API Security: Acting Now to Enable Security Controls
summary
Live demo shows an API test lab built on Kong + Cassandra + Docker that exposes token and object-ID flaws allowing one authenticated token to read other users’ records (book titles, emails, passwords) and thus large data leaks. A commercial platform (Noname Security) runs discovery, runtime analysis and posture management across environments, links findings into ticketing (ServiceNow) and blocks risky traffic for automated remediation. Config checks, continuous testing and integration hooks are demonstrated and the blocking/remediation workflow works in the demo.
AI-written summary · about
chapters (6)
- 0:00API security challenges
- 12:04API vulnerabilities demo
- 27:14Security strategy
- 35:52Production analysis
- 41:07Testing and continuous integration for APIs
- 44:20Q&A
related talks
48mAPI Security for Enterprises fireside chat
46mAPI Security – Divide & Conquer
48mNavigating the depths of API security testing
45mOpening Keynote – Tushar Kulkarni
16mApisecure, 14 & 15 March 2023 - Meenakshi Kaushik, Leader - Product Management at Cisco.
44mAll your APIs are mine - Secure them now
24mSecuring AI Integration with API's
33mImproving API Security Posture.