Can a company lose track of its own APIs?

At first glance, it might seem strange for a company to lose track of the APIs it uses. After all, these connections are established by the companies themselves. However, as systems grow and scale, keeping track of which APIs are currently active may not be so simple.

For example, imagine a developer writing a new iOS app. An API previously used in the app is no longer needed. The new version is released, the team moves on to other tasks, and the old API which should have been decommissioned, is simply left behind. Over time, no one remembers that the API is still running and exposed to the internet.

The API continues to respond to requests, yet it is no longer regularly maintained, tested, or monitored by the security team.

This is precisely where the risk arises.

Shadow APIs and Zombie APIs: The Basics

Shadow APIs are APIs that do not appear in an organization's official inventory or current documentation. This includes APIs created by a team as a temporary workaround or for testing purposes and deployed without the knowledge of the company's security unit.

Zombie APIs, on the other hand, are legacy APIs that have continued to run even though they should have been shut down.

Think of it as failing to return the keys after moving out of an old office. The company might no longer use that building, but if you can unlock the door and get inside, you can still access the items and other valuable assets left behind.

Similarly, a long-existing API could be used to access customer data, internal data transmissions, or system resources.

How do attackers discover these APIs? The fact that a company has forgotten about an API does not make it impossible for outsiders to discover it.

Public job postings, legacy applications, files bundled with mobile apps, and technical documentation published in the past can all provide clues. Legacy APIs often have weaker security controls compared to newer versions.

Outdated API documentation and a lack of inventory management systems are among the top 10 API security risks identified by OWASP.

OWASP notes that, if left unupdated, legacy versions and unpatched APIs can lead to unauthorized access and expose sensitive data.

Can we secure a system we don't know exists?

An organization cannot secure an asset it is unaware of.

After all, in such a scenario, there is no way to monitor traffic, manage access permissions, or detect unusual activity.

Therefore, the first step is not to purchase a new security product, but to identify the APIs that currently exist.

Records must be maintained regarding active APIs specifically, what information they access, who uses them, and when they are decommissioned.

It is essential to verify that outdated versions are truly no longer in use and to decommission them in a controlled manner.

NIST  also states that the API lifecycle is not limited to runtime protection; it must be addressed across all stages, including design, development, deployment, and usage.

As we see in modern systems, the newest or most complex endpoint is not always the most dangerous one. That door, which hasn't even crossed your mind for years, often poses the greatest danger.

Disclaimer

The content of this article consists of general information and does not constitute professional cybersecurity advice.

‍