Akamai Technologies, Inc. has published a report that showed cyberattacks against application programming interfaces (APIs) used in the financial services sector have increased 65% year-over-year.

Researched in collaboration with FS-ISAC, a nonprofit committed to improving cybersecurity in the financial services sector, the report also found a larger percentage of these attacks exploited Local File Inclusion (LFI) vulnerabilities, while there has been a slight decline in attacks using cross-site scripting (XSS) and structured query language injection (SQLi) techniques.

Steve Winterfeld, advisory CISO at Akamai, said it’s clear that while APIs play a critical role in enabling innovative financial services, there is a clear need to focus on securing APIs as tactics and techniques continue to evolve. Organizations tend to overlook cybersecurity in the rush to build and deploy IT services that have the potential to drive additional revenue, he added. That doesn’t mean organizations shouldn’t launch these types of initiatives, but it does mean there needs to be a greater appreciation for the cybersecurity implications, noted Winterfeld.

For example, the report noted that web application firewalls (WAFs) have become better at thwarting XSS and SQLi attacks, which partly accounts for why more LFI attacks are being seen.

Unfortunately, many financial services firms still lack visibility into how APIs are being abused by cybercriminals, noted Winterfeld. However, much like any other sector, there is still an ongoing debate as to whether API security is a distinct discipline versus a subset of a larger application security strategy.

The report did note there is cause for some optimism as more organizations begin to comply with the latest version of the Payment Card Industry Data Security Standard (PCI-DSS) that requires increased focus on API security and the Digital Operational Resilience Act (DORA) being adopted by the European Union. In addition, resiliency guidelines put forward by the National Institute of Standards and Technology (NIST) will also serve to improve application security, noted Winterfeld.

In general, the report noted access control bypass and account takeover attacks made up most of the attacks launched against APIs. In addition, there is a significant amount of activity involving web scrapers used to steal financial data that can be used to launch phishing attacks, the report noted. The financial services sector had the highest percentage of reported phishing attacks than any other vertical for the second quarter (51%) than any other vertical industry.

Overall, the report also noted that the financial services sector continued to be victimized by distributed denial-of-service (DDoS) attacks that escalated with the onset of the war in Ukraine. There is also a significant amount of malicious bot activity aimed at financial services organizations, the report noted.

Cybercriminals are, of course, targeting the financial services industry because that’s where the money is. In fact, the Akamai report noted that the financial services sector has now surpassed the gaming industry as the vertical industry experiencing the most DDoS attacks.

Regardless of the vertical, cybersecurity professionals will be looking to see how the financial services sector responds to this latest surge of cyberattacks. The only difference, of course, is that financial services firms, more than other types of organizations,  have more resources at their disposal to combat threats as they continuously evolve.