DEVOPSdigest

CloudVector announced the availability of CloudVector Enterprise Edition, which enhances its pioneering API discovery capability with AI-enabled monitoring and security functionality.

As organizations embrace digital transformation they must reduce the risk of API-related breaches. CloudVector is illuminating an API security blind spot deeper than any other solution, applying intelligent automation for enhanced efficiency and streamlining deployment with a unique architecture that requires no changes to code.

The delivery of business applications as a service has catalyzed the proliferation of APIs across the enterprise. These APIs are an attractive target for attack because they are a flexible communication protocol, similar to how and why HTTP is targeted in attacks on web applications. However, web application firewalls (WAFs) designed to protect web applications and HTTP traffic have been unable to effectively address API security because of underlying limitations in their architecture—they cannot address the fluid nature of APIs. WAF providers are treating web application and API protection (WAAP) as a bolted on solution, when it needs to be addressed with a fundamental shift in architecture.

According to Gartner, "With few exceptions, WAF technology has failed to deliver on the promise to automatically enforce a positive security model. Shorter application project cycles further impede the ability of security teams to implement and fine-tune WAF appliances."1

API management gateways have addressed this fundamental shift in architecture, but they are an inadequate security solution because they require tedious manual processes to obtain visibility into API blueprints and catalogs and are ineffectual against advanced API threats. Time-consuming processes are at odds with an agile development cycle, causing these API catalogs to be ignored or forgotten. But without API catalogs, shadow APIs of unknown origin may become introduced into production environments. Without visibility into these shadow APIs, organizations are blind to their risk. The end result is a new wave of API-related breaches, from Capital One to the United States Postal Service.

The CloudVector advantage is derived from its unique micro sensor architecture and its AI-enhanced ability to discover, monitor and secure all APIs. These smart sensors enable highly scalable cloud deployments without impacting developers, while providing deeper inspection into API parameters than any other solution. Artificial intelligence is applied directly to anomaly detection and the intelligent automation of policy management minimizes the time spent fine-tuning security controls.

"As an innovative startup, APIs permeate our service and our organization, and as a mature startup it is crucial that we demonstrate compliance to both win new business and retain our clients," said Shiva Cheedella, Head of IT and Information Security at THEATRO. "CloudVector is the first solution we have found with the ability to automatically discover and secure all of our APIs. It is a powerful tool to collect evidence for audits while ensuring a secure API environment."

Key Features of CloudVector Enterprise Edition Include:

- AI-Enabled Approach to API Protection – CloudVector applies machine learning and deep learning to automate the continuous discovery of all APIs, monitoring of anomalies, and security enforcement. Intelligent automation of policy management ameliorates workflows by automatically activating advanced security controls after a risk is detected.

- Discover Enterprise API Assets with Live API Catalogs – CloudVector automatically and continuously discovers all API parameters to provide the industry's most accurate and comprehensive API blueprint. Organizations leverage CloudVector to validate its API specs, even if its developers do not catalog them.

- Monitor Anomalies with Automated Detection – CloudVector uses its high fidelity API blueprint to create a baseline behavior model and compare usage patterns. CloudVector models the behavior of the API, the behavior of the user interacting with the API and the behavior of the service hosting the API to monitor for anomalies and to automatically detect advanced API threats. CloudVector can even discover and monitor shadow APIs that have been introduced into a production environment without proper documentation.

- Secure APIs from Abuse with Granular Controls – CloudVector automatically applies AI-enabled protection policies to prevent API abuse and API-related data breaches. Granular controls enable CloudVector to respond at a session level by invalidating the access token of a single session instead of taking down the entire application, even if the application lacks native protection.

- A Micro Deployment with Macro Results – CloudVector leverages a unique micro sensor architecture to be deployed with zero impact to developers, no code changes, and no impact to application performance, or SLAs. This comprehensive solution provides complete visibility and control of every enterprise API asset – even Shadow APIs.

"Organizations are getting serious about the risk of advanced API threats, but they need to realize that the new state of the art attacks won't be detected or prevented by their legacy security technology designed a decade ago before the proliferation of APIs," said Ravi Khatod, founder and CEO, CloudVector. "CloudVector is pioneering a new approach to API security with our unique micro sensor deployment technology, and with Enterprise Edition even the largest organizations in the world can automate the continuous visibility and granular control of their API risk surface."

CloudVector Enterprise Edition is available now.