F5 Report Examines API Sprawl, Credential Exposure and Security at Scale
Summary
F5 models continued API growth and examines how unmanaged endpoints, exposed credentials and webhook abuse increase security risks. The report recommends lifecycle security, unified discovery and an inter-cluster proxy approach.
Key points
- F5's model projects potentially more than one billion APIs by 2031, with estimates varying by developer participation, API production and supported lifetime.
- Continuous development, microservices and distributed infrastructure multiply API versions; deprecated endpoints can become unmanaged zombie APIs.
- API keys stored in source code, email, databases or backups can expose services and provide access to critical infrastructure if compromised.
- The report describes how exposed Slack webhook URLs can enable unsolicited phishing messages, citing earlier reporting on publicly accessible webhook credentials.
- F5 argues that security must cover the entire API lifecycle and that previously validated endpoints still require ongoing trust assessment.
- The authors propose an inter-cluster 'API gateway 2.0' using a bidirectional meet-me proxy, alongside unified API discovery, documentation and reliability monitoring.
Article Details
- Publisher
- F5 Office of the CTO
- Scope
- Global public and private API sprawl, enterprise security risks, and inter-cluster API governance and connectivity.
- Key Statistics
- The authors estimate that the worldwide number of public and private APIs is approaching 200 million; this is a modeled estimate, not an observed inventory.
- A cited report states that more than nine out of ten enterprises experienced an API security incident in 2020.
- The cited 2021 IBM Security X-Force Cloud Threat Landscape Report attributes two-thirds of cloud incidents to misconfigured API keys allowing improper access.
- A cited Dark Reading article reports that a GitHub scan returned more than 130,000 public code results containing Slack webhook URLs, most containing the full unique value.
- Recommendations
- Integrate security throughout the API lifecycle, from code development through deployment and end-of-life.
- Maintain a single source of truth for enterprise-approved APIs, including discovery, versioning, documentation, and deprecated or unsupported API inventories.
- Perform due diligence on external API providers and continuously validate trust beyond endpoint identity.
- Monitor API reliability consistently across deployments.
- Consider an inter-cluster bidirectional proxy approach for secure API connectivity without replacing existing intra-cluster architectures.