Welcome to 2024!

Another year has started and with that, best wishes to all and especially to those responsible for keeping your applications, APIs and data secure. I foresee a challenging year in the world of cybersecurity, especially with the technology making it easier to attack but of course also protect these endpoints.

Let's break down the four major categories that I feel will play a major role this year, coming from a cybersecurity consultant, operating primarily in the Web Application and API Protection and Distributed cloud and Edge Computing spaces.

#1 - API Security

A recurring trend for several years now, APIs are more commonly attacked. According to the statistics from Akamai, APIs are now the most attacked type compared to web application endpoints.

OWASP released the API Security Risks Top 10 last year and it remains critical to make sure all your API endpoints are protected against a variety of attacks ranging from accessing and tampering with sensitive data to attempts to make your API infrastructure unavailable to your daily users.

With the companies I have consulted with in 2023, one area definitely showed as an eye-opener and that is the lack of observability and continuous monitoring on API endpoints. Akamai launched a new solution (Akamai API Security) through acquiring Neosec and in pitching this solution to companies and running proof of concepts, it showed that often there is lack of visibility on rogue / shadow APIs and limited tracking is done of attempted API attacks.

It is great to see companies tap into this API observability potential either through Akamai API Security or other alternatives out in the market. The more focus on protecting API endpoints and sharing information, the better protected the community can be from potential harm.

Although I don't want this to happen, it would not surprise me to see several large data leaks or disruptions, originating from attacks on API endpoints. Take stock, add a layers of security and improve your cybersecurity on APIs.

#2 - AI

With the disruptive growth of AI technology in the last 12-18 months, this is also causing a disruptive growth in the areas of spamming and scamming. It has become easier to generate phishing emails, web applications or chat bots to make it harder for users to know what to trust.

The usage of AI technology within companies should also not be underestimated as there have already been incidents of relying on AI technology to improve proprietary code and technology which could be collected and inspected.

And all of that hasn't even delved into the area of regulatory and policies around the use and application of AI technology.

2024 will be a key year in this space. For further reading, I definitely recommend giving the OWASP LLM Top 10 a read.

#3 - CI/CD and Shift-Left

With all that, the DevSecOps movement continues to grow stronger. Throughout 2023, I have definitely seen an improvement in DevOps and DevSecOps maturity from the companies I consult with.

Infrastructure as Code continues to be a growing need for organizations and in 2023, I spend a lot of time consulting companies on how to best implement IaC for their Akamai security solutions. Moving away from ClickOps and implementing things like Akamai Terraform Providers into their CI/CD pipeline. Creating a single source of truth code base for their Web Application and API Security solutions is making it easier for companies to scale their efforts.

With IaC implementations and the aforementioned observability tooling, it has also given rise to protecting more endpoints, more easily. Developers have easier access to protect lower-level environments (test, staging, pre-prod etc.) behind their security stack and implement security from the start, achieving exactly the Shift-Left DevSecOps mindset companies are looking for.

It really is great to see companies being able to automate the onboarding of dozens if not hundreds of additional endpoints within short sprints due to the modularity and reusability of IaC tooling.

At Akamai, I am continuing to see a huge growth to IaC tooling and more reliance on observability tooling such as SIEM Integrations and API Security for that full visibility and full protection on all web application, API and DNS endpoints as well as HTTPS certificates.

In 2024, I will continue on this path, helping our developers make the best use of their security solutions and it is my goal to share more on the benefits, implementation tips and anecdotes and stories along the way.

As always, if you are looking for help with any of these areas, you know where to find me! Good luck out there and don't let the bed bugs bite!

/Mike

Bonus reading