Application Programming Interfaces (APIs) are critical to modern business, but weak security can lead to catastrophic breaches. APIs allow modern software applications to communicate with each other. They are a foundational element of the modern internet, and API communications make up a majority of internet traffic. They can be found in customer-facing, partner-facing, and internal applications. As organisations migrate systems to the Cloud and adopt AI, the number and criticality of APIs will only expand.
The Consequences of Poor API Security
The consequences of getting API security wrong can be immense, with many notable breaches, such as the Optus breach in 2024, being linked to an unauthenticated API. APIs are a popular target for attackers, and successful exploitation can lead to the exposure of sensitive personal and business information, ability to manipulate a system, ability to access other internal resources, and expose information to be used in further attacks. Developers and organisations tend to trust data received from third-party APIs more than user input, which motivates attackers to go after integrated third-party services in order to compromise the environment. Additionally, organisations frequently consume services with per-request charging via APIs, and satisfying API requests consume resources such as network bandwidth, CPU, memory, and storage. Therefore, successful attacks can also lead to denial-of-service incidents and an increase in operational costs.
New Zealand's Regulatory Response
New Zealand Government has now shifted towards legislating API requirements across the economy, with the inclusion of the API Standards within open banking (under the Customer and Product Data Act 2025). For Government agencies, the current API guidelines are being updated to a mandatory standard, with an exposure draft released in February this year. If your organisation relies on the internet, securing your APIs should be a clear priority. This is not only essential for protecting your own systems and data, but also for meeting the growing expectations across the ecosystem. Banks and government agencies are increasingly requiring demonstrable API security, and these standards will continue to flow down to the organisations they work with.
How Bastion Can Help?
The good news is that dedicated tools and international best practice exist for New Zealand companies and agencies to leverage. Reach out to understandhow Bastion can help you: Develop fit-for-purpose policies, implementsecure API architecture and designs, perform security testing, and automate compliance.
Further resources can be found here:
- https://docref.digital.govt.nz/nz/dia/nz-api-standard/
- https://www.mbie.govt.nz/about/news/open-banking-regulations-now-in-force
- https://www.apicentre.paymentsnz.co.nz/standards/available-standards/
- https://owasp.org/www-project-api-security/
- https://csrc.nist.gov/pubs/sp/800/228/upd1/final