Do not live in the Shadow (APIs)
summary
Shadow APIs cause real breaches: industry data shows 31% of malicious API requests hit unknown or unmanaged endpoints, and the Opus incident exposes almost 10 million records after an internet-facing test API used real customer data. The exposed API has no authentication, no authorization and no monitoring, combined with misinventory and legacy dev practices. Recommended fixes are concrete: run combined automated and manual API discovery (Burp Suite, Postman, custom scanners), maintain a central API inventory, baseline traffic, continuous monitoring and shift-left testing.
AI-written summary · about
chapters (12)
- 0:00Shadow APIs introduction
- 1:10Shadow, zombie and orphan APIs
- 2:32Risks of Shadow APIs
- 4:19Opal breach case study
- 6:49Exploiting Shadow API vulnerabilities
- 7:52Detecting and preventing Shadow APIs
- 10:19Manual vs automated discovery
- 10:41Building API inventory
- 12:28Continuous monitoring for APIs
- 12:50API-first security mindset
- 13:35Shift-left threat hunting
- 14:19Conclusion and call to action
related talks
19mAvoid These API Security Pitfalls: Expert Insights
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
24mAPI security, mitigate API abuses using machine learning
29mChasing Shadows: Securing APIs in a Digital Economy
39mThe API Assessment Primer
26mHack Your APIs in 15 Minutes or Less
33mImproving API Security Posture.
26mOffensive API Penetration Testing