The 42Crunch maturity model
In my time as a technical evangelist at 42Crunch, I formulated a six-domain API security maturity model that has proved to be popular with customs in determining both their current security posture and their roadmap toward a more secure posture.
The maturity model features a set of activities for each domain, which may exist to varying degrees based on maturity. For this discussion, we will bucket the activities as non-existent, emerging, or established.
Inventory
An up-to-date and accurate inventory is key to maintaining visibility into the exposed risk and attack surface.
The adage “you can’t protect what you can’t see” applies perfectly to API security. As APIs grow exponentially, fueled by business demand, it is increasingly difficult for security teams to maintain visibility of what APIs exist and what risks they expose.
Three elements are key:
- How new APIs are introduced and tracked in the organization...
