Credit: supplied
API security vendor Noname Security today announced a new release of its platform, with a number of upgrades designed to enhance visibility into a user’s API environment and protect against the growing number of API-based threats.
The growth in the number of those threats has been fueled by the increasing centrality of APIs to modern enterprise computing, Noname said in a press release. The company cited a recent report from IBM as saying that as many as two thirds of all incidents analyzed by IBM’s X-Force security team involved unsecured APIs.
Noname’s latest updates cover a wide range of new capabilities, including customized discovery, Kubernetes features, simplified onboarding and more. The idea, according to the company, is to improve the solution’s coverage and allow it to work more quickly to discover potential vulnerabilities.
“APIs are the connective tissue for the digital world,” said co-founder and CTO Shay Levi, in a statement.
Visibility and discovery key to API security
The updates, as a whole, are well-designed to target the most important parts of the broader API security issue, according to Forrester principal analyst Sandy Carielli. Visibility and discovery, for instance, are still a major challenge to many organizations. “Lots of companies don’t have a sense of what APIs are in their environments or what data is being used,” she said. “Any tooling improvements that add context to the discovery process, which this announcement talks about, I think will be good news for the organizations struggling to understand what they have.”
Part of the problem that improved visibility attempts to solve is the presence of zombie APIs – which are APIs that have been depreciated or forgotten and aren’t in active use, but are still present on a company’s systems – and rogue APIs, which could be used to provide back doors into important subsystems.
Testing APIs for vulnerabilities
Testing, according to Carielli, is the other part of the API security landscape that is effectively addressed by Noname’s latest updates. Testing APIs for vulnerabilities can be time consuming based on the fact that they’re frequently not integrated in to development pipelines – as well as the aforementioned fact that there are increasingly large numbers of them present on the average company’s systems.
“What jumps out to me about [Noname’s announcement] is the idea of leaving no API untested,” she said. “They’re looking not just at the tech but at the business logic aspects of APIs.”
The new features are available now, and no pricing changes were announced.
