Neosec Ties Its API Security Platform to Kong’s API Gateway

Earlier this year, Neosec, a programming security newcomer, came out of stealth. Their mission? According to Giora Engel, Neosec CEO, take a fundamentally different approach to app and Application Programming Interface (API) security without signatures, a predetermined exploit database, or on-premises deployment.

How does it do that? By automatically finding all your APIs, maintaining a complete inventory of them, and then automatically generating missing documentation for previously unknown APIs. Armed with this data, Neosec audits the API’s risk posture. It then identifies those transferring sensitive data, revealing any discrepancies between existing API documentation and the parameters of the API. By automatically learning the baseline behavior of every API, Neosec then, according to Engel, then flags vulnerable or misconfigured APIs.

Kong Partnership

Now, Neosec has partnered with Kong. to integrate its API security platform with their Kong Gateway. This gives you, Neosec, claims, “a complete enterprise-class solution for managing and securing APIs and microservices. Kong provides the world’s most popular API gateway, built for hybrid, multicloud environments optimized for microservices and distributed architectures. Neosec enables Kong customers to easily gain enterprise API security capabilities to protect their critical business processes.”

Neosec continuously watches how old APIs are used and what new APIs are up to. It also monitors their behaviors for abuse. Then, in concert with the Kong API gateway, they automatically orchestrate conditional responses on specific consumer entities into the Kong API gateway.

“As more enterprises embrace digital transformation initiatives and expose APIs, core aspects of business processes are increasingly put at risk. In this modern environment, API security cannot only create alerts for a security team to evaluate, but it must also work with existing API technologies in creating automated responses,” said Engel. “Our strategic partnership with Kong enables the platforms.”

It appears they’ll work well together. Kong Gateway provides an excellent way to manage the complexities of deploying and using APIs, while the Neosec platform augments the security posture with API discovery, risk assessment, and AI-powered behavioral analysis, detection, and response.

Then, as security incidents appear — and they always do — the Neosec integration automatically creates security policies in Kong Gateway and enables automated responses.

Kong Gateway provides API authentication, authorization, logging, traffic control, caching, and administration. Neosec, for its part, ingests access logs from popular technologies like CDNs, web app firewalls, and API gateways. The Neosec platform enables API discovery and automatically flags meaningful anomalous behaviors within them. The combination enables enterprises to minimize risk with no production pipeline changes.

API Attacks on the Rise

“The stakes for API exposure continue to climb as companies rely more heavily on open infrastructure and connecting applications, systems, and data with each other as well as with customers and partners,” said Reza Shafii, Kong’s vice president of products.

Shafii isn’t wrong. According to a Gartner webinar, next year, 2022, API attacks will become the most frequent attack against enterprise web apps. The more we depend on APIs, the more they’ll be attacked.

You may not use Neosec tomorrow. But I can safely say that if you’re smart and you’re building and running cloud native apps, you’ll either be using it or something a lot like it within the next year. The alternative is serious security breaches within the next year or two.