedeployedtoproductionasaconsiderablepercentofpossiblesecurityissuesareidentifiedinthelaterstagesofAPIlifecycle.ndvulnerabilitiesareidentiedwithrealtimeionbythreeoutofveITleadersemphasizingthattheneedforanactivesecuritypostureisanecessityinthisenvironment.ConfidentinthefaceofthreatssAPIthreatlandscapemostorganizationsthreequartersofetherequiredtoolsandsolutionsandyneedtechnologyleaderswouldedAPIsecuritycenterofexcellenceandtheirsecuritytoolsandsolutionsareointedinanywayCertaingroupsaremoreconfidentoftheirsecurityposturethanGoogleLLCAllrightsreserved7GoogleLLCAllrightsreserved8Isthisconfidencemisplaced?dappearthatthereisagapbetweentheexistenceofsecurityincidentsandconfidencethatthetoolsaredoingthejob.CoulditbethatorganizationsareignoringtheinthelastyearaswellastheOrisitsimplythatsecurityincidentsareacceptedasacostofdoingbusinessinthedigitalspace?reinthemiddleSomemaybeunderestimatingthreatsandtheextenttowhichtheyimpacttheirorganization,whilealsobeingrealisticthatAPIsecurityisconstantlyevolving,andthreatsareapartoflife.CompaniesprioritizebeingproactivewithAPIsecurityTostayaheadofsecuritythreats,manyorganizationslookforsolutionsthatallowthemtobeproactivewhileminimizingtheburdenontheirsecurityteams.Accordingtoourresearchcapabilitiesthatproactivelyidentifysecuritythreats(60%)andimproveistsforthenextyearHowevermostarenotreadyorwillingtoprioritizetakingtheleaptowardincorporatingArtificialntelligenceandMachineLearningintotheirAPIsecurityyetelentlessthreatlandscapeandalitanyofvulnerabilitiestoaccountforacrosseverystageoftheAPIlifecycle?Asidefromfactorsthatareneartablestakes,likeeasyintegrationwithexistingtoolsandsupportforthelatesttechnologies,consolidationandend-to-endsolutionsaresomeofthemostimportantfactorstolookforwhenevaluatingAPIsecuritysolutions.ThisismorefocusedoneasyintegrationwithexistingAPItools,mendationsmorethanCwhileCvaluessolutionsthatarebuiltforcloudnativeeoveraconsiderablyhigherpercentageofCpreferconsolidatedAPIsecuritysolutionsoverpointsolutions.MoretrainingandcertificationinthisspaceisneededAsidefromtechnologicalsolutions,manylooktotrainingandproceduralimprovementsasameansofcombatingthreats.TopprioritiesforAPIsecurityincludeestablishinganAPIsecuritylearningandcertificationstandard(38%),improvingtheirdocumentationtoincorporatesecuritybestpractices(38%),andmodifyingexistingprocessestocatchAPIpleaseapproachtoimprovingtheirAPIsecuritywithnosingleinitiativestandingoutaboveothers.GoogleLLCAllrightsreserved9GoogleLLCAllrightsreserved10irstrategyneedsimprovementgtoourresearchmostorganizationsdonthaveacompleteAPIsecurityrategyinplaceAmajoritywouldsaythattheirstrategyneedsimprovementattheveryleast.ctbetweentheperceptionsofIThatnumberincreasestoGoogleLLCAllrightsreserved11strategynotalwaysatoppriorityyorganizationssimplylacktheresourcesandorganizationsoftenfeelasthoughAPIsecurityisn’tprioritized.Thiscanleadtosomeanimositywithintheranksofthesecurityteam.litteredacrosstheirorganizationwithresponsibilitiesoftendividedamongteams.Infact,APIsecurityresponsibilitiesequentlyvaryfromcompanytocompanydependingonneedsindustryandcompanystructurePIgatewaysolutionsavezationwideAPImanagementAPIGatewaysolutionimplemented.ThoseorganizationsarelesslikelytofeelthattheirsecurityzedAPIsecurit