What kind of automated catalog do you use for keeping a list of all 3rd party software API integrations exchanging data to external 3rd parties? Additionally, who does the data classification for all these software integrations in your org? A major issue that we are seeing is dependence on 3rd party software services being called from the various code bases is increasing, and declaring all data sub-processors accurately is a challenge in terms of communication between teams and visibility when audits and customer data privacy requests come through.
Sort by:
I would start with establishing a API Governance body which will include Lead Developers/Architects. Then start analyzing with the biggest platforms first - Salesforce, AWS etc. You should do it platform by platform. We have very effective IDE's and configuration tools which will give the list of all the end points in the code and metadata with some regular expressions. Once you have the list made, keep adding the new ones to the list as the team identifies them. Let the Governance body act as an SME and guide the future implementations. In parallel run a "Technical Debt" program which will either fix the issues in increasing sprints or re-design the whole thing with some new design pattern (Microservices?). And also, the Governing Body should analyze if you need to consume so much data from the 3rd party applications. If any of it is static or doesn't change frequently (lets say quarterly), batch jobs will help to bring in the data. It will also improve the performance of the application.
put rate limits
Limit you APIs and depend more on internal solutions.
I agree that one of the first things to do is establishing governance. In my organization, our application architect developed a web based tool to catalogue all applications, their owners, type of data used, APIs, type of APIs, locally developed or 3rd party …etc. The decision to classify the data is governed by our data classification policy which is under Data Architecture team. The security classification is also done by our cybersecurity team.