How deeply does Secure APIs cover data inventory?

Defines collection, storage, retention, exposure, and update questions, but stops short of prescribing inventory tooling or implementation.

Data inventory in Secure APIs

A data inventory is a catalog of the data an organization possesses, exposes, or processes and the locations where it resides.

A data inventory catalogs the data an organization collects, how it collects it, where it stores it, how long it keeps it, and how APIs expose it. Keeping it current reveals sensitive data and the endpoints that handle it. section 2.1

Evaluate the inventory by asking:

What kinds of data do you collect, and how do you collect them? section 2.1
Where is the data stored, how long is it retained, and is the inventory updated regularly? section 2.1
How does the API expose the data, and which endpoints contain the most sensitive information? section 2.1
Check whether the inventory is continuously updated; mature API security operations know what sensitive data they expose and where. section 2.7

Table 2.1 API security posture evaluation questionnaire¹

	Mature	Not mature
Data inventory Is your data inventory up to date and continuously updated?	Yes	No
Attack surface Is your attack surface completely mapped and always up to date?	Yes	No
Authentication and authorization Do you follow best practices and standards for authentication and authorization?	Yes	No
Access controls Do you have secure and strict access controls, and are they continuously updated?	Yes	No
Secure implementation Do you use secure design and implementation patterns?	Yes	No
Security testing Do you continuously test your APIs for security?	Yes	No
Risk analysis Have you mapped out your API business risks, and are they continuously updated?	Yes	No
Incident detection Do you have proper API observability and automated detection of malicious activity?	Yes	No
Incident response plan Do you have a detailed response plan for security breaches, and is it continuously updated?	Yes	No
Training and awareness Do you continuously train your staff on API security?	Yes	No
¹Answer yes only when you’re 100% into a category. If you’ve mapped 95% of your attack surface, for example, that’s still no, and if your data inventory is updated regularly but not continuously on every change, that’s still no.

Use the posture questionnaire to assess whether the data inventory is current and continuously maintained. section 2.1

How Secure APIs covers it

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.

Data inventory

Table 2.1 API security posture evaluation questionnaire1

How Secure APIs covers it

Related concepts

Table 2.1 API security posture evaluation questionnaire¹