7. of Spoofing I

An attacker can connect to a server or peer over a link that isn’t authenticated (and encrypted).

Threat
	You have an internal API so that your applications can perform lookups of customer details (addresses, phone numbers, etc.) but, although only intended for internal use, this API doesn’t require authentication and access from the internet hasn’t been blocked. So, an attacker, having discovered the service, is now harvesting all your customer information.
CAPEC	CAPEC-36: Using Unpublished Interfaces or Functionality
ASVS	1.2.2 Ensure all your APIs that expose sensitive data are authenticated
CWE	CWE-306: Missing Authentication for Critical Function

...