API Protection for Healthcare
API adoption is revolutionizing interoperability efforts and health data exchange as providers race to comply with the CMS Interoperability and Patient Access final rule while they work towards implementing the HL7 Fast Healthcare Interoperability Resources (FHIR) standard. A recent survey of developers showed that 71% expect healthcare to rely on APIs more in 2022 than 2021. The wide spread adoption combined with the power and flexibility found in APIs makes them the #1 target for attackers, who use their developer skills for malicious purposes. This data point is validated in the most recent Cequence Security API Usage and Threat Report that found 80% or 1.8 billion of the blocked attacks were API-based.
By the Numbers
400%
Healthcare is one of the biggest adopters of APIs with healthcare API traffic growing by more than 400 percent in 2020.
Marsh McLennan Global Cyber Risk Analytics Center
Marsh McLennan Global Cyber Risk Analytics Center
100%
In a recent study, 100% of 30 of the leading mobile health (mHealth) apps were found to be vulnerable to API attacks which could allow unauthorized individuals to gain access to full patient records.
10x
Personal health information is the most valuable data on the dark web, demanding 10 times more the price of a credit card for a single PHI record.
Source
Source
The API Protection Challenge for Healthcare
Healthcare involves many parties working together such as health insurance, healthcare marketing, pharmacy and prescription management, healthcare tech, and health administration. This makes them a target for attackers and cybercriminals seeking monetary gain by exploiting APIs to steal patient records and healthcare financial data. Attacks on healthcare APIs can introduce a range of risks and they impact the entire business – not just the security team. Business impact examples include:
Infrastructure
Whether it’s an automated ATO on a perfectly coded API, or a volumetric attack against an API coded without resource or rate limiting (OWASP API#4), the impact on infrastructure teams can cause costs to skyrocket. Worse yet, the web site and mobile app can become non-responsive, resulting in (real) user dissatisfaction.
Security
Security is impacted by efforts to slow or stop API attacks, often struggling to separate real transactions from fake, or worse yet, blindsided by an unprotected shadow API.
Fraud Teams
Fraud teams are overwhelmed by unauthorized fraudulent activity that affects their business operations, brand, and customers. This enables fraudsters to constantly instigate new and creative campaigns to avoid detection and defraud users and businesses.
Marketing, Sales, eCommerce
Depending on the type of attack, these groups may be presented with inflated marketing statistics which turn into poor or misleading sales program decisions, missed revenue projections and damage to vendor relationships.
Customer Satisfaction, PR, Brand
With the understanding that 57% of consumers spend more on brands to which they are loyal, which can generate a 12%-18% incremental revenue growth per year, financial services organizations are singularly focused on customer retention. A bad experience due to a slow or unavailable website, or a compromised account drive customers elsewhere, resulting in a 5x increase in costs of acquiring a new customer.
Limitations of Traditional Defenses
Today’s security teams simply lack the visibility and defense capabilities they need to protect the ever-growing risk from APIs and other application connections. Many believe that compliance with PCI or SOC 2 and a “shift-left, DevOps” approach is sufficient to protect their APIs. The problem with these strategies is that they don’t have a way to “know the unknown”, meaning they aren’t able to look for all APIs and API vulnerabilities without knowing where to look. Even if all APIs are discovered and “known”, attackers can still leverage seemingly legitimate transactions in an attempt to steal data, or commit fraud. Traditional approaches that use WAFs or API gateways depend on easily evadable detection, lack the real-time ability to discern good from bad API activity and are reliant on static, least common denominator protection spread across multiple technology components.
Cequence Secures the Healthcare Industry
Cequence Security believes in taking a holistic approach to defending against API-related data risk with a market-defining Unified Application Protection solution that goes beyond API security approaches that may focus solely on one aspect of the API protection journey. Achieving true peace of mind for comprehensive API attack protection means traveling through six distinct steps associated with the Unified Application Protection solution:
Discovery: Viewing an organization’s API attack surface from a threat actor perspective to know the unknown.
Inventory: Performing a comprehensive multi-cloud API inventory, including all existing APIs and connections.
Testing: Integrating API protection into development, which shifts API security left within the organization, so risky code doesn’t go live.
Compliance: Keeping APIs in compliance with specifications, standards and regulations such as OWASP and ensuring ongoing API governance.
Detection: Continuous scanning for threats, including subtle business logic abuse, fraud, and automated malicious activity from bots.
Prevention: Employing countermeasures such as alerts, real-time blocking, deception, without the need for added third-party data security tools.
Unified Application Protection is different from fragmented or incomplete API security offerings because it’s a methodology designed to account for multiple types of risk, across every phase of the API protection lifecycle.
Why Cequence?
With the Cequence Unified Application Protection solution, customers can continue to reap the competitive and business advantages of ubiquitous API connectivity. The Cequence solution results in attack futility, failure, and fatigue for even the most relentless of attackers. It significantly improves visibility and protection while reducing cost, minimizing fraud, business abuse, data losses and non-compliance.