API Security in 2017
summary
Predicts a “perfect storm” of breaches by 2017 and prescribes concrete defenses: adopt the neo security stack (OAuth2, OpenID Connect, FIDO, ALFA), split capability into an identity management system, an entitlement system and an API management gateway, and enforce whitelisted redirect URIs. Gives real failures — Heartbleed, POODLE/SSLv3, Shellshock, the iTunes “fappening” and the SnapSave compromise — and shows SnapSave’s stored credentials are what was breached, while an OAuth/OpenID flow would have prevented token theft. Practical ops: SSO + 2FA, no hard‑coded keys, use password managers, monitor and throttle endpoints.
AI-written summary · about
chapters (6)
- 0:00Start
- 13:10Reduce the Number of Passwords
- 16:14Use a Password Manager
- 20:31Neo Security Platform
- 20:46Identity Management
- 26:06Conclusions and Recommendations
related talks
41mAPI Security 2026: How Not to End Up on Have I Been Pwned?
01h 29mAPI Vulnerabilities and What to Do About Them
48mAPI Security for Enterprises fireside chat
08mAPI Security Risks
25mAPI Security Deep Dive: Safeguard Your Digital Assets
31mAPI security
18mAPI Security Simplified: A 5-Pillar Approach
18mSecure your Apps and APIs with strong authentication and Adaptive Access.