Marvin, Where is My Secure API?
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Thursday, 2020-11-19· at 13:36· Intrado Virtual Event Platform,·
summary
A proposed system called Marvin monitors the full app lifecycle from repo to runtime and scores or flags APIs so developers pick curated secure APIs, security and SRE teams get real-time compliance reporting, and platform teams see risk to customer data. Examples reference the Monzo microservice dependency graph and the network service mesh project. The talk recommends embedding API reputation in CI/CD, tracking RPC calls, using mitre and ova's attack taxonomies, and presents a prototype vision rather than deployed results.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:30Who is Marvin
- 1:17Historical Context
- 1:48The Problem
- 3:23Marvin Size Problem
- 3:51Marvins Potential
- 4:14What would the app lifecycle look like
- 4:37How would we train Marvin
- 5:08App specific questions
- 5:34Broader questions
related talks
16mApisecure, 14 & 15 March 2023 - Meenakshi Kaushik, Leader - Product Management at Cisco.
43mApisecure, 14 & 15 March 2023 - Brian Joe, Co-Founder, Product at Impart Security.
33mWhy Developers Struggle with API Security
48mAPI Security for Enterprises fireside chat
14mGoing beyond AppSec integration, correlation, and orchestration
59mFlying blind? - The case for API Security and Observability
24mAPI Security in DevSecOps: Built-In, Not Bolted On
16mDo the Right thing, shift Left!