API's are essential tools for businesses — they streamline organizational operations, and provide strategic value such as additional exposure for your brand and increased revenue. APIs are a new type of ecosystem, allowing companies to expand into new markets where they can use them for more than just technical concepts.
Like every technology, APIs come with advantages and disadvantages, which Steve Prentice explains in the most recent CISO/Security Vendor Relationship Podcast.
What is an API?
API stands for 'application programming interface,' and the dictionary describes it as "a set of functions and procedures allowing the creation of applications that access the features or data of an operating system, application, or other services." In more basic terms, API is a software intermediary that allows two different applications to talk to each other.
Commercial websites often provide developers with specifications or protocols on how to request services or exchange data with the company. The code they share is called the API, and the tools they produce are called applications. It is very common for larger organizations to build APIs for their customers or for internal use, and the goal is typically external information exchange.
For instance: Walgreens provides an API for its photo printing and pharmacies, which makes it possible for someone to create a mobile app so users can print photos directly from their phones at a Walgreens location.
API Examples
Companies of all sizes can utilize APIs for website analytics, project and team management tools, online payment systems, and for many other operational solutions.
- Analytics. Google Analytics is a part of the Google Cloud API Platform and offers multiple API options that businesses can use for analytics. The most common APIs used are Core Reporting API and Management API.
- Project and Team Management. Tools like Jira, Basecamp, and Microsoft Teams provide communication between coworkers and data sharing functionality — and that all happens through API.
- Online Payment Systems. Where digital money transfers occur, there is an API supporting the process. Many organizations choose to utilize APIs from a firm such as PayPal to provide secure, safe money transfers to their customers.
API Disadvantages
There is a lot of conveniences and advantages to APIs, but business leaders should also be aware of the disadvantages. As a single point of entry, an API is a gateway and can become a hacker's primary target. Once the API is compromised, all other applications and systems become vulnerable.
Nine of the top ten vulnerabilities listed in the OWASP Top 10 now mention APIs — and since APIs can be accessed over the internet, they will have all the same disadvantages as any other Internet-based resource. APIs are vulnerable to man-in-the-middle attacks, CSRF attacks, XSS attacks, SQL injection, and DDoS attacks.
API Security
APIs are vital to any business, and it is essential for companies to embed secure API gateways within the cloud itself. This means using Secure API Gateway technologies which put security as a top priority. This is not something that business leaders should just leave to their Cloud Providers — it is up to individual companies to be proactive about securing these solutions. Here are a few tips to help you keep your API secure:
