Personas workflow ↗

The workflow outlines the responsibilities of each persona to detect, assess, protect, and secure the API assets across the organization, focusing on the main API security elements:

  • Visibility
  • Posture Management & Risk Profiling
  • Threat Detection & Response

SOC analyst

Responsibility: Real-time threat detection & response

The SOC analyst is the key to identifying and investigating API vulnerabilities and attacks within an organization.

Steps:

  1. Visibility: Reviews the Cases & Issues module for new attacks.

  2. Investigate: Select a case or an issue, analyze involved APIs and their context, analyze request/response details, and distinguish normal from malicious activity.

    To conduct a deeper investigation to eliminate or contain the threat, investigate the security issue

  3. Decide and Act: Determine if it's a true attack. If so, initiate an immediate response (often outside the UI) and flag for fixes. Close the case in the UI.

Security practitioner

Responsibility: Proactive posture management & risk reduction

The security practitioner uses the UI for continuous risk assessment and orchestration of remediation.

Steps:

  1. Overview of API landscape: In the API Security Management dashboard, review emerging threats and understand the overall security of the API landscape.
  2. Analyze APIs and Risks: Navigate to API endpoints to view all APIs, their risk factors (e.g., internet exposure, sensitive data, authentication/encryption status), and posture issues. Drill down for details.
  3. Manage OpenAPI Specifications: Access the OpenAPI specification files. Review findings on the specification file itself (misconfigurations) and verify API traffic conformance to its specification.
  4. Assign Remediation: Consolidate all findings, group them by application owner, and distribute tasks (via email/tickets with timelines) for fixes (code, gateway, specification updates).

Workload owner

Responsibility: Application security accountability

The workload owner acts on security tasks, primarily outside the UI.

Steps:

  1. Receive Tasks: Get detailed security tasks and timelines from the security practitioner.
  2. Implement Fixes: Apply necessary fixes to application code, API configurations, or OpenAPI specifications.
  3. Ensure Compliance: Bring their APIs and assets into alignment with security standards.