API security
summary
Claims that API attacks are usually low-skill, long-lived slow drip exfiltration and that 90% of companies have faced an API incident; predicts nearly 1 billion APIs in the next decade, creating massive attack surface. Recommends a shift left and integrate right workflow: static analysis of code and OpenAPI/Swagger, active testing for business-logic flaws (curl fuzzing, parameter tampering), and runtime discovery. Offers a free Swagger/OpenAPI scanner at kicks.checkmarks.net to enumerate APIs and find excess data exposure.
AI-written summary · about
chapters (7)
- 0:00Start
- 15:18OWASP API TOP 10
- 18:00Scan your Swagger/Open API now!
- 19:12API Lifecycle
- 21:47Shift Left and Integrate Right
- 23:25CORE PILLARS
- 25:39Strategy and Pillars
related talks
19mAvoid These API Security Pitfalls: Expert Insights
25mThe New API Vulnerability Frontier
26mOffensive API Penetration Testing
26mAPI and Application Security - The Future
58mA Risk based Approach to API Security
17mAPI Security Simplified: Practical Tips & Tools
24mAPI Security in DevSecOps: Built-In, Not Bolted On
43mAPI Security By Design