API Security Trends: Securing Large API Landscapes

APIs and API security have come a long way. It started with very centralized models of securing well-known and centrally managed APIs. This model of securing APIs today is challenged by a variety of factors. One factor is that instead of treating security as an afterthought, it should "shift left" and become part of the API design and development process. A second factor is that many organizations only have an incomplete inventory of their APIs, making it difficult to even know what exactly to secure. A third factor is that the increasing variety of API styles and technologies (think SOAP, REST, GraphQL, gRPC, EDA, ...) makes it more difficult to use the exact same approach for securing all these diverse APIs.
In this video, Filip Verloy of Noname Security talks about these challenges and explains how a three-pronged approach can help: Determine which APIs are active; secure the APIs that you know about or have found; and shift left security in an effort to make future APIs secure by design.
APIs "are popping up like mushrooms", and there is no end in sight. Gartner predicts that by 2025, organizations will use three times as many (external) APIs as they are using today. Organizations want the benefits of APIs but they also have to face the challenges that they create. Security is one of these challenges, but with a more comprehensive approach than traditionally, it is possible to secure your API landscape and to make sure that you are managing API risk in a responsible way.