API sprawl & open API: Potential risks of application modernization
summary
Modernization accelerates API churn: 48% of developers push an API to production within one week while 44% have under two years’ experience, and monitoring uncovers that 45% of API traffic goes to shadow APIs. Real incidents include an airline losing $500,000/month to scraping and a bank facing 2 million ATO attempts per hour. Recommended actions are automated discovery and inventory of endpoints and responses, detect auth header absences, classify response data, block single-request exploits in real time, and apply rate limits, CAPTCHAs, deception, quotas and anomaly monitoring for business-logic abuse.
AI-written summary · about
chapters (9)
- 0:00Modernization challenges
- 0:46API threat landscape
- 1:54Development speed risks
- 3:39Bot and logic abuse examples
- 5:38Complexity of BOLA attacks
- 6:35API security framework
- 9:04Identifying implementation flaws
- 10:07Mitigation strategies
- 11:57Monitoring and conclusion
related talks
25mAPI Security Deep Dive: Safeguard Your Digital Assets
31mAPI security
24mSecuring the Modern API Ecosystem
24mAPI security, mitigate API abuses using machine learning
19mAvoid These API Security Pitfalls: Expert Insights
58mA Risk based Approach to API Security
15mDo not live in the Shadow (APIs)
24mAPI Security in DevSecOps: Built-In, Not Bolted On