Attack Vectors: A Developer's Perspective
summary
A FinTech developer from QIWI analyzes API attack vectors that arise from weak application architecture or coding mistakes, with examples related to PCI DSS-level security concerns. The talk covers specific types of API vulnerabilities and outlines defensive techniques and preventive measures to harden applications.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:56App security relevance
- 3:01Security standards and tools
- 5:33OWASP and projects
- 7:42OWASP Top 10 and training
- 10:18OWASP Top 10 2023 changes
- 11:28Access and resource vulnerabilities
- 16:28CSRF and config issues
- 20:05Trust in third-party services
- 23:14PCI DSS standard
- 26:05Infrastructure scanning
- 27:12Data encryption and passwords
- 28:16Dependency vulnerability analysis
- 29:21Incident management
- 30:02API example analysis
- 35:31Replay attack vulnerabilities
- 37:20Idempotency and request signing
- 41:25Request forgery protection
- 42:29Certificate info leaks
- 44:57XSS protection principles
- 46:46Key takeaways
- 47:52Conclusion
- 48:12Q&A
