{"id":17039,"date":"2023-10-03T18:26:34","date_gmt":"2023-10-03T17:26:34","guid":{"rendered":"https:\/\/staging2022.42crunch.com\/?page_id=17039"},"modified":"2024-04-29T14:58:19","modified_gmt":"2024-04-29T13:58:19","slug":"6-pillars-of-api-security","status":"publish","type":"page","link":"https:\/\/staging2022.42crunch.com\/6-pillars-of-api-security\/","title":{"rendered":"The 6 Core Pillars of API Security"},"content":{"rendered":"\n\n\t\t<h1>\n\t\t\tThe Core Pillars of API Security\n\t\t\t\t\t\t\t\t\t\t\tSecurity Throughout the API Lifecycle\n\t\t<\/h1>\n\t\t\t<p>Increase your API Security Maturity by understanding each of the core domains and the challenges each presents.<\/p>\t\t\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2023\/09\/DevSecOps-Pillars-1024x782.png\" alt=\"The 6 domains of API security\" itemprop=\"image\" height=\"782\" width=\"1024\" title=\"DevSecOps &amp; the 6 Pillars of API Security\" onerror=\"this.style.display='none'\"  \/>\n<h2>\n\t\tEnhancing your API Security Posture\n\t<\/h2>\n\t<p>Understanding your current position on each of the core domains of API security and what gold standard looks like will allow you to create a plan to improve your API security posture. Below we ask the key questions related to each domain, these questions are answered on a dedicated page for each domain.<\/p>\n<h2>\n\t\t<a href=\"https:\/\/staging2022.42crunch.com\/secure-api-design\/\" title=\"API &lt;b&gt;DESIGN&lt;\/b&gt;\" target=\"_self\" rel=\"noopener\">\n\t\tAPI <b>DESIGN<\/b>\n\t\t<\/a>\n\t<\/h2>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2023\/10\/DevSecOps-API-Design.png\" alt=\"DevSecOps-API Design\" itemprop=\"image\" height=\"137\" width=\"300\" title=\"DevSecOps-API Design\" onerror=\"this.style.display='none'\"  \/>\n\t<ul>\n<li>Are you doing API-design-first?<\/li>\n<li>Do you incorporate security into the design phase?<\/li>\n<\/ul>\n<p>WHY IT MATTERS?<\/p>\n<p>It is significantly more cost e.ective to address security issues at the design phase, rather than later in the lifecycle &#8211; <strong>a shift-left<\/strong> approach is key.<\/p>\n<p><a href=\"https:\/\/staging2022.42crunch.com\/secure-api-design\/\">Secure API Design explained<\/a><\/p>\n<h2>\n\t\t<a href=\"https:\/\/staging2022.42crunch.com\/secure-api-development\/\" title=\"API &lt;b&gt;DEVELOPMENT&lt;\/b&gt;\" target=\"_self\" rel=\"noopener\">\n\t\tAPI <b>DEVELOPMENT<\/b>\n\t\t<\/a>\n\t<\/h2>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2023\/10\/DevSecOps-API-Development.png\" alt=\"DevSecOps-API Development\" itemprop=\"image\" height=\"147\" width=\"310\" title=\"DevSecOps-API Development\" onerror=\"this.style.display='none'\"  \/>\n\t<ul>\n<li>Are your developers trained to code securely?<\/li>\n<li>Do they understand API security threats and risks?<\/li>\n<\/ul>\n<p>WHY IT MATTERS?<\/p>\n<p>This vital stage is where the rubber meets the road &#8211; developers should ensure they are following <strong>security best practice<\/strong> to avoid introducing vulnerabilities into APIs.<\/p>\n<p><a href=\"https:\/\/staging2022.42crunch.com\/secure-api-development\/\">Secure API Development Explained<\/a><\/p>\n<h2>\n\t\t<a href=\"https:\/\/staging2022.42crunch.com\/api-security-testing\/\" title=\"API &lt;b&gt;SECURITY TESTING&lt;\/b&gt;\" target=\"_self\" rel=\"noopener\">\n\t\tAPI <b>SECURITY TESTING<\/b>\n\t\t<\/a>\n\t<\/h2>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2023\/10\/DevSecOps-API-Security-Testing.png\" alt=\"DevSecOps-API Security Testing\" itemprop=\"image\" height=\"148\" width=\"310\" title=\"DevSecOps-API Security Testing\" onerror=\"this.style.display='none'\"  \/>\n\t<ul>\n<li>Are you doing automated API testing?<\/li>\n<li>Are you considering security in your test strategy?<\/li>\n<\/ul>\n<p>WHY IT MATTERS?<\/p>\n<p>Without adequate API security testing an organization runs the risk of deploying insecure APIs &#8211; <strong>test early, test often, test everywhere.<\/strong><\/p>\n<p><a href=\"https:\/\/staging2022.42crunch.com\/api-security-testing\/\">API Security Testing Explained<\/a><\/p>\n<h2>\n\t\t<a href=\"https:\/\/staging2022.42crunch.com\/api-inventory-security\/\" title=\"API &lt;strong&gt;INVENTORY&lt;\/strong&gt;\" target=\"_self\" rel=\"noopener\">\n\t\tAPI <strong>INVENTORY<\/strong>\n\t\t<\/a>\n\t<\/h2>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2023\/10\/DevSecOps-API-Inventory.png\" alt=\"DevSecOps-API Inventory\" itemprop=\"image\" height=\"156\" width=\"310\" title=\"DevSecOps-API Inventory\" onerror=\"this.style.display='none'\"  \/>\n\t<ul>\n<li>Do you understand what APIs you own?<\/li>\n<li>Do you track shadow and zombie APIs?<\/li>\n<\/ul>\n<p>WHY IT MATTERS?<\/p>\n<p>An <strong>up-to-date and accurate inventory<\/strong> is key to maintaining visibility into the exposed risk and attack surface.<\/p>\n<p><a href=\"https:\/\/staging2022.42crunch.com\/api-inventory-security\/\">Securing Your API Inventory Explained<\/a><\/p>\n<h2>\n\t\t<a href=\"https:\/\/staging2022.42crunch.com\/api-protection\/\" title=\"API &lt;b&gt;PROTECTION&lt;\/b&gt;\" target=\"_self\" rel=\"noopener\">\n\t\tAPI <b>PROTECTION<\/b>\n\t\t<\/a>\n\t<\/h2>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2023\/10\/DevSecOps-API-Protection.png\" alt=\"DevSecOps-API Protection\" itemprop=\"image\" height=\"156\" width=\"309\" title=\"DevSecOps-API Protection\" onerror=\"this.style.display='none'\"  \/>\n\t<ul>\n<li>Are you using API protection technology (WAFs, WAAPs, API gateways) in your deployments?<\/li>\n<li>Are you using API runtime threat protection technology?<\/li>\n<\/ul>\n<p>WHY IT MATTERS?<\/p>\n<p>A <strong>defense-in-depth<\/strong> approach is the foundation of risk reduction &#8211; regardless of how well designed your APIs are, they will still be attacked by persistent and skilled adversaries. Adding runtime threat protection is a key tool in defensive strategies.<\/p>\n<p><a href=\"https:\/\/staging2022.42crunch.com\/api-protection\/\">Secure API Runtime Protection Explained<\/a><\/p>\n<h2>\n\t\t<a href=\"https:\/\/staging2022.42crunch.com\/api-governance-security\/\" title=\"API &lt;b&gt;GOVERNANCE&lt;\/b&gt;\" target=\"_self\" rel=\"noopener\">\n\t\tAPI <b>GOVERNANCE<\/b>\n\t\t<\/a>\n\t<\/h2>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2023\/10\/DevSecOps-API-Governance.png\" alt=\"DevSecOps-API Governance\" itemprop=\"image\" height=\"156\" width=\"320\" title=\"DevSecOps-API Governance\" onerror=\"this.style.display='none'\"  \/>\n\t<ul>\n<li>Do you control and actively monitor your API estate and environments?<\/li>\n<li>Can you enforce security policies?<\/li>\n<\/ul>\n<p>WHY IT MATTERS?<\/p>\n<p><strong>Trust but verify<\/strong> &#8211; a robust governance process is essential to ensure that API development observes organizational methodologies and policies.<\/p>\n<p><a href=\"https:\/\/staging2022.42crunch.com\/api-governance-security\/\">API Security Governance Explained\u00a0<\/a><\/p>\n\t<h4>Datasheet<\/h4>\n<h2>\n\t\t42Crunch and Microsoft deliver <br \/>seamless DevSecOps for API Security\n\t<\/h2>\n\n\t\t\t<a href=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2023\/03\/42Crunch-Microsoft-Datasheet.pdf\" target=\"_blank\" rel=\"noopener\">\n\t\t\t\t\t\t\tDownload\n\t\t\t\t\t<\/a>\n\t\t\t\t<img decoding=\"async\" src=\"https:\/\/staging2022.42crunch.com\/wp-content\/uploads\/2022\/09\/Microsoft-Datasheet-Mockups-2-copy.png\" alt=\"Microsoft Datasheet Mockups 2 copy\" title=\"Microsoft Datasheet Mockups 2 copy\" itemprop=\"image\"  \/>\n<h2>\n\t\tReady to Learn More?\n\t<\/h2>\n\t<p>Developer-first solution for delivering API security as code.<\/p>\n\t\t\t<a href=\"https:\/\/staging2022.42crunch.com\/get-started\/\" target=\"_self\" rel=\"noopener\">\n\t\t\t\t\t\t\tGet Started\n\t\t\t\t\t<\/a>\n\n","protected":false},"excerpt":{"rendered":"<p>The Core Pillars of API Security Security Throughout the API Lifecycle Increase your API Security Maturity by understanding each of the core domains and the challenges each presents. Enhancing your API Security Posture Understanding your current position on each of the core domains of API security and what gold standard looks like will allow you [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"6 Pillars of API Security for all API Security Programs ","_seopress_titles_desc":"The six core pillars of API Security explained. These include: API Inventory; API Design, API Development, API Security Testing, API Threat Protection and API Governance.","_seopress_robots_index":"","site-sidebar-layout":"default","site-content-layout":"disabled","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"disabled","ast-hfb-above-header-display":"disabled","ast-hfb-below-header-display":"disabled","ast-hfb-mobile-header-display":"disabled","site-post-title":"disabled","ast-breadcrumbs-content":"disabled","ast-featured-img":"disabled","footer-sml-layout":"disabled","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-17039","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/pages\/17039"}],"collection":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/comments?post=17039"}],"version-history":[{"count":1,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/pages\/17039\/revisions"}],"predecessor-version":[{"id":18586,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/pages\/17039\/revisions\/18586"}],"wp:attachment":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/media?parent=17039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}