Nearly one in three organizations experienced an API breach in the past 12 months. If you're assuming your WAF caught everything, you're using the wrong security model.
What Happened
Organizations relied on traditional defenses like endpoint detection and web application firewalls while attackers focused on exploiting APIs. This led to breaches that bypassed conventional controls.
Attackers didn't use zero-day exploits or sophisticated operations. They exploited business logic, manipulated poorly documented endpoints, and took advantage of broken authentication flows that appeared legitimate to traditional monitoring tools.
Timeline of a Typical API Breach
Day 0: A developer deploys a new API endpoint for a mobile app feature without a security review and with minimal documentation.
Week 2: An attacker discovers the endpoint through reconnaissance, tests authentication flows, and identifies a BOLA (Broken Object Level Authorization) vulnerability.
Week 4: The attacker begins systematic data extraction. Requests mimic normal user traffic with correct authentication tokens, standard rate limits, and valid HTTP methods.
Month 3: The security team notices unusual data transfer patterns during a quarterly review. By this time, the attacker has extracted customer records from 14,000 accounts.
Month 4: Incident response confirms the breach. Root cause analysis reveals the API endpoint was never added to the asset inventory. WAF logs show no alerts; all requests appeared legitimate.
Which Controls Failed
Visibility: About 70% of enterprises have only 30% of their APIs documented. You can't protect what you don't know exists. Shadow APIs, deployed without security review, become easy targets.
Context-Aware Detection: Traditional security approaches miss API attacks because they lack the context to detect business-logic abuse. Your WAF sees valid HTTP requests with proper authentication but doesn't recognize that user_id=1001 is iterating through user_id=1002, 1003, 1004 to harvest data.
Authentication and Authorization: The OWASP API Security Top 10 lists BOLA as the #1 risk. Yet, many organizations still rely on network-layer controls that can't inspect whether a user should access a specific resource, only whether they're authenticated.
API Inventory Management: There's often no central registry of API endpoints, versions, or ownership. When the security team asked "who owns this API?", it took three weeks to identify the responsible team.
What Standards Require
The OWASP ASVS v4.0.3 addresses API security in several sections:
- Requirement 4.1.1: Verify that the application enforces access control rules on a trusted service layer.
- Requirement 4.2.1: Verify that sensitive data and APIs are protected against Insecure Direct Object References (IDOR).
- Requirement 13.1.4: Verify that GraphQL and other Web Service data layer authorization logic is implemented at the business logic layer.
PCI DSS v4.0.1 now explicitly covers API security:
- Requirement 6.4.2: Examine software-development procedures to verify that up-to-date threat intelligence is incorporated into the secure development lifecycle.
- Requirement 11.6.1: Deploy a change-detection mechanism to alert personnel to unauthorized modifications of HTTP headers and the contents of payment pages.
ISO 27001 requires:
- Control 8.3: Information access restriction, "Access to information and other associated assets shall be restricted in accordance with the established topic-specific policy on access control."
- Control 5.15: Access control, Organizations must implement controls for both authentication and authorization.
These standards don't say "install a WAF and you're done." They require context-aware access controls, continuous monitoring, and governance frameworks that track what you're protecting.
Lessons and Action Items
1. Build a Complete API Inventory
Start with automated discovery. Tools like API gateways with built-in discovery, traffic analysis platforms, or open-source options like Akita can identify active endpoints.
Your inventory needs:
- Endpoint URLs and methods
- Authentication requirements
- Data sensitivity classification
- Owner and business purpose
- Last security review date
Update this weekly, not quarterly. APIs change faster than traditional infrastructure.
2. Implement Identity-Aware Authorization
Authentication isn't enough. Every API request should answer: "Is this user authorized to access this specific resource?"
For RESTful APIs, this means:
- Validate object ownership on every request
- Don't trust client-provided IDs without server-side checks
- Use indirect object references where possible
For GraphQL:
- Implement field-level authorization
- Limit query depth and complexity
- Monitor for enumeration patterns
3. Deploy API-Specific Monitoring
Your SIEM needs context beyond "200 OK" responses. Monitor for:
- Sequential ID enumeration (user_id=1, 2, 3...)
- Unusual data volume from authenticated users
- Access pattern changes (user suddenly accessing 100x normal records)
- Failed authorization attempts (not just authentication)
These patterns indicate business-logic abuse that traditional tools miss.
4. Establish API Governance
Before any API reaches production:
- Conduct a security review using the OWASP API Security Top 10 as a checklist
- Develop a threat model for business logic abuse
- Document in a central registry
- Review the authorization model
Make this part of your CI/CD pipeline, not a quarterly audit.
5. Test Authorization Logic
Your penetration tests should include:
- BOLA testing (can user A access user B's data?)
- Function-level authorization (can a regular user access admin endpoints?)
- Rate limiting effectiveness
- Authentication bypass attempts
Don't just test whether endpoints exist. Test whether they enforce the authorization model you designed.
The shift from endpoint to API as your security perimeter isn't coming; it's already here. Traditional defenses won't fail catastrophically; they'll just quietly miss the attacks that matter. Your next breach won't announce itself with a zero-day exploit. It'll look like normal API traffic until you check the logs three months later.
