devopsy.kinsta.cloud

Tag: Salt Security

  • How to Build an Effective API Security Strategy

    How to Build an Effective API Security Strategy

    Application Programming Interfaces (APIs) enable organizations to grow their businesses and drive innovation. APIs allow applications to easily transfer data to external third-party developers, business partners and internal departments. Since APIs have access to valuable and sensitive data, they have increasingly become a target for cyberattacks.

    At the API Security Summit, taking place on March 3, distinguished cybersecurity leaders will discuss the top API security vulnerabilities to be on the lookout for and how to build an effective API security strategy.

    The agenda for the API Security Summit will explore the following topics:

    • The importance of API security testing
    • The role of APIs in their environment
    • How are hackers getting in? What can we learn from them?
    • How API attacks are different from traditional application attacks
    • What leading CISOs are doing today to protect themselves
    • How APIs are increasing the attack surface
    • Why API management is not enough for API security
    • The benefits and limits of “shift left” tactics
    • Ways to increase API security fluency across your organization
    • How to drive automation across dev and security teams

    The speaker lineup features top security experts, including:

    • Corey Ball, cybersecurity consulting manager at Moss Adams
    • Dr. Katie Paxton-Fear, lecturer of cybersecurity at Manchester Metropolitan University
    • Tom Salmon, head of cybersecurity at bp Launchpad
    • Nir Valtman, CEO at Arnica and former head of product security at Finastra
    • Tyler Warren, deputy information security officer at Prologis
    • Jeff Serota, principal security engineer at Ally Bank
    • Jack Hart, InfoSec professional and API security lead at City National Bank
    • David Biesack, chief API officer at Apiture
    • Curtis Simpson, CISO at Armis
    • Anthony Doerga, founder at AppyThings

    For more information and to register, please visit the API Security Summit website.

  • Salt Security Adds Support for GraphQL APIs

    Salt Security Adds Support for GraphQL APIs

    Salt Security has extended its platform for securing application programming interfaces (APIs) to include support for APIs built using GraphQL.

    GraphQL is an open source data query and manipulation language for APIs that was originally developed by Facebook. It provides a more efficient approach to querying data than the REST APIs that are widely used today.

    Elad Koren, chief product officer for Salt Security, said adding support for GraphQL alongside existing support for REST APIs to the Salt Security API Protection platform will make it possible for security teams to discover those APIs, mitigate data exposure, stop attacks and eliminate vulnerabilities. The Salt platform parses the complex structure of each GraphQL query to identify unique object entities that are then used to create a complete inventory of the GraphQL APIs being employed.

    APIs built using GraphQL are more challenging to secure because of the unique call and response formats, noted Koren. Cybercriminals can also, for example, leverage GraphQL capabilities such as nested queries and query batching, to launch distributed denial of service (DDoS) attacks, he said.

    Many developers will tend to assume that, because GraphQL is relatively new, most cybercriminals are primarily focused on exploiting REST APIs. However, as more developers employ GraphQL, it’s only a matter of time before cybercriminals begin to find ways to exploit APIs that may not be as secure as the REST APIs that many organizations already know how to secure.

    The Salt Security platform itself is based on a big data engine that employs machine learning algorithms and other forms of artificial intelligence (AI) to identify attacks in real-time. It creates a baseline to identify legitimate system behavior while preventing cybercriminals from using penetration testing tools to perform reconnaissance.

    From a DevOps perspective, the Salt Security API Protection Platform integrates with tools such as Jira and Slack to ensure that remediation details are routed to the right development team in addition to helping track tickets to ensure remediation fixes are implemented. It also can be integrated with security information event management (SIEM) platforms from vendors such as Splunk and Sumo Logic to enable incident response for both DevSecOps and security operations teams.

    Most IT teams will not be replacing REST APIs with GraphQL-based APIs overnight. However, there will soon be enough APIs based on GraphQL to warrant additional security measures. Less clear is to what degree those security measures will be put in place by DevSecOps teams versus a security operations team.

    One way or another, however, the number of APIs that need to be secured is accelerating rapidly as organizations roll out a new generation of microservices-based applications that drive mission-critical digital business transformation initiatives. Each microservice has its own API that needs to be built and then secured. Unfortunately, most APIs are built by developers that don’t always have the greatest appreciation for security. As such, while more responsibility for API security is shifting left toward developers, many security teams would be well advised to make certain every API being deployed is fully secure.

  • Salt Security Enhances Developer Insights on Industry’s Only Full Lifecycle API Security Platform

    Salt augments existing “shift left” features to provide more remediation insights earlier in the API lifecycle to help organizations better secure their API-driven applications 

    Palo Alto, CA – May 12, 2021 – Salt Security, the leading API security company, today announced that it has updated its next-generation Salt Security API Protection Platform with additional “shift left” security capabilities including API security posture insights and automated OpenAPI Specification (OAS) analysis and reporting. These latest capabilities enable Salt Security users to harden the full application lifecycle — build, deploy and runtime – identify risks and vulnerabilities in APIs before they are exploited, and make it easier to report on OAS standards to improve their API security posture.

    The new capabilities in the Salt platform enable companies to identify these vulnerabilities before they can be exploited. Because Salt provides both runtime protection and developer insights, companies can ensure their vital data and services are immediately protected against attacks while they work with developers to harden their APIs.

    “From a security standpoint, today’s application dependence on APIs changes the source of risk – it’s not just the front end under siege from traditional attacks and recon activities that map out backend processes,” said Mike Rothman, president of security analysis and consulting firm  Securosis. “APIs have quickly emerged as the most attractive and least protected target within today’s new applications, since they have access to critical data and services.”

    New features in the Salt Security API Protection Platform include:

    • Posture insights – enabling companies to identify risk and vulnerabilities in their APIs before they can be exploited. The Salt platform highlights actionable insights on exploitable vulnerabilities such as potential data leaks and security misconfigurations, before any actual attack has occurred. These insights help customers continuously improve their security posture and reduce their attack surface.
    • OAS accuracy – ensuring accurate documentation to enhance organizational efficiency and simplify compliance. The Salt platform provides a dynamic comparison between OAS documentation and the APIs and sensitive data the Salt platform discovers. On average, customer evaluations reveal 40% to 800% more APIs in use than companies have in their documentation and 10x to 20x the number of parameters.
    • Automated alerting and documentation – providing real-time feedback on non-compliant APIs and generating OAS documentation. Salt sends real-time alerts whenever the APIs and exposed parameters it discovers do not match OAS documentation. Organizations can export the full discovery of APIs and exposed data as updated and accurate OAS files, ensuring documentation is complete before APIs are published and simplifying compliance.

    The Salt platform has long used attacker behavior to identify security gaps in APIs – effectively using attackers as pen testers, with their small successes, before the Salt platform shuts down the attacker, highlighting areas where APIs can be improved. These new capabilities identify such security gaps well before they can be even partially exploited. Salt integrates with DevOps tools such as Jira and Slack to efficiently route remediation details to the right development team and can help track tickets to ensure remediation fixes are implemented. Salt taps the vulnerability learnings from its customer environments to enhance its ML and AI models, improving remediation insights for all its customers.

    According to the Salt Security State of API Security Report, Q1 2021, API security concerns are significantly inhibiting business innovation. Identifying vulnerabilities in APIs early in their lifecycle is crucial to protecting companies’ vital assets so they can focus on business operations instead of risk. Because APIs are unique to each business, every API vulnerability is a zero-day vulnerability.

    “The misconception persists that WAFs and API Gateways are sufficient for protecting APIs against vulnerabilities and attacks and that developer documentation provides all the information an organization needs about its APIs,” said Roey Eliyahu, co-founder and CEO, Salt Security. “But API attacks easily elude WAFs and gateways, which can protect against only known attacks, and today’s application environments are too complex and too dynamic for manual documentation to keep up. APIs are among the most vulnerable parts of the modern application stack. Salt Security’s latest capabilities make security more effective across the full application lifecycle — something no other company in the API security market provides  — identifying the zero-day vulnerabilities and protecting them from attacks in runtime.”

    For more information on the Salt Security API Protection Platform or to request a demo, please visit: https://content.salt.security/demo.html.

    About Salt Security

    Salt Security protects the APIs that form the core of every modern application. Its API Protection Platform is the industry’s first patented solution to prevent the next generation of API attacks, using machine learning and AI to automatically and continuously identify and protect APIs. Deployed in minutes, the Salt Security platform learns the granular behavior of a company’s APIs and requires no agents, no configuration, and no customization to pinpoint and block API attackers. Salt Security was founded in 2016 by alumni of the Israeli Defense Forces (IDF) and serial entrepreneur executives in the cybersecurity field and is based in Silicon Valley and Israel. For more information, please visit: https://salt.security