Blog

1 in 5 APAC Organizations Turn to AI/ML for API Security, Latest F5 Research Finds

INDIA, August 1, 2024 – APAC organizations are increasingly relying on artificial intelligence and machine learning (AI/ML) enabled solutions to tackle a wide array of security challenges around Application Programming Interfaces (APIs), according to F5’s inaugural 2024 Strategic Insights: API Security in APAC report. The report examines the challenges and opportunities in API security in Asia Pacific (APAC), as APIs continue to power the region’s digital experiences.

With APIs increasingly being the point of attack for cybercriminals, one in five APAC organizations have adopted AI/ML technologies to detect and mitigate sophisticated threats, such as server-side request forgery (SSRF), that may be overlooked by traditional security measures. API Gateways (20%) are also widely adopted by organizations across the region for strong access control and to mitigate a broad spectrum of vulnerabilities such as unrestricted access to sensitive business flows.

“Applications have become the front door to cybercrime, and cybercriminals increasingly use APIs as the key. Across the APAC region, we have seen more attacks, with increasing speed, scale and sophistication as cybercriminals leverage AI-powered tools,” said Mohan Veloo, Chief Technology Officer for Asia Pacific, China and Japan, F5. “As such, protecting API connections and the data that runs through them has become the critical security challenge for APAC organizations, especially with many looking to deliver AI.”

“In India, we are currently witnessing a huge rise in application-based businesses, opening new avenues for cyber attackers, which has led to the rising demand for cybersecurity solutions. Businesses are prioritizing investments in security infrastructure, to ensure protection for their applications. According to our 2024 Strategic Insights: API Security in APAC report, the majority of Indian businesses are prioritizing API security testing, access control, and runtime protection for comprehensive API security,” said Pratik Shah, Managing Director of India and SAARC, F5. “At F5, we strive to understand our customers’ challenges through surveys, offering insights and solutions to help IT decision-makers build a strong security foundation; this report of ours is evidence of the same. The insights in this report offer a strategic overview of API security challenges and opportunities, enabling us to help our customers align challenges to solutions.”

“APAC organizations are facing unique API security challenges that differ significantly from global OWASP rankings. The research highlights the pressing need for tailored security measures to address specific risks such as Broken Authentication, Server-Side Request Forgery, and Security Misconfiguration. Countries like Malaysia, New Zealand, South Korea, and India are prioritizing these issues, reflecting the diverse API adoption patterns across the region. It’s clear that a focus on robust testing, strong access control and continuous runtime protection is essential for a holistic API security approach in APAC,” said Manoj Menon, Founder and CEO at Twimbit.

While APAC organizations look to protect their APIs during runtime, many also increasingly recognize the importance of guarding APIs right from development. Having robust code security standards and practices (17.5%) has emerged as a fundamental strategy among the region’s organizations to guard APIs against a broad range of complex vulnerabilities, from Broken Object Level Authorization and Security Misconfiguration issues to SSRF.

“Today, API security is more important, but also more complex than ever. Findings from our report clearly show that more organizations are shifting left along the API lifecycle, while still attempting to shield right. F5 is bringing advanced API code testing and telemetry analysis to F5 Distributed Cloud Services, creating the industry’s most comprehensive and AI-ready API security solution. F5 Distributed Cloud Services can offer API discovery, testing, posture management, and runtime protection, all in a single platform, allowing organizations to gain true visibility and security from code to cloud,” Veloo added.

Some key India findings from the 2024 Strategic Insights: API Security in APAC report include:

· Rising Security Concerns around Broken Authentication (API2) and Server-Side Request Forgery (SSRF):

o Broken Authentication: Broken Authentication has been marked by 15% of respondents as a top concern, aligning with the APAC average of 15%. The prevalent use of Webhooks (37%) and REST APIs (43%) necessitates strong authentication mechanisms to prevent unauthorized access. Securing authentication processes is vital to protect user identities and sensitive data.

o Server-Side Request Forgery (SSRF): It is also a significant concern in India, with 15% of respondents indicating it as a top issue, compared to 13.8% in APAC. The high use of GraphQL (40%) and SOAP (37%) protocols highlights the importance of validating user-supplied URLs to prevent SSRF attacks. Implementing robust validation mechanisms is essential to safeguard against malicious requests.

· India Prioritizes API Security Testing, Access Control, and Runtime Protection for Comprehensive API Security: In India, API Security Testing is the highest priority, with 57% of respondents marking it as a top concern, exceeding the APAC average of 52%. API Access Control, including Authentication and Authorization, is another critical priority, highlighted by 47% of respondents, slightly above the APAC average of 46%. The significant use of Internal (67%) and Public (57%) APIs emphasizes the need for robust access control mechanisms, aligned with OWASP API2 and API5. Additionally, API Runtime Protection is crucial, with 43% of respondents marking it as a top concern compared to 36% in APAC, driven by the high use of Internal (67%) and REST (43%) APIs.

· Significant Adoption of Code Security Solutions: Code security solutions are the most adopted API security solutions in India, with an 18.0% adoption rate. This highlights the importance of secure coding practices and static code analysis to prevent vulnerabilities from being introduced during the development phase. By integrating code security solutions with AIML technologies, businesses can proactively identify and address potential security issues, ensuring a secure API environment from the ground up.

· Critical Role of API Gateways in API Security: API Gateways play a crucial role in India’s API security strategy, with a 16.5% adoption rate. The use of API Gateways helps manage and secure API traffic, providing essential controls for access and consumption, which is critical given India’s significant use of RPC (43%) and REST APIs (43%).

