Cybersecurity Awareness Month is running in the U.S. during October 2021. Some of the events and associated themes are designed to demonstrate how companies still have a long way to go to perfect their security strategies, and ways they can improve their cybersecurity posture.
Looking at some of the common themes for the month, for Digital Journal, is security expert Nathanael Coffing, CSO of Cloudentity.
Coffing looks at one of the fundamental issues that are impacting upon cybersecurity topics within the business community – application programming interfaces, which are type of software interface, offering a service to other pieces of software.
With APIs, Coffing says: “Modern organizations are sharing data over APIs to digitally transform and rapidly bring new services to market. APIs are connecting with internal and external services, transferring sensitive data with users and partners across the hybrid cloud. Consequently, organizations are facing increased cyber risks and a growing attack surface. Legacy identity and access management (IAM) tools cannot protect and secure identities working in modern applications, much less multi-cloud infrastructures.”
The risks in relation to APIs is not just something that Coffing is considering. He also seizes upon industry trends, finding: “Gartner predicts that APIs will be the most frequent attack vector by 2022. Implementing zero-trust for APIs to protect against known and emerging threats like broken object-level authorization or broken authentication means building strong application identity along with strong user identity, as well as protecting sensitive data with fine-grained authorization.”
This leads to Coffing to distil the following advice: “Properly assessing and mitigating risks at the API level can also allow organizations to enhance the user experience with transactional Authentication/ Authorization and fine-grained consent management.”
The current event running across the month provides an opportunity for businesses to review and act upon such weaknesses. Coffing states: “Cybersecurity Awareness Month shines a light on the changing state of cybersecurity. Prioritizing cybersecurity and adopting these modern capabilities is no longer optional as digital transformation accelerates.”
