API Security: Acting Now to Enable Security Controls
summary
Live demo exposes broken object-level authorization in a sample bookstore API, showing valid tokens used to retrieve other users' books and even change their passwords, run against a Kong + Cassandra setup in Docker (Kong + Cassandra demo). Claims: traditional firewalls miss these API logic flaws, runtime baselining with ML detects behavioural anomalies and flags account‑level breaches, and an out‑of‑band platform performs discovery, automated testing and remediation integrated with workflows like ServiceNow (runtime baselining with ML, ServiceNow integration). Numbers cited include ~800 industry studies and a three‑pillar defence model.
AI-written summary · about
chapters (9)
- 0:00API security workshop intro
- 2:15Current API security risks
- 6:13OWASP Top Ten API flaws
- 9:49Live API attack demo
- 15:24Insecure direct object references
- 23:41Security strategy runtime
- 26:53API security posture pillars
- 33:04Integrating security workflows
- 36:36Platform demo Q&A
related talks
48mAPI Security for Enterprises fireside chat
46mAPI Security – Divide & Conquer
22mLayered Approach of API Security Strategies and its Business Impact
01h 29mAPI Vulnerabilities and What to Do About Them
24mSecuring AI Integration with API's
17mAPI Security Simplified: Practical Tips & Tools
29mAPI Security in 2017
24mAPI security, mitigate API abuses using machine learning