11/02/2022
Latest Announcement for Cybersecurity in Digital Mental Health
API Security Project Launch!
https://www.beckyinkster.com/apisecurityproject
What is Our Goal?
We want to show ‘what good looks like’ for API security-by-design in digital mental health service provision. Protecting sensitive data in the channel from mobile app, via API to backend cloud/server, is a fundamental step to ensure sensitive data doesn’t inadvertently leak to places it shouldn’t.
Who Is This Project For?
Any security vendors, API vendors, healthcare service providers, pentesters, and other interested individuals and parties are all welcome to join us. If you are interested in participating in this project to create a recipe for digital mental health service API security, please get in touch with Becky Inkster (becky@beckyinkster.com) and David Stewart (david.stewart@approov.io).
Why does API Security Matter?
APIs define how apps can communicate with other apps and systems, and this form of communication accounts for over 83% of all internet traffic (29). APIs play a crucial role in supporting health IT interoperability by allowing multiple data sources to become transferable, which can help healthcare providers give better care (35).
As the pandemic accelerated the use of mobile healthcare apps, this has increased the exposure of health data through API vulnerabilities used by mobile health applications. Mobile apps and the APIs that service them are a particularly challenging environment to protect. Certain tactics used by cybercriminals include exploiting digital services via their APIs. Malicious API traffic is growing faster than non-malicious API calls (e.g., Salt Security customer data showed that API calls grew 51% whereas malicious traffic grew 211% (30) and it has been predicted that by 2022 API attacks will become the most frequent attack vector for application breaches (31). Many high-profile companies have experienced API-related cybersecurity problems, and a report by Salt Security found that 91% of companies had API-related security problems (32).
In the largest unveiling of vulnerabilities in telemedicine APIs, a report called “All That We Let In” by ethical hacker Alissa Knight and Approov found that all 30 mobile health apps investigated were vulnerable to API attacks, which collectively exposed 23 million mobile health users (33-34) Much more research and security-by-design implementation is needed, especially related to vulnerabilities and inadequacies in the implementation of security around APIs that carry very sensitive data - including but not limited to Fast Healthcare Interoperability Resources (FHIR) APIs and the mobile apps that use them (36-38).