API Security for Enterprises fireside chat
summary
Enterprises need automated API discovery and continuous runtime monitoring because major breaches (Parler, Starbucks, Equifax, Capital One) happen from combinations: no auth, no rate limiting, BOLA (broken object level authorization), and no monitoring — Parler exposed tens of terabytes by scraping. Adopt OpenAPI/Swagger contracts, shift-left DevSecOps scans (42Crunch/Postman), enforce authentication/authorization, stitch tokens to users for a single pane of glass, and add ML-based anomaly detection as a Zero Trust post-deployment layer.
AI-written summary · about
chapters (10)
- 0:00Introduction and speakers
- 1:25API security concerns for enterprises
- 3:50APIs as blind spots in security
- 8:08Layers of API security
- 13:02Developer vs security team ownership
- 18:25Post-deployment monitoring and risks
- 23:05OWASP API Top 10 and data validation
- 33:16Actionable recommendations and strategies
- 41:18Zero trust model for APIs
- 45:12Developer mindset and final thoughts
related talks
39mAPI Security: Acting Now to Enable Security Controls
24mAPI Security in DevSecOps: Built-In, Not Bolted On
01h 29mAPI Vulnerabilities and What to Do About Them
25mAPI Security Deep Dive: Safeguard Your Digital Assets
31mAPI security
45mAPI Security: Acting Now to Enable Security Controls
24mAPI security, mitigate API abuses using machine learning
29mAPI Security in 2017