Don’t Worry, Be API Addressing AppSec’s Modern Challenge
summary
Claims that API security is now modern app security and that access control is the biggest gap backed by concrete outcomes: an OWASP API Security Top 10 is released, cheat sheets are being updated, and an CRAPI intentionally vulnerable API is published for testing. Examples include discovered access control flaws that exposed smart‑vacuum camera feeds and locations. Concrete categories to watch are API1 broken object level authorization API2 broken authentication API5 broken function level authorization.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:20What is API
- 3:59Traditional and Modern Applications
- 6:55Summary
- 7:52What makes API vulnerable
- 9:29CICD
- 10:37Good News
- 11:45Bridging the Gap
- 13:52API Security Top 10
- 19:47Broken Authentication
- 22:55Broken Object Level Authorization
- 25:10Broken Function Level Authorization
- 27:50Summarize
related talks
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
01h 29mAPI Vulnerabilities and What to Do About Them
35mSecuring Your API: The OWASP Top 10
58mA Risk based Approach to API Security
25mThe New API Vulnerability Frontier
27mAddressing OWASP API Security Top 10 starts at design time
25mOWASP Top 10 for APIs
26mOffensive API Penetration Testing