· Adoption of AIML Solutions for Comprehensive Protection: AIML solutions are another key focus for India, with a 16.5% adoption rate. The rise in the adoption of AIML solutions demonstrates India’s proactive approach to leveraging advanced technologies for comprehensive threat detection and prevention, ensuring robust security measures across dynamic API environments.

To evaluate the current landscape of API security in APAC, Twimbit conducted research on behalf of F5 in H1 of 2024, surveying 297 professionals from various sectors, including security, DevOps, SecOps, and application development. Respondents were distributed across 11 APAC markets: Australia, China, India, Indonesia, Japan, Korea, Malaysia, New Zealand, Singapore, Taiwan, and Thailand.

Wondrlab and Bharat Matrimony play to win as they launch the ‘Wedding Games’ campaign

Mumbai, 1st August, 2024: As the world gears up for the international games to win gold, Matrimony.com, India’s biggest matrimony company, is set to win hearts with its innovative ‘Wedding Games’ campaign. This timely initiative cleverly intertwines the excitement of the games (or rather sports) with the anticipation of the upcoming wedding season.

The campaign features two captivating films that humorously portray the ‘international-level’ challenges faced by singles during wedding season. These witty films showcase protagonists deftly dodging intrusive questions about their marriage plans from eager relatives.

Arjun Bhatia, Chief Marketing Officer at Matrimony.com, shared his insights on the campaign and the company’s unique approach: “Matchmaking is not just a simplistic game of pairing based on superficial criteria. It’s not about finding a partner; it’s about finding the right partner who aligns with your unique essence. This campaign humorously highlights the pressures singles face, while showcasing how Bharat Matrimony offers a more thoughtful, personalized experience.”

Bhavesh Kosambia and Rahul Chandwani, Content Leads at Wondrlab, the creative minds behind the campaign, explained: “We landed a strong insight – during the wedding season, a lot of the prospects who are of marriageable age, attend weddings of their friends and family. They are often questioned about their wedding plans, and these prospects try and dodge such questions. The campaign is a set of two films where we see such protagonists try and avoid pestering guests, albeit dramatized for entertainment as though they were athletes. Bharat Matrimony comes in as the perfect place to find the answers to these questions as they can log on to find their perfect life partners.”

CRISIL Ratings: Likely computation change can shave 10-30 pps off bank LCRs

The Reserve Bank of India’s (RBI’s) draft guidelines of July 25, 2024, proposing to revise the liquidity coverage ratio (LCR) framework will, if implemented as is, impact the LCRs of banks by 10-301 percentage points (pps), reducing the cushion now available over the regulatory requirement of 100%, a study by CRISIL Ratings shows.

The draft guidelines propose to introduce three key changes to the LCR calculation.

First, assigning an additional 5% run-off factor on internet and mobile banking (IMB)-enabled retail deposits and certain small business deposits.

Second, restricting the value of government securities (G-secs) forming a part of Level 1 high-quality liquid assets (HQLAs) to the market value, adjusted for applicable haircuts, in line with the margin requirements under the liquidity adjustments facility and the marginal standing facility.

Third, treating deposits contractually pledged as collateral to a bank as callable, and hence included in the LCR math.

The revised norms will be applicable from April 1, 2025.

To be sure, the proposed guidelines can enhance the resilience of banks against sudden and unanticipated deposit outflows. While the implementation of the circular in its current form will result in a reduction in the current reported LCRs given the higher stress factors proposed, banks will work toward re-building that corpus.

But they will have to bear a near-term impact on credit growth and net interest margins as they shore up liquidity buffers to manage the transition.

CRISIL Ratings analysed the impact of the proposed guidelines on 31 public sector and private banks (comprising over 90% of the total assets of the Indian banking system), presuming ~75% of retail deposits are IMB-enabled. A 1% impact on the value of HQLAs due to the change in the valuation of G-secs has also been considered.

Says Ajit Velonie, Senior Director, CRISIL Ratings, “Compared with the past, and given the rising penetration of digital banking, the risk of sudden, large withdrawals during stress is higher now, thus putting pressure on liquidity. We saw instances of this last year in other geographies. The RBI’s proposed guidelines aim to increase the buffer to enable banks tackle such emerging risks. However, this revision will have an impact on current reported LCRs of many banks. The median LCR of the banks analysed, which stood at 136% as on March 31, 2024, would drop to 117% if the guideline is implemented as is.”

Further, 17 of the 31 banks analysed would have an LCR of less than 120%, compared with only three currently (see Table 1). And of this 17, nine would have LCRs of less than 110% as against none now.

The RBI move comes at a time when banks are grappling with deposits growing slower than credit. While the gap has narrowed to ~300 bps last fiscal compared with 600 bps in fiscal 2023, the initial months of this fiscal have seen the difference widening again to around 400 bps.

Many banks have been managing their funding requirements by dipping into their excess statutory liquidity ratio (SLR) holdings, among other avenues.

The LCRs of many banks have already been impacted by a reduction of more than 250 basis points in excess SLR, a key component of HQLA, between fiscals 2023 and 2024.

Says Subha Sri Narayanan, Director, CRISIL Ratings, “Banks will need to strike a fine balance between growth and profitability. While not all banks may choose to restore their LCRs to original levels, they will still need to rebuild their buffers, resulting in a two-fold impact. One, with greater investment in government bonds to shore up HQLA, resources available for lending will get curtailed, and to that extent, credit growth may moderate from the CRISIL Ratings’ projection of ~14% for fiscal 2025. Two, the higher proportion of lower-yielding G-secs in the asset mix, along with continued battle for deposits and a potential increase in deposit costs, could weigh on NIMs and profitability of banks.”