The ‘A-B-C’ of effective application security

Article by Barracuda APAC director of sales engineering, Mark Lukie.

Software applications have been a key tool for businesses for decades, but the way they are designed and operated has changed during the past few years.

Rather than running on servers within a datacentre, they are increasingly located on cloud platforms and accessed via the internet. While this has significantly improved functionality, it has big consequences for IT security.

Applications that are exposed to the internet have become a favoured target for cybercriminals. They recognise that a successful breach could provide access to a target organisation’s wider infrastructure.

The problem has become even more acute as a result of pandemic disruptions. Many organisations were forced to quickly make more applications available via the internet so that remote workers could continue their roles.

Unfortunately, sufficient priority was not given to security, and in many cases, applications are now vulnerable to attack. Techniques being used include SQL injection, cross-site scripting, and command injection.

To improve this situation, organisations must focus on the ‘A-B-C’ of software security:

‘A’ is for API security

For many years, APIs were used primarily in the backend of business applications, performing machine-to-machine communication. Today, however, APIs are everywhere, and they enable most of the applications used in daily life. They are the core of businesses, powering modern digital platforms and enabling digital transformation.

Many businesses have turned to developing applications with an ‘API first’ strategy, allowing them to innovate and go to market more quickly. APIs enable fast delivery when used with agile and DevOps practices, allowing developers to quickly build and release new functionalities for web and mobile applications.

When it comes to security, the growth of APIs and their direct access to critical data has made them a prime target for attackers. APIs are built for automation, which makes finding and exploiting insecure ones potentially very lucrative.

For these reasons, API security needs to be high on the priority list for all security teams. They should…