Lessons from API Breaches: Securing Your Digital Infrastructure
summary
FireTail’s decade-long breach review finds the number of exposed records almost tripled this year and shows authentication and authorization as top two vectors across incidents. Concrete examples: 3 million Peloton records leaked via sequential IDs without server-side authorization, Lemonade data indexed because APIs required no token, and a GraphQL endpoint that could leak nearly 100 million user records. Root cause is application logic and misconfiguration on EC2/Lambda/Kubernetes behind API gateways; recommended fixes are discovery, continuous policy assessment and runtime enforcement.
AI-written summary · about
chapters (12)
- 0:00API security breaches intro
- 1:53Speaker background
- 4:00API breach data analysis
- 8:09API security report findings
- 10:14Peloton breach case study
- 12:41Lemonade indexing vulnerability
- 14:05Starbucks GraphQL exposure
- 16:10Industries hit by API breaches
- 18:16Why traditional security fails
- 19:19API security strategy core
- 21:26DevSecOps approach
- 22:51Summary and call to action
related talks
22mHow to Fortify Your API Against Multi-Vector Threats
29mDecoding a Decade of API Breaches: Key Learnings Unveiled
59mInside the Breach: Secrets Exposed
32mDo This, Not That – Lessons from 7 Headline Grabbing Security Breaches
57mLessons From Billions of Breached Records
35mClosing Keynote Day 1 API First Hacking
01h 29mAPI Vulnerabilities and What to Do About Them
31mStandard Classification: API Security Top 10 - A Beginner's Guide to Mitigation