In September 2022, Optus, one of Australia’s largest telecom companies, found that the personal details of up to 9.8 million customers had been exposed. The attacker did not break through a firewall or hack a server. Investigations showed the data was reached through an internet-facing API that did not ask for a login.
This is the risk many enterprises miss. They protect their applications and networks well, but the APIs, EDI links and file transfers that move data between systems and partners get far less attention.
Below, we explain where this risk comes from, the six gaps we see most often in large organisations, and five practical steps to close them.
What Is Enterprise Integration Security?
Think about what happens when a customer places one online order. The order goes from your website to your ERP, then to your warehouse, then to a courier partner, and a payment confirmation comes back from the bank. That single order uses at least four connections.
Enterprise integration security is about protecting those connections. For every API, EDI link, file transfer and partner link, it answers three simple questions:
- Who is allowed to use it?
- What data does it share?
- Is anyone watching for unusual activity?
If a connection fails any of these, the data inside it is at risk.
Why Attackers Now Target Integrations
There are many more of them. Cloud apps, mobile apps and digital partners mean a large enterprise can run hundreds or even thousands of APIs and data flows, built by different teams over many years.
They carry the data attackers want. Customer records, payment details and contracts all pass through integrations.
Misuse looks like normal traffic. When an attacker uses a valid API key or a partner’s login, each request looks like a genuine business request. Firewalls and antivirus tools see nothing wrong.
Your partners widen the door. Every supplier, broker or vendor connected to your systems adds a possible entry point. If they are breached, their trusted connection becomes the attacker’s route in.
Two More Breaches That Started With a Connection
T-Mobile (USA). From around 25 November 2022, an attacker used one of T-Mobile’s APIs to pull data linked to about 37 million customer accounts. The activity was only detected on 5 January 2023, roughly six weeks later.
Lesson: An API can be misused for weeks if nobody is watching how it is used.
MOVEit Transfer (Global, 2023). The ransomware group Cl0p exploited a flaw in MOVEit, a file transfer tool many companies use to exchange files with partners. By the end of August 2023, more than 1,000 organisations and about 65 million people had been affected, many of them through vendors and service providers.
Lesson: A partner’s file transfer tool is part of your security, even if you do not own it.
6 Integration Security Gaps We See Most Often
- Old APIs that were never switched off.
Test endpoints and older API versions keep running after projects end, with nobody checking them.
Example: A company releases a more secure version 2 of its customer API but leaves version 1 running. An attacker finds version 1 and reads customer data without the new controls. - System accounts with too much power.
Integration accounts are often given full admin rights, and passwords are typed straight into code and never changed.
Example: A reporting tool only needs to read sales figures, but its account can also edit and delete ERP records. Whoever steals that account gets the same power. - APIs that hand out too much data.
Some APIs return full records when only a few fields are needed, or do not check whether the caller may see that record. Broken object-level authorisation is ranked the number one risk in the OWASP API Security Top 10.
Example: A portal loads a customer with /customer/10045. A logged-in user changes it to /customer/10046 and sees someone else’s details. The Optus API had a similar weakness, with customer IDs that simply went up by one. - Loose partner access.
Partners get broad access, passwords are shared by email, and access stays open after the partnership ends.
Example: An employee at a freight partner clicks a phishing link. The attacker logs into your shipment portal with that partner’s account and sees customer names and addresses. - Ageing middleware and exposed files.
Platforms near end of support may stop receiving security updates, and data files sit unencrypted in shared folders.
Example: Payroll data is exported each night as a CSV file for the bank transfer. The file is never deleted or encrypted, and 50 people can open the folder. - Monitoring that only checks delivery.
Most integration dashboards only confirm that messages arrived, not whether the activity makes sense.
Example: An API that normally handles 500 requests a day receives 200,000 at 2 a.m. The dashboard stays green because every request succeeded.
Why These Gaps Stay Hidden
- Nobody fully owns the connections. Security teams look after networks and devices, integration teams keep data moving, and business teams manage partners. Integrations fall between all three.
- Security tools see traffic, not intent. A firewall cannot tell whether 10,000 exported records is a monthly report or a theft.
- Yearly testing is too slow. New partners and apps are connected every month, so an annual test is soon out of date.
- The law still holds you responsible. Rules such as GDPR, PCI DSS and HIPAA make your company accountable for data wherever it goes, including through partners.
5 Steps to Secure Your Integrations
Step 1: Find your high-risk connections
Start with the integrations that carry sensitive data or connect to outside partners, and give each one a named owner.
Example: A retail company found 30 old integrations that were no longer used but still active. Switching them off removed a large part of its risk in a single day.
Step 2: Make every connection prove who it is
Use a zero trust approach: no system or partner is trusted automatically. Use strong authentication such as OAuth 2.0 or certificates, give each integration only the access it needs, store keys in a secure vault, and close access when a partner leaves.
Example: Instead of one shared password for all suppliers, each supplier gets its own certificate. If one supplier is breached, only that one connection is blocked.
Step 3: Share less, and protect what you share
Return only the fields that are needed, mask values such as card and ID numbers, encrypt data in transit and at rest, and reject messages that do not match the expected format.
Example: A bank’s API for an insurance partner used to return full customer profiles. It now returns only name, policy number and status, so much less can leak if it is misused.
Step 4: Apply one set of rules everywhere
Put APIs behind a gateway or central integration platform so the same login checks, access rules and request limits apply to every connection. Add a security review before anything new goes live.
Example: A hospital group had patient data flowing between its booking app, lab systems and insurers, each secured differently. After placing every API behind one gateway, all connections follow the same rules, and audits take days instead of weeks.
Step 5: Alert on unusual behaviour
Set alerts for traffic spikes, logins at odd hours and unexpected data requests, and send integration logs to your security monitoring team.
Example: An alert fires when a partner account downloads ten times its normal daily volume. The account is blocked within minutes.
Planning to replace older middleware? That move is the best time to build these controls in. Our guide to integration modernization explains how to do it safely.
How Quadrant IT Services Can Help
Quadrant IT Services works on both integration and cyber security. With more than 13 years in enterprise integration, and clients across banking, insurance, telecom and logistics, we know where data flows and where it is usually exposed.
We can help you with:
- Security analysis: vulnerability scans, penetration tests and compliance audits against GDPR, PCI DSS and HIPAA
- Secure integration architecture: designs that cover security at both the integration and transport level, from authentication to data formats
- API development and management: APIs built and managed with access control and data protection in mind
- Managed file transfer: end-to-end encryption, audit logging and monitoring for file exchanges with partners
- Cloud security: protecting integrations and data as you move to the cloud
Do you know who is watching the data that moves between your systems and partners? Book a 30-minute Integration Audit and we will show you where your data is exposed and what to fix first.
Frequently Asked Questions
- What is enterprise integration security?
It is the practice of protecting the connections that move data between your systems, applications and partners, such as APIs, EDI links, file transfers and integration platforms. - How is API security different from application security?
Application security protects the software people use. API security protects how systems talk to each other. An app can be secure while the API behind it still shares too much data or lets the wrong users in. - Why are B2B connections a security risk?
They give outside companies trusted access to your data. If a partner is breached or a connection is poorly set up, attackers can use it to reach your systems without being noticed. - How often should integrations be checked for security?
High-risk integrations should be monitored all the time and reviewed at least every quarter, and again whenever you add a major partner or move to a new platform.