{"id":7633,"date":"2019-08-22T00:01:44","date_gmt":"2019-08-21T23:01:44","guid":{"rendered":"https:\/\/staging-site.42crunch.com\/?p=7633"},"modified":"2022-09-24T16:17:45","modified_gmt":"2022-09-24T15:17:45","slug":"revolutionizing-api-security-interview","status":"publish","type":"post","link":"https:\/\/staging2022.42crunch.com\/revolutionizing-api-security-interview\/","title":{"rendered":"Revolutionizing API Security &#8211; 42Crunch + Digital Anarchist"},"content":{"rendered":"<p>42Crunch CEO, Jacques Declas, sat down with Alan Shimel of Digital Anarchist at this year&#8217;s RSA APJ show to discuss new trends in API Security, DevSecOps, and what tools you need to keep up!<\/p>\n<style>.embed-container { position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%; } .embed-container iframe, .embed-container object, .embed-container embed { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }<\/style>\n<div class=\"embed-container\"><iframe src=\"https:\/\/www.youtube.com\/embed\/eJIfbrVRZL4\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/div>\n<p>&nbsp;<\/p>\n<p><strong>[Alan Shimel] <\/strong>Hey everyone, it\u2019s Alan Shimel for DevOps.com Security Boulevard. We\u2019re here in Singapore at RSA APJ. We\u2019re right on the edge of the show floor interviewing speakers, attendees, vendors \u2013 just getting the temperature and feel for this year&#8217;s RSA APJ. It always gets me excited when I can find a new DevSecOps company, and just walking around the floor earlier I came across a company that had DevSecOps all over their stuff and I was like \u2013 I never heard of these guys. So I walked over and introduced myself and I met this gentleman here Jacques Declas. He\u2019s the CEO of a company called 42Crunch. Ok, so 42Crunch, what is it \u2013 it&#8217;s DevSecOps \u2013 but what do you guys do? What are you about?<\/p>\n<p><strong>[Jacques Declas] <\/strong>Well, we\u2019re trying to change the way security has been done for 15 years by putting security in the code of applications. You&#8217;re going to hear us talk a lot about security as code \u2013 like Kubernetes did for the infrastructure \u2013 we&#8217;re trying to do the same for security. We feel security hasn\u2019t been done the right way, and it\u2019s been a bit of a failure trying to secure applications from the edge of a network \u2013 which is disappearing really fast. We created a cloud platform for the customers to use and to put enforcement on security anywhere in the network. And we followed the developers, so we&#8217;re putting security into the developers\u2019 hands.<\/p>\n<p><strong>[Alan Shimel] <\/strong>Sounds like DevSecOps to me! A couple of things we&#8217;ll jump into. First of all, I got into DevSecOps six\/seven years ago for exactly the same reason. I felt that DevOps and the whole shift-left and security as code gave us a chance to right some wrongs that we&#8217;ve seen in the past. What I&#8217;ve seen over the last six\/seven years though is we still have security for what&#8217;s called SecOps. We have security through the Ops people. What we&#8217;re seeing as part of that shift-left security for developers \u2013 let&#8217;s call that DevSec. So you have DevSec and SecOps \u2013 DevSecOps. And they&#8217;re not necessarily mutually exclusive, but that&#8217;s just how it&#8217;s done. So you&#8217;re clearly going for the DevSec element.<\/p>\n<p><strong>[Jacques Declas] <\/strong>Yes, but we also have a good story for the operations people who with DevOps these days \u2013 all the Ops have been decimated because it&#8217;s kind of done by the developers. Things like Kubernetes, your developers write five lines of code and that\u2019s it \u2013 Kubernetes is a mini datacenter on its own taking most of the complex network configuration away from operations.<\/p>\n<p><strong>[Alan Shimel] <\/strong>Kubernetes is shacking the whole DevOps space up \u2013 from chef to puppet to\u2026<\/p>\n<p><strong>[Jacques Declas] <\/strong>It&#8217;s a revolution<\/p>\n<p><strong>[Alan Shimel] <\/strong>Yeah, it&#8217;s changed things.<\/p>\n<p><strong>[Jacques Declas] <\/strong>Through my experience of being in security for a long time \u2013 and especially seeing the exponential proliferation of APIs \u2013 those thin interfaces that connect everything to anything these days \u2013 we saw some real old traditional ways of trying to secure those applications becoming more and more painful \u2013 and the more APIs talk to other APIs, outside my data center, out to partners, data I own, data I don\u2019t. It&#8217;s just becoming really difficult \u2013 more or less impossible. That&#8217;s when we had the idea to really try to shift left and put security in the hands of developers \u2013 because they build the applications so they know exactly what data in coming in and out, how sensitive a particular data is and so on. So they know and therefore security doesn\u2019t need to guess anymore what the application does.