Securing the Modern API Ecosystem
summary
APIs suffer as much from misconfiguration and network context as from poor code, citing an IBM finding that two thirds of incidents involve misconfigured public APIs and Alyssa Knight research showing 54 of 55 mobile apps and 100% of tested APIs vulnerable to BOLA. Recommended defenses are three pillars: posture management (automatic inventory and metadata), unsupervised machine learning for payload inspection and real‑time detection/response, and CI/CD integrated secure code testing, all usable out-of-band to avoid extra inline proxies.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:00Karls background
- 2:45Why is API so important
- 5:07Why is API security so difficult
- 6:35API Security Top 10
- 11:58Strategies
- 12:48Posture Management
- 14:23Detection Response
- 16:25Code Testing
- 20:23Questions
related talks
31mStandard Classification: API Security Top 10 - A Beginner's Guide to Mitigation
31mAPI security
24mAPI security, mitigate API abuses using machine learning
24mAPI Security in DevSecOps: Built-In, Not Bolted On
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
19mAvoid These API Security Pitfalls: Expert Insights
25mAPI Security Deep Dive: Safeguard Your Digital Assets
22mLayered Approach of API Security Strategies and its Business Impact