Flying blind? - The case for API Security and Observability
summary
Argues that distributed tracing uncovers runtime API topology and data flow so security teams see what developers know; product instruments via in‑app agents, sidecars, API‑gateway mirroring or VPC mirroring and discovers 1,000+ APIs with “80 learned / 11 risky” in the demo. Shows detection of OWASP API Top 10 issues (BOLA, LFI, sensitive data exposure), blocks a remote code execution attempt with blocking RCE (403), attributes attacker activity across traces and raises a threat score for forensics and automated response.
AI-written summary · about
chapters (19)
- 0:00Agenda
- 3:10The implications for security
- 4:52Why distributed tracing
- 9:15User behavior
- 15:21Traceable Platform
- 20:43Broken Object Level Authorization
- 26:26Dating Apps
- 34:14Different environments
- 35:32API Intelligence Dashboard
- 38:11Application Flow
- 41:11API Exposure
- 42:37API Risk
- 44:37Vulnerabilities
- 45:54Backend information
- 46:44API Specific Attacks
- 48:28LFI Attack
- 51:35Remote Code Execution
- 52:57Attacker
- 55:53Conclusion
related talks
33mImproving API Security Posture.
23mTraceable AI
24mAPI security, mitigate API abuses using machine learning
31mAPI security
26mOffensive API Penetration Testing
19mAvoid These API Security Pitfalls: Expert Insights
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
01h 29mAPI Vulnerabilities and What to Do About Them