<\/p>\n<p><strong>[Alan Shimel] <\/strong>You got to start it there because if you&#8217;re waiting for it to be here\u2026<\/p>\n<p><strong>[Jacques Declas] <\/strong>And that&#8217;s why people talk about artificial intelligence. I think it&#8217;s great, but what it means \u2013 it means we&#8217;re still trying to understand what the developers did because we still don&#8217;t know. So what we&#8217;re doing is going back to them and say we&#8217;re not asking you to do security as such in your code, we\u2019re asking you to define properly what you do. Let security help you to put the right things in place for the whole DevOps cycles and CI\/CD \u2013 because what we found is those API through agile development and competition and bringing those mobile app in the last 10 years as fast as possible \u2013 those APIs were changing weekly. Before you contacted security to secure it, there was a new version coming out, so it never happened. So we&#8217;re putting it in the code, it goes to the CI\/CD, we\u2019re integrating with all the Jenkins and pipelines and GitHub and GitLab.<\/p>\n<p><strong>[Alan Shimel] <\/strong>Jenkins is another thing being disrupted by Kubernetes. In talking to some of your team I stopped by the booth and I watched \u2013 and you\u2019re really focusing on the APIs that are being used here.<\/p>\n<p><strong>[Jacques Declas] <\/strong>That&#8217;s right. There&#8217;s a particular reason for that. First, I&#8217;ve been involved in the API before they were called API \u2013 they were SOAP, before that XML and EDI. I could tell they were going to really take over the world. I don&#8217;t know if you saw it, there was a research published by Akamai, The State of the Internet in 2018, and it said that JSON API traffic in 2010 was 2% of web traffic, and it went up to 83% last year! I mean it&#8217;s just everywhere. So for us, API security is quickly replacing the web application security, it\u2019s just everywhere.<\/p>\n<p><strong>[Alan Shimel] <\/strong>So CA Technologies, right, since the acquisition they&#8217;re a little bit different \u2013 but before the acquisition they really had it, right? They said we live \u2013 I remember interviewing their CEO \u2013 who said we&#8217;re living in an API driven economy \u2013 it\u2019s the APIs that are driving it. Yes there&#8217;s great applications, but every single application we use \u2013 well first of all it&#8217;s 85% open source components, right, and then behind the scenes all these applications a lot of what they do is make API calls out to dependencies or they&#8217;re dependent on these other apps and functions and so forth. I&#8217;m reminded of a company I knew in Boulder Colorado, SendGrid, I don\u2019t know if you ever heard of them. This company went for a couple of billion dollars, they got sold, but all they were was the \u00a0e-mail piece that went into your app when you had to fire an email off, so everyone used that, but in the background what was really happening is\u2026<\/p>\n<p><strong>[Jacques Declas] \u2026<\/strong>the API made a visit. I mean I&#8217;ll give you another example. If you look at Netflix, they were really the first one to say hey we&#8217;ve got this streaming media type of technology \u2013 how are we going to become a media company? They just wrote a really nice API, really well documented, and said it&#8217;s opening up \u2013 everybody can use it \u2013 come on in, and they had thousands. And suddenly through their API program they took over the world.<\/p>\n<p><strong>[Alan Shimel] <\/strong>Slack is another one. Otherwise Slack is just AOL instant messenger without the API to integrate all these things.<\/p>\n<p><strong>[Jacques Declas] <\/strong>Exactly, but the problem is an API calls another API that calls 5 other APIs \u2013 it starts to become too complex to handle\u2026<\/p>\n<p><strong>[Alan Shimel] <\/strong>and insecure!<\/p>\n<p><strong>[Jacques Declas] <\/strong>\u2026which data is coming in from where, authentication, authorization, what&#8217;s it allowed to do, how do you filter all this traffic and make sure the right API talks to the right API and more importantly than the API is not compromise.<\/p>\n<p><strong>[Alan Shimel] <\/strong>There\u2019s another piece to it too Jacques, and that\u2019s this: As a developer you want to get your stuff done. You want it to work and want to get it done. You\u2019ve got an API for me that means I don&#8217;t have to reinvent the wheel. Hey man give it to me. Great. But I don\u2019t check it. How do I know that API is secure? How do I know \u2013 the same way when I bring an open source component into my app \u2013 how do I know that component\u2019s not a vulnerable edition or version of that. It&#8217;s the same thing with this API\u2026<\/p>\n<p><strong>[Jacques Declas] <\/strong>&#8230;What kind of library is calling in the back, who&#8217;s done it, and who&#8217;s maintaining\u2026<\/p>\n<p><strong>[Alan Shimel] <\/strong>But I think \u2013 you know developers want to get stuff done, and they don&#8217;t necessarily check that. Is that part of what you guys are doing?<\/p>\n<p><strong>[Jacques Declas] <\/strong>Yes. What we do is we\u2019ve got an out of the box static analysis of the API, sort of a SAST. The good news between API and web application is that in the API world you have a contract. That&#8217;s where we concentrate. It&#8217;s a standard where you can define your data. We help developers define it properly in the contract. So you can&#8217;t just say this is a string. We say \u201cwell, hang on a minute, I can put all kinds of garbage in a string\u201d. Tell me if it&#8217;s an integer if it&#8217;s a credit card \u2013 what is it? Email address? We really give them the tool to have a correct description of the contract and then we automatically apply about 250 rules statically on this. We give them an automatic report and help them by giving code snippets. They don&#8217;t even need to come to our platform \u2013 we integrate with VS Code \u2013 so they stay in their environment. It&#8217;s free because they don&#8217;t like to spend any money \u2013 the developers. So that\u2019s how we are helping them to scan and go all the way to effectively producing firewall functionality across their API and connection.<\/p>\n<p><strong>[Alan Shimel] <\/strong>Because then there&#8217;s that real time element you have as well.<\/p>\n<p><strong>[Jacques Declas] <\/strong>So, because we try to integrate our firewall technology and our protection into the CI\/CD pipeline. If a developer use GitHub for example, they push a new version of the API into GitHub we&#8217;ll pick it up automatically through our integration, and then we&#8217;ll launch our scan, our security audit assessment, recheck the policies and tell the developer <em>\u201coh hang on a minute you score has gone down to 55 because of this \u2013 fix it\u201d <\/em>and then everything gets deployed in the developer pipeline including the generation of our firewall rules. It&#8217;s truly real time with what they do \u2013 because otherwise if you do it somewhere else it&#8217;s not integrated, it&#8217;s too late, it&#8217;s too difficult \u2013 and some of our customers have thousands of APIs. It&#8217;s incredible.<\/p>\n<p><strong>[Alan Shimel] <\/strong>I know we were talking at your booth, you know the average enterprise, from the surveys I saw, is running somewhere between 1,000 and 1500 internally developed applications, and I don&#8217;t mean commercial cards off the shelf. Each one of those is integrating with multiple APIs. You can see real quick how it goes to 5,000 to 10,000.<\/p>\n<p><strong>[Jacques Declas] <\/strong>Yeah, and that&#8217;s why we think the old model of web application firewalls needs to do east\/west traffic and any to any traffic. That&#8217;s why you need to be everywhere. We&#8217;re putting our micro-firewall right next to the API, so in a Kubernetes world right into the same pod which contain the API itself so that you can get as close to the API as you can.<\/p>\n<p><strong>[Alan Shimel] <\/strong>How can people get more information?<\/p>\n<p><strong>[Jacques Declas] <\/strong>Just come to 42crunch.com or visit our community APIsecurity.io. There is a free API audit tool that everyone can try out \u2013 no information necessary.<\/p>\n<p>&nbsp;<\/p>\n<p>Try our <a href=\"https:\/\/apisecurity.io\/tools\/audit\/\">security audit<\/a> for free. If you want to see the whole platform in action, <a href=\"https:\/\/42crunch.com\/request-demo\/\">request a demo now<\/a>!<\/p>\n<p>For news on all things API &#8211; visit <a href=\"https:\/\/apisecurity.io\/\">APIsecurity.io<\/a> and sign up for the weekly newsletter.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>42Crunch CEO, Jacques Declas, sat down with Alan Shimel of Digital Anarchist at this year&#8217;s RSA APJ show to discuss new trends in API Security, DevSecOps, and what tools you need to keep up! &nbsp; [Alan Shimel] Hey everyone, it\u2019s Alan Shimel for DevOps.com Security Boulevard. We\u2019re here in Singapore at RSA APJ. We\u2019re right [&hellip;]<\/p>\n","protected":false},"author":13,"featured_media":11329,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"Revolutionizing API Security with 42Crunch &amp; Digital Anarchist","_seopress_titles_desc":"42Crunch CEO, Jacques Declas, sat down with Alan Shimel of Digital Anarchist at RSA to discuss new trends in API Security and DevSecOps","_seopress_robots_index":"","site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"disabled","ast-hfb-above-header-display":"disabled","ast-hfb-below-header-display":"disabled","ast-hfb-mobile-header-display":"disabled","site-post-title":"disabled","ast-breadcrumbs-content":"disabled","ast-featured-img":"disabled","footer-sml-layout":"disabled","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[6],"tags":[14,22],"class_list":["post-7633","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-api-security","tag-api-security-platform"],"_links":{"self":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts\/7633"}],"collection":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/comments?post=7633"}],"version-history":[{"count":0,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/posts\/7633\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/media\/11329"}],"wp:attachment":[{"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/media?parent=7633"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/categories?post=7633"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/staging2022.42crunch.com\/wp-json\/wp\/v2\/tags?post=7633"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}