Securing your APIs at Scale
summary
Demo shows Akamai Control Center + Postman blocking real attacks: five API keys configured with 100 hits per hour quotas, a visual demo sending 30 requests/sec per node for 30 seconds that triggers throttling and denies excess requests, and Postman-driven tests that return 401 for missing keys, 405 for disallowed methods, 403 for SQL injection and geoblocked IPs. Uses WAF rules, rate limits, geoblocking and a positive security model that only allows defined operations and API key enforcement which successfully blocks the malicious traffic.
AI-written summary · about
chapters (7)
- 0:00Introduction and speakers
- 2:11API attack landscape
- 7:54API throttling demo
- 12:03Volumetric attack mitigation
- 13:25API protection demo
- 22:15API security strategy
- 24:19Call to action and resources
related talks
54mFive-step plan for securing your APIs
49mApisecure, 14 & 15 March 2023 - Sudhir Chepeni, Director Products and Technology at Akamai.
20mFrom Chaos to Calm: Navigating Emerging API Security Challenges.
47mAPIs Exposed!
16mMastering API Management and Security
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
33mImproving API Security Posture.
45mAPI Security: Acting Now to Enable Security Controls