Postman, the API collaboration platform for developers, advocates an API-First approach for companies. Using 42Crunch, API developers and application security teams can now implement API security design and testing as part of their API-First approach in Postman.
Kin Lane, chief Evangelist with Postman recently joined Isabelle Mauny, Field CTO at 42Crunch for a webinar to demonstrate how enterprises are automating the testing of API security for all their APIs.
API Explosion: API-Last or API-First?
Kin pointed out that APIs have come a long way from the mid-90s when businesses such as eBay and Amazon first started to exploit the web using APIs. However, despite the fact that APIs are now everywhere, there is a strong distinction to be drawn between companies who are characterized as API-Last and those who are API-First. Adopting an API-first strategy better prepares a business for the digital revolution impacting every industrial sector today.
API Contracts – OpenAPI and Postman Collections
Unfortunately the standards of API development vary widely and many are poorly built and left exposed to security vulnerabilities. Central to a successful API strategy is the adherence by the development teams to API contracts which define the documentation of the API that will ultimately be consumed by both internal and external customers. The OpenAPI specification and Postman Collections have evolved to assist companies build API contracts that help move APIs forward throughout the API lifecycle.
Shift-Left & Shield Right with Security as Code
Isabelle Mauny expanded on the concept of the API lifecycle and recommended that enterprises adopt a shift-left approach to protecting their APIs by introducing “security as code” as early as possible in the API design and development phases. Isabelle demonstrated how easy it is for developers to take control of implementing security as they code using 42 Crunch’s API audit and scan services that are pre-integrated into the developers’ favourite IDEs and CI/CD environments and now also integrated with Postman. Complementing this shift-left approach, is the 42Crunch API firewall that enforces API security policy at runtime.
