Why Developers Struggle with API Security
summary
Claims that organizations need one appsec per five devs, that testing suffers from a production bias, and that security must move left drive the talk. Concrete tooling advice names SCA tools (Snyk, npm audit, Fossa, GitHub Dependabot), static analysis like SonarQube, DAST/RASP for runtime checks, and a StackHawk demo. Practical steps: generate OpenAPI specs, run security tests locally and in CI/CD, treat security checks as unit tests for microservices, and seed the database to avoid noisy production scans.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:08Scott Gerlock
- 1:13Why Do You Want Good Api Security
- 1:55Static Code Analysis
- 3:36Runtime Application Security
- 13:22Api Security Tools
- 23:37Api Practice Best Practices
- 26:50What's Your Opinion on Training Qa Members To Do Appsec in the Context of a Small Startup
- 27:35Can the Security Scan Be Done in Stage or Uat Environment
- 30:38Conclusion
related talks
28mWhy Developers Struggle with AppSec
24mAPI Security in DevSecOps: Built-In, Not Bolted On
17mAPI Security Simplified: Practical Tips & Tools
16mDo the Right thing, shift Left!
27mDevelopers Struggle with Application Security (and How to Make ...)
39mSecurity Tooling in Your DevOps Pipeline
26mBeyond Testing: Application Security in the Age of DevOps
08mAutomated Security Testing for JS Apps