Forrester’s Sandy Carielli Shares Highlights From API Security Report
Forrester analyst Sandy Carielli highlights key API security aspects in Forrester’s report titled “The Eight Components of API Security,” which covers governance, discovery, testing, authentication and protection from API breaches.
See Also: OnDemand | Understanding Human Behavior: Tackling Retail’s ATO & Fraud Prevention Challenge
Over the past year, organizations have recognized the importance of investing in discovery as a foundational step. Now, the focus has shifted to API security testing, protection, detection and response.
Many organizations are grappling with the maturity of these aspects, realizing the need to classify, categorize and protect their APIs. The evolving landscape underscores the complexity of API security, which requires paying attention to multiple areas to ensure a comprehensive and robust security posture.
The journey into API security should not be solitary. Carielli emphasized the necessity of a collaborative process involving the development team and architecture team.
“This has to be a collaborative process with the development team, with the architecture team. Security needs to be by their side, helping to set the guardrails but also allowing them to implement APIs in a way that’s going to help grow the business. It really does have to be a collaborative effort between the two,” she said.
As the API security landscape matures, industry experts predict a trend toward consolidation. “As a security leader, you will likely see more consolidation in the industry, addressing multiple API security use cases through fewer products,” she said.
Carielli also said security leaders need to assess their current components, identify gaps and acknowledge that while consolidation is a prevailing trend, a fully comprehensive solution with just one or a few tools may not be fully realized yet.
In a video interview with Information Security Media Group, Carielli discussed:
- How organizations can strengthen their API authentication and authorization processes;
- Best practices for managing third-party API interactions;
- Emerging API security trends and how to prepare for these changes.
Carielli is a principal analyst at Forrester advising security and risk professionals on application security, with an emphasis on the collaboration among security and risk, application development, operations and business teams. Her research covers proactive security design, security testing in the software delivery life cycle, protection of applications in production environments, and remediation of hardware and software flaws.