DEVOPSdigest

Salt Security announced multiple advancements in discovery, posture management and AI-based threat protection to the Salt Security API Protection Platform.

Salt leapfrogs traditional posture management by providing an API posture governance engine delivering operationalized API governance and threat detection across organizations at scale.

With the latest expansion to its AI-based platform, Salt now delivers:

- API posture governance engine - Which helps organizations minimize risk on their API first journey, by having the ability to author corporate standards for API posture, and assess compliance with those standards, along with industry best practices, and regulatory requirements. Unlike typical API security solutions that focus primarily on detection and mitigation of threats, Salt's platform introduces the first-ever engine dedicated to API posture governance. The new functionality helps ensure that all API lifecycle stakeholders (architects, developers, API product managers, AppSec, SecOps) are in sync and security standards are followed as an API makes its way through its lifecycle.

- New API filtering and querying capabilities - Which provides context rich API asset discovery and management, helping organizations mine more intelligence from their discovered API assets. This feature allows organizations to extract detailed insights about their APIs, such as their purpose, usage patterns, and associated risks. The ability to create posture governance policies directly from these insights is a significant leap forward, offering a new level of depth and customization.

- Enhanced behavioral threat response capabilities - Which will provide SecOps personnel with the capability to more effectively prioritize, triage, and analyze API related security events, and drastically reduce mean time to respond and resolve. More API sprawl means more opportunity for threat actors targeting APIs. This trend will continue in 2024, as evidenced by Salt Security's latest State of API Security Report, Q1 2023, which found a 400% increase in unique API attackers this last year and its State of API Security for Financial Services and Insurance Report where 92% of respondents say they have experienced a significant security issue in production APIs over the past year, with nearly one out of five have suffered an API security breach. Salt's new attacker activity filtering, querying, and threat hunting capabilities leverages findings derived from industry's most mature and advanced behavioral threat detection platform, coupled with its context rich API asset intelligence. The integration of this advanced threat detection with API asset intelligence equips security teams with the tools to rapidly and effectively address API-related security events.

- New ecosystem enrichment capabilities - Which will share API intelligence with the broader lifecycle ecosystem. The platform's enhanced integrations with application security testing platforms, data enrichment through its public API, and advanced outbound integrations (like syslog and Splunk) are designed to ensure that API security is not a standalone effort but an integrated part of the broader security infrastructure. This holistic approach to API security, focuses on both internal asset management and external ecosystem integration. All of these improvements help organizations more easily share and operationalize Salt's API asset and threat intelligence with existing security technology investments.

- Enterprise onboarding and operationalization improvements - Which reduce API risk quickly with minimal operational friction. These latest updates aim to help ease this burden with new improvements in role based access control, improved integrations to corporate identity systems, enhanced system health management and audit controls, and improved data collection and data protection mechanisms.

"APIs sit at the core of today's modern applications, connecting enterprises to vital data and services," said Roey Eliyahu, CEO at Salt Security. "However, with the ever-growing abundance of APIs, businesses are struggling to keep track of the APIs they have within their environment and even more so, are unsure of their current API posture against best practice policy and their own custom policies. By providing the industry's first API posture governance engine, Salt is helping organizations govern their API-first journeys using API intelligence to discover and effectively manage API assets, ensuring that corporate standards and industry best practices are followed throughout an API's lifecycle."

The Salt posture governance engine captures API data with ease, simplifying how organizations share and respond to API threat intelligence. The platform provides pre-packaged templates for accelerated ramp up time, allowing organizations the ability to create their own posture rules, organize and categorize their rules, and extensively filter their APIs. The Salt AI-based runtime engine pulls from the largest data lake in order to continuously train the engine. Salt is the only API security company to deliver AI-based API security, advanced discovery and innovative posture gap analysis, which is needed to unlock the intelligence discovered within APIs.