Do the Right thing, shift Left!
summary
APIs at scale (some orgs run 5,000–10,000 APIs) drive the claim: embed API security into the SDLC so vulnerabilities are found early, not fixed later at ~100x cost. Concrete practices: maintain API specs and ownership, turn production attack traces into pre‑prod tests, gate releases in CI/CD, and automate scanning with SAST (SonarQube, Checkmarx), DAST (ZAP) and IAST (Traceable) plus runtime protection. Cited gaps: ~20% integrate security early and ~15% can remediate quickly, so prioritization and developer‑friendly findings are essential.
AI-written summary · about
chapters (8)
- 0:00Introduction to Shifting Left
- 1:05API-first economy and security risks
- 3:12Current state of API security practices
- 5:59What is shifting security left?
- 7:04Challenges in traditional security
- 9:30How to shift security left effectively
- 12:43Closing the loop in development
- 15:12Tools for vulnerability management
related talks
24mAPI Security in DevSecOps: Built-In, Not Bolted On
33mWhy Developers Struggle with API Security
31mAPI security
58mA Risk based Approach to API Security
24mSecuring the Modern API Ecosystem
19mAvoid These API Security Pitfalls: Expert Insights
33mImproving API Security Posture.
16mFuture-Proofing Your APIs: A Holistic Approach to Security, Privacy, and ROI.