In September 2022, Optus suffered a massive cyberattack that exposed the sensitive information of millions of current and former customers. The Australian Information Commissioner puts the number of people affected at approximately 9.5 million Australians. The details included names, birth dates, phone numbers, email addresses, and – for some customers – addresses and identity document numbers such as driver’s licence, passport and Medicare numbers.
Based on the initial investigation, the cybercriminals could access Optus’s customer identity database through an API, or Application Programming Interface. Optus had an API that didn’t require any authentication to access the customer data within. The fact the API was exposed to the internet meant that anyone with knowledge of its existence could access the customer database.
Court documents filed by the Australian Communications and Media Authority (ACMA) in 2024 gave a fuller picture. The ACMA alleges that a coding error introduced in 2018 left an access control ineffective, four years before the attack. Optus fixed the error on its main domain in 2021 but left a second, no-longer-needed domain exposed, and the attacker used it to send requests to APIs that returned customer data through what the ACMA called “a simple process of trial and error”.
A cyberattack of this scale is devastating to any company. Optus has faced financial implications as well as immense reputational damage, along with the cost of fixing its cybersecurity and supporting affected customers. It has also faced regulatory action: the ACMA started Federal Court proceedings in May 2024, and in August 2025 the Australian Information Commissioner filed civil penalty proceedings alleging Optus failed to take reasonable steps to protect personal information, as the Privacy Act 1988 requires.
It is important that basic cybersecurity best practices are in place to ensure your systems and networks are secure, with any vulnerabilities patched and dealt with. So what is an API? And how do you secure it?
Below is an introduction to APIs and eight key ways to secure them:
API or Application Programming Interface in simple terms is the software medium that allows for two-way communication between two applications. Through an API, one application or program can access the information and capabilities of another.
Let us look at a real-life example to help you understand how an API works:
Imagine you’re at a restaurant, and you are given a menu to select what you would like to eat. You have made your decision and are looking to place an order. Although the kitchen is in view and is where your meal will be cooked, what is missing is the intermediary to communicate your order to the chef, wait till it is cooked and then deliver it back to your table.
That is where the waiter or API comes in. The waiter is the messenger – or API – that takes your request or order and tells the kitchen – the system – what to do, mentioning any additional requests you might have made, like dietary requirements you may have included in your order. The waiter then delivers the response back to you, in this example, the meal you ordered.
APIs work based on the concept of request and response, an individual makes a request in the hopes that that request is fulfilled by a response. An API acts like the facilitator or interface for that request, its role isn’t simply to communicate a message but to also interpret what is needed, source the information or solution and respond back.
Now that you have a basic understanding of how an API works, you can imagine how useful they are. Here is how they are beneficial:
APIs have quickly become the go-to method for building applications, especially when it comes to mobile and IoT devices. Although they are highly beneficial they act as the gateway to data, exposing data to outsiders and the public. This makes APIs extremely lucrative targets for a malicious actor, not solely for the data the APIs provide, but as potential entry points to other backend systems within a business’s infrastructure. APIs can pose a huge risk to companies, and like in Optus’s case can lead to a devastating cyberattack.
Here are eight best practices when it comes to securing an API:
The security of an API needs to be considered during its development and not as an afterthought once it has been implemented. As we have seen with Optus, a single API can expose an entire database to cybercriminals looking to steal or expose the sensitive information stored within. Therefore businesses need to ensure that security is thought of during the development process.
With how many uses APIs have, businesses tend to have dozens or even hundreds of publicly available APIs. It is essential that you keep an inventory of all your existing APIs, to then be able to secure and manage them appropriately. Retire APIs and domains you no longer need rather than leaving them exposed – the ACMA alleges the Optus attack came through exactly such a domain.
An effective method of implementing access control is by following the concept of least privilege. Least privilege is defined as the strict assignment of access rights and permissions for users, accounts, applications, systems, devices and computing processes, to the absolute minimum so that assigned organisational activities can be carried out. It gives users the bare minimum permissions they need to perform their work. It is essential that this principle is applied to APIs.
Non-existent authentication and authorisation are major issues with many publicly available APIs. In fact, ineffective access controls are what allegedly allowed cybercriminals to access the records of around 9.5 million Optus customers. Since an API can provide access to an organisation's databases, it is essential that access to them is strictly controlled and monitored.
Authorisation mechanisms such as the OAuth 2.0 system segment your account into resources and provides limited access to the auth token bearer. An additional precaution that can be taken is to implement an expiry protocol on authentication tokens, for example, a 24-hour expiry on tokens can mitigate the impact of a breach or security incident.
Rate limiting is used to control the number of requests an API accepts from each client in a given period. APIs are often subject to Distributed Denial of Service or DDoS attacks; by implementing a constraint on the number of requests that are accepted by your APIs, you can defend against bots that flood your APIs with requests in the hopes of disabling them.
An SQL Injection can wipe out entire databases if not careful. Therefore it is essential that any input that passes through to an endpoint is validated. If it is a bad input, for example, our API expects an email address but is given a postal address, then the API will reject the data. This is an essential method for securing APIs and preventing attempts by cybercriminals to compromise them.
Organisations may choose to not encrypt data from APIs that are considered ‘non-sensitive’, however, this may open an organisation up to a ‘man in the middle attack’. Organisations that utilise APIs to exchange sensitive information should consider encryption as essential. The cost of a data breach or cyberattack severely outweighs the cost of a TLS certificate.
Ensure that APIs are revealing the right amount of data or information required to complete their task. If security controls are not in place, APIs can reveal an extraneous amount of information that can create vulnerabilities. Ensure that filtering is done by the endpoint to control the amount of data exposed by APIs.
The above methods are just a starting point when it comes to securing APIs and protecting your organisation from cybercriminals. APIs are frequently targeted by malicious actors who utilise SQL Injections, Cross-Site Scripting, Distributed Denial-of-Service or Man-In-The-Middle attacks against them. To ensure that your APIs aren’t susceptible to threats like this it is essential that they are adequately secured by your organisation. If you are not sure where to start, the above eight methods are a good starting point for improving your API security. For a fuller checklist, the OWASP API Security Top 10 (2023 edition) lists the 10 most critical API security risks.
We know that cybersecurity can be an overwhelming prospect for business owners, especially ones that own small to medium businesses with a limited budget. There are many things to consider when building a cybersecurity strategy, like which framework to follow and what to prioritise when it comes to implementation. At StickmanCyber we are here to help you with your cybersecurity journey.
With growing cybersecurity attacks, most businesses lack the skills and time to mitigate their risks; we provide a comprehensive fully managed service that protects and certifies your business, resulting in mitigating your risks, building trust, and winning and retaining clients.
The First Step is Crucial. Start with a Cybersecurity Assessment
Where are you at your cybersecurity maturity journey? Get an assessment of your current security posture and identify the gaps and challenges that you need to act upon.
Start an assessment or book a free consultation with one of our experts.
API security is the practice of protecting application programming interfaces from misuse and attack. It covers who can call an API (authentication), what each caller is allowed to access (authorisation), how many requests they can make (rate limiting) and how much data the API returns. Because APIs often connect directly to customer databases, a single weak API can expose large volumes of personal information.
The OWASP API Security Top 10 is a list of the most critical security risks for APIs, published by the Open Worldwide Application Security Project, a non-profit foundation. The current edition, released in 2023, is led by Broken Object Level Authorization and Broken Authentication, and also covers Unrestricted Resource Consumption and Improper Inventory Management. Many of the best practices in this article map directly to these risks.
Broken object level authorisation (BOLA) is the top risk in the OWASP API Security Top 10. It occurs when an API accepts an object identifier, such as a customer or account number, without checking that the caller is allowed to access that specific record. Attackers can then change the identifier in their requests to retrieve other people’s data, so authorisation checks are needed in every function that accesses data using an ID supplied by the user.
Start with an up-to-date inventory of your APIs, then combine automated security testing in the development pipeline with regular manual penetration testing. A test should check authentication, authorisation between users and records, rate limiting, input validation and how much data each endpoint returns. Retest after significant changes to an API or the systems behind it.
An API gateway helps by centralising controls such as authentication, rate limiting, TLS and logging in front of your APIs. On its own, it cannot fix flaws in the application behind it, such as an API that returns another customer’s record because object-level authorisation checks are missing. Treat a gateway as one layer of defence alongside secure coding, testing and monitoring.
Contain the breach first, for example by disabling or restricting the affected API, then assess the likely harm and follow your incident response plan. Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a breach is likely to result in serious harm. ASD’s ACSC can also help, 24/7, on 1300 CYBER